

It’s pretty simple to set up. Generate CA, keep key and other private stuff stored securely, distribute public part of CA to whoever you want and sign all the things you wish with your very own CA. There’s loads of howtos and tools around to accomplish that. The tricky part is that manual work is needed to add that CA to every device you want to trust your certificates.




Our opsec is pretty well managed, but I try to squeeze anything I’d need at home to work tasks. I get paid to learn the stuff at work and then I can just implement it on my own environment.