https://homelab.tod.net/tags/step-ca/Recent content in Step-Ca on Tod's HomelabHugoen-usMon, 29 Jun 2026 12:00:00 -0400https://homelab.tod.net/posts/downsizing-the-homelab/the-pki-detour/Mon, 29 Jun 2026 12:00:00 -0400https://homelab.tod.net/posts/downsizing-the-homelab/the-pki-detour/<p><a href="https://homelab.tod.net/posts/downsizing-the-homelab/infrastructure-to-build-infrastructure/">GitLab was up</a>. The code had a home. The obvious next question was: how does every other internal service get a TLS certificate?</p> <p>The answer I wanted: something clean, automated, and not requiring full Cloudflare DNS credentials on every host. The answer I got — eventually — was &ldquo;Cloudflare DNS-01, one token per service, and accept the limitations.&rdquo; Getting there took a week on the wrong approach, then six days and three attempts on a more ambitious one. This post is both of those failures, what they cost, and what survived them.</p>