• prime_number_314159@lemmy.world
    link
    fedilink
    English
    arrow-up
    6
    ·
    3 months ago

    You can just issue new certificates one per year, and otherwise keep your personal root CA encrypted. If someone is into your system to the point they can get the key as you use it, there are bigger things to worry about than them impersonating your own services to you.

    • Petter1@lemm.ee
      link
      fedilink
      English
      arrow-up
      2
      ·
      3 months ago

      And additionally, you can sign intermediate Certificates reducing the risk even more, since you can revoke and re-issue new ones any time.