Hacker News Reader

Is there any open source self-hosted CA that supports ACME? Boulder (the LetsEncrypt system) has big disclaimers in its docs about it not being a good fit for most companies.

In most large companies, issuing certificates remains a manual process. Generate a CSR, create a ticket, wait for response, download certificate, install on host. ACME seems like it should be the standard API for fixing this.

View on HN

Since version 2003, Windows Certificate Services has automated issuance and renewal to domain joined clients managed via Group Policy. It just works and many orgs use this for managing VPN certificates to fleets of Windows clients, as well as internal TLS server certs. It uses Kerberos/AD for validating certificate names.

No ACME of course, but considering the MSFT certificate management protocol pre-dates ACME by more than a decade that’s not surprising. Traditional manual issuance after CR submission workflow is also supported for any OS.

Reply on news.ycombinator.com