• Petter1@lemm.ee
    link
    fedilink
    English
    arrow-up
    1
    ·
    3 months ago

    Just use only VPN to access your services behind the reverse proxy, if you want prevent unauthorised connections.

    CA certificates are not here to prevent someone accessing a site, they are here, so that you can be sure, that the server you are talking to is really the one belonging to the domain you entered and to establish a tunnel in order to send the API calls (html, css, javascript etc.) and answers encrypted.

    • BestBouclettes@jlai.lu
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      1
      ·
      3 months ago

      That’s the problem, if anyone somehow gets your root CA key, your encryption is pretty much gone and they can sign whatever they want with your CA.
      It’s a lot of work to make sure it’s safe in a home setup.

      • prime_number_314159@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        ·
        3 months ago

        You can just issue new certificates one per year, and otherwise keep your personal root CA encrypted. If someone is into your system to the point they can get the key as you use it, there are bigger things to worry about than them impersonating your own services to you.

        • Petter1@lemm.ee
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 months ago

          And additionally, you can sign intermediate Certificates reducing the risk even more, since you can revoke and re-issue new ones any time.