On: Safari will no longer trust certs valid for more t...

[nimbius]

check out Cloudflares CFSSL https://github.com/cloudflare/cfssl to manage the CA side, its API, and its OCSP

then check out Netflix Lemur for issuing and tracking certs automatically. https://github.com/Netflix/lemur

[dcow → nimbius]

CFSSL was developed with cloudflare-specific use cases in mind. If you're looking for a general purpose personal CA, checkout smallstep/certificates: https://github.com/smallstep/certificates. Full disclosure, I work for smallstep, but we’re not exactly competitors. Regardless, here’s an external analysis of the two: https://jite.eu/2020/2/17/step-ca/

[Mister_Snuggles → dcow]

This looks very nice too! I'll have to look at this one closely, it seems to give me most of what I'm looking for. Thanks!

[Mister_Snuggles → nimbius]

These both look really good! I'll have to check them out in more detail.