Platform Services

CA & Certificate Infrastructure

Certificate strategy, issuer boundaries, inventory, network policy, and deployment order for public ACME and private step-ca certificates.

Let's Encrypt certificates issued through Cloudflare DNS-01 cover browser-facing services without inbound challenge traffic. A narrowly scoped private step-ca instance covers IPMI/BMC firmware and optional internal mTLS where public ACME is unsuitable.

Issuer Boundary

Certificate decision map

Pick the issuer by trust requirement

Public ACME and private device identity solve different problems; inspect either lane for its boundary.

Target certificate model
Publicly trusted

Let’s Encrypt Through Cloudflare DNS-01

Public trust without exposing an HTTP challenge endpoint.

Private trust

step-ca for Non-Public Device Identities

Useful only where managed clients can trust the private root.

DNS validationIssuance and delivery

Publicly trusted certificates remain the default where possible. Private trust is reserved for device and mTLS use cases.

aorxi.io is hosted on Cloudflare, so DNS-01 can validate internal names under core.aorxi.io without publishing the corresponding A records or opening an HTTP challenge path. Publicly trusted roots avoid private-root distribution for most services.

IPMI/BMC firmware cannot run an ACME client. step-ca provides certificates for those interfaces and may later issue short-lived client certificates for service-to-service mTLS.

DecisionChoice
Primary certificate strategyLet's Encrypt via Cloudflare DNS-01
Public domainaorxi.io
Internal zonecore.aorxi.io; Technitium serves internal records
Private CAstep-ca on sa-ca-01 (10.10.30.30) for IPMI/BMC and optional mTLS only
Kubernetes issuancecert-manager ClusterIssuer per cluster
Non-Kubernetes issuanceOPNsense os-acme-client; acme.sh on Proxmox/PBS
Root trustLet's Encrypt is already trusted; distribute the private root only to managed clients that need it

Runbooks

Public ACME

Create the scoped Cloudflare token and configure OPNsense, Proxmox, PBS, and planned Kubernetes issuance.

Private step-ca

Deploy sa-ca-01, issue IPMI certificates, distribute trust, renew certificates, and protect CA state.

Certificate Inventory

ServiceIssuerHostnameRenewal
OPNsense Site ALet's Encryptsa-fw-01.core.aorxi.ioAuto (os-acme-client)
OPNsense Site BLet's Encryptsb-fw-01.core.aorxi.ioAuto (os-acme-client)
Proxmox sa-edge-01Let's Encryptsa-edge-01.core.aorxi.ioAuto (acme.sh cron)
Proxmox sa-cmp-01Let's Encryptsa-cmp-01.core.aorxi.ioAuto (acme.sh cron)
Proxmox sa-cmp-02Let's Encryptsa-cmp-02.core.aorxi.ioAuto (acme.sh cron)
Proxmox sa-stor-01Let's Encryptsa-stor-01.core.aorxi.ioAuto (acme.sh cron)
Proxmox sb-edge-01Let's Encryptsb-edge-01.core.aorxi.ioAuto (acme.sh cron)
Proxmox sb-cmp-01 through sb-cmp-05Let's Encryptsb-cmp-0x.core.aorxi.ioAuto (acme.sh cron)
PBS sa-pbs-01Let's Encryptsa-pbs-01.core.aorxi.ioAuto (acme.sh cron)
Kubernetes wildcard Site ALet's Encrypt*.core.aorxi.ioAuto (cert-manager)
Kubernetes wildcard Site BLet's Encrypt*.core.aorxi.ioAuto (cert-manager)
IPMI sa-edge-01step-caipmi-sa-edge-01.core.aorxi.ioManual/yearly
IPMI sa-stor-01step-caipmi-sa-stor-01.core.aorxi.ioManual/yearly
IPMI sb-edge-01step-caipmi-sb-edge-01.core.aorxi.ioManual/yearly
IPMI sb-cmp-01 through sb-cmp-05step-caipmi-sb-cmp-0x.core.aorxi.ioManual/yearly

Network Policy

DNS-01 is outbound only. ACME clients require TCP 443 to acme-v02.api.letsencrypt.org and api.cloudflare.com; no inbound challenge rule is required.

ProtoSourceDestinationPortPurpose
TCPVLANs 10, 20, 10010.10.30.309000Private certificate issuance API
TCP10.20.30.0/2410.10.30.309000Cross-site issuance over WireGuard

Keep the Private CA Internal

Port 9000 on sa-ca-01 must never be reachable from the internet. Limit access to trusted administration networks and approved Site B traffic over WireGuard.

Deployment Order

  1. Provision sa-ca-01 after Technitium DNS is available.
  2. Initialize step-ca, add its DNS record, and distribute its root to managed clients that require private trust.
  3. Issue and upload IPMI certificates.
  4. Configure acme.sh on Proxmox and PBS, then verify initial issuance.
  5. Configure os-acme-client on both OPNsense instances.
  6. Deploy cert-manager and ClusterIssuer resources only after Kubernetes clusters exist.
  7. Add expiry monitoring and verify every renewal path.

IPMI remains usable with self-signed certificates before the private CA is deployed; private issuance is a day-2 improvement.

  • DNS VMs: internal records for certificate hostnames
  • IPMI / KVM: BMC access where private certificates are installed
  • Build Phases: dependency order for DNS, certificates, and Kubernetes
  • IP Tables: sa-ca-01 address allocation

Container & Build Infrastructure

Docker Compose setup for running Supermicro Java iKVM on ARM/macOS hosts: build approach, known errors, and SMB file sharing for IPMI virtual media.

Public ACME Runbook

Cloudflare DNS-01 setup and Let's Encrypt issuance for OPNsense, Proxmox, PBS, and planned Kubernetes workloads.