Bite the bullet and create a Root CA for local network.
As browsers are getting more secure and packed with more safeguards to prevent malicious actors from doing their biddings, they become less friendly with self-signed certificates. This is a pain in small labs and other wall off networks. While using http for non-prod/testing can be a solution, it is not ideal and can create other issues.
Create the simplest CA setup that can be recreated and thrown away at wish.
Create one wildcard server certificate for any servers in the network.
The result is a simple script with an openssl config file that will generate a CA and a wildcard certificate.
$ ./tiny_ca.sh local.local
--- Prepare directory
--- Generate Root Key and Certificate
Generating a RSA private key
writing new private key to './ca/local.local/ca.local.local.key.pem'-----
--- Generate Server Key
Generating RSA private key, 2048 bit long modulus (2 primes)
e is 65537 (0x010001)
--- Generate Server CSR
--- Generate Server Certificate
Using configuration from ./ca/local.local/ca.local.local.cnf
Check that the request matches the signature
Serial Number: 4096 (0x1000)
Not Before: Feb 7 21:28:34 2020 GMT
Not After : Feb 4 21:28:34 2030 GMT
countryName = CA
stateOrProvinceName = local.local
organizationName = local.local
commonName = *.local.local
X509v3 Basic Constraints:
Netscape Cert Type:
OpenSSL Generated Server Certificate
X509v3 Subject Key Identifier:
X509v3 Authority Key Identifier:
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication
Certificate is to be certified until Feb 4 21:28:34 2030 GMT (3650 days)
Sign the certificate? [y/n]:
1 out of 1 certificate requests certified, commit? [y/n]Write out database with 1 new entries
Data Base Updated
--- CA Certificate:
--- Server Certificate:
Install CA certificate into browser or OS.
Install server certificate and key into webserver.
Most modern browsers will not accept wildcard certificate for TLD (top level domain). For example *.local, *.com, will not work.
Install CA in Ubuntu
Copy ca certificate to /usr/local/share/ca-certificates and change extension to crt. Then run update-ca-certificates.