step-ca: run your own CA for real HTTPS at home

why your homelab keeps yelling at you about certificates

you spin up a nas, a proxmox box, maybe a pi-hole admin page, and every single one of them hits you with "your connection is not private." so you click advance, proceed anyway, train your brain to ignore security warnings. that's the actual problem. not the warning itself, but the habit you build of clicking through it without thinking. step-ca fixes this by letting you run your own private certificate authority, so your homelab gets real trusted https instead of self-signed garbage your browser hates.

what a certificate authority actually does

a ca is just something that signs certificates and vouches for them. when you visit a public website, your browser trusts it because a known public ca (like let's encrypt) signed its certificate, and your browser already trusts that ca's root certificate. your homelab devices don't have public domain names pointed at the internet, so you can't easily get a public cert for "nas.home." the fix isn't to give up on https, it's to become your own ca and tell your devices to trust you, the same way they already trust let's encrypt.

step 1: create your ca

step ca init

this generates your root certificate and intermediate certificate, the foundation everything else chains back to. it'll ask you for a name, a dns name, and a password to protect the private key. treat that root key like the crown jewels of your homelab. if someone gets it, they can mint certificates that your devices will blindly trust, which is a much bigger deal than one leaked password. keep it on an encrypted drive, back it up offline, and don't leave it sitting in a public docker volume.

step 2: run the ca

once it's initialized, you run step-ca as a service, usually in docker or as a systemd unit, so it's always available to issue and renew certs for your network. this becomes the quiet little service in the corner of your homelab that nothing else depends on until something needs a cert, and then everything depends on it. that means uptime matters here. if your ca goes down, nothing can renew, and eventually certs expire and you're back to browser warnings. treat it like dns or your router, boring but critical.

step 3: issue a certificate for a device

step ca certificate nas.home nas.crt nas.key

breaking this down:

step ca certificate tells the step cli you want to request a new cert from your ca.

nas.home is the common name, basically the hostname this cert is valid for. this has to match what your browser or client expects to connect to, or you're back to warnings.

nas.crt is the output certificate file, the public part you install on the service.

nas.key is the private key, which should never leave that device and should never be emailed, uploaded, or stored in a shared folder.

run this for every internal service you want real https on, your nas, your reverse proxy, your home assistant instance, whatever's got a web ui.

step 4: install the root cert on your devices, once

this is the step people skip and then wonder why it's still not working. your laptop, phone, and any browser need to trust your root ca certificate, the one generated in step 1, not the individual device certs. you add it to your system's trusted root store or your browser's cert manager. do this once per device you use to access your homelab, and from then on every cert your ca issues is automatically trusted, no warnings, no exceptions clicked.

what this means for your actual security

running your own ca gives you encryption that's verified instead of encryption you've trained yourself to click past. it also means your traffic between devices on your lan is encrypted, not just "https in theory." but it puts real responsibility on you: that root key is now a single point of trust for your whole network. rotate certs on a schedule, keep the ca's private key offline when not actively issuing certs, and audit which devices actually have your root cert installed. if you ever decommission a device, revoke its cert instead of just unplugging it and hoping.

the takeaway

stop training yourself to ignore security warnings, because that habit follows you everywhere, including places where the warning is real. running your own ca with step-ca gives your homelab actual trusted https, teaches you how certificate trust works under the hood, and gives you one more system to understand instead of fear. protect the root key like it's the master key to your house, because functionally, it is.