About This Project
Built a complete two-tier public key infrastructure from scratch with OpenSSL, so every internal service runs on trusted HTTPS without depending on a public certificate authority or exposing anything to the internet.
What Was Built
- A self-signed root CA, kept isolated and used only to sign the intermediate
- An intermediate CA that issues all day-to-day service certificates — so the root can stay protected and the intermediate can be replaced if compromised
- A wildcard certificate for the internal domain, valid for two years, with a proper certificate chain
- Deployment to more than ten different systems, each with its own import format: PEM certificate and key pairs, PKCS#12 (.pfx) bundles for applications that require them, and appliance web GUIs
- Root CA distributed to the trust stores of Windows, Firefox, and iOS (including the extra manual trust step iOS requires)
Result
Firewall, virtualisation cluster, DNS consoles, NAS systems, backup server, private cloud, and the reverse-proxied web services all present a valid certificate with no browser warnings — no public CA, no internet exposure.
Also Covered
Retired a legacy CA left over from an earlier naming scheme, and removed a redundant public-CA client and its renewal timer from a server that no longer needed it.
Skills Demonstrated
- X.509 and certificate chains
- OpenSSL CA operation
- TLS deployment across mixed platforms
- Trust store management
- Certificate lifecycle and rotation planning
Project Info
- Category: Security
- Year: 2026
- Status: Completed