About a week later than planned, I finally have my blogpost on automating step-ca in my #HomeLab, using #Puppet to automatically setup, and ensure renewal of, short-lived ssh certificates on all my hosts.
The end result is that all my internal certificates, both SSH and X509 for TLS have lifespans < 48 hours, so I'm way ahead of the Browser CA Forum's 47-day-lifespan-by-2029-plan.
At least, that's the first half of the post; the second half is then me describing all the services that I can't control through puppet, and how I wrangled them into Supporting SSH certificates whether they wanted to or not. Including #Truenas, #QNAP, #Opnsense, #HomeAssistant and #Forgejo/#Gitea.
It's mostly talking about SSH certs, but it also touches on issuing regular X509 certs for their web interface certificates, for the ones that don't support ACME properly (spoiler: that's most of them 
)
Given this is probably of interest to maybe a dozen people on the Fediverse, it's probably not worth all the time I put into it, but on the plus side, I feel I understand how everything works incredibly well now, which will be useful going forward. (In before someone puts a comment here telling me how I could have fixed some of the problems I hit here much easier!)
Check it out, if it sounds at all interesting to you: https://i.am.eddmil.es/posts/ssh-certificates/
