Learn
The guides on this site tell you what to type. These pages tell you why. Each one explains a piece of PKI in plain words, names the standard it comes from where that matters, and then says what MyOwnPKI does about it. They are written for someone who runs a homelab or a small network and wants to understand the certificates, not only issue them. Where a statement is about this product it holds for the current release; features of later releases are marked as not built.
Questions and pages
| Question | Page |
|---|---|
| What does a certificate authority do, and what does a certificate prove and not prove? | What is a certificate authority? |
| Why a root and an intermediate, why is the root offline, and what if one of them is lost or expires? | Root and intermediate CAs |
What is in a certificate, which fields matter, what do the presets set, and how do I read openssl x509 -text? |
Reading a certificate |
| How does a client decide to trust a certificate, and what does a browser warning mean? | How trust works |
| How can I limit a CA to my own names, and what happens to a name outside? | Name constraints |
| How does a certificate stop working before its end date, and does the server do OCSP? | Revocation |
| How long should certificates and CAs live, and who renews them? | Lifetimes and renewal |
| How does a host get a certificate by itself, and how is this ACME server different? | ACME explained |
| How are the CA keys protected, what is a sealed server, and what can I recover if I lose a secret? | Keys and unsealing |
Reading order for a newcomer
- What is a certificate authority?: the idea.
- Root and intermediate CAs: the structure you are about to build.
- Reading a certificate: what the CA writes.
- How trust works: why clients need your root.
- Keys and unsealing: what you must keep safe, before you install.
- Name constraints and Lifetimes and renewal: how to set the limits.
- ACME explained and Revocation: how certificates are obtained, and withdrawn.
Then follow the guides: Installation, Adding hosts and Best practices.
Where the facts come from
The numbers for MyOwnPKI (lifetimes, limits, defaults) are those of the operations guide and of the code of the current release. General PKI statements follow the standards they name (RFC 5280, RFC 8555 and others). If a page here ever disagrees with the operations guide, the operations guide is right.