I’ve finally gotten annoyed enough with openssl that I broke down and switched
to using a standalone HashiCorp Vault instance
to manage internal certificates.
It’s a single-node instance which stores data in a local directory. Configuration management for everything except the leaf certificates is managed with some local Terraform code. With my current configuration, no sensitive data is maintained in the Terraform state, so I can track the state file in git along with the configuration — the state is small enough that I’m fine with that.
All of the data on disk is encrypted in the normal Vault way
so I can back up everything with my normal system backup method. I generate
certificates rarely enough that I have a script which starts the vault binary,
runs vault operator unseal, waits for you to tell the script you are done,
shuts down Vault and makes a tarball of the Vault data directory so there’s
a quiescent snapshot of the data for backups.
Since Vault has included an ACME issuer for some time, eventually I can get around to setting up an always-running Vault instance with an intermediate CA so I can use ACME for internal-only services.