A Late-Night Rescue, a Sewer Line I Fixed Myself, and a Full mTLS System Built End to End
One of those days that started with a phone call and ended a dozen commits deep in a certificate authority I built myself.
A rescue in Volo
Got a call from a friend who'd been helping someone move, ended up in an argument with the other guy partway through, and got out of his car at a stoplight rather than ride it out. I drove out to Volo to go get him. Glad he called instead of trying to figure out a ride home on his own at that hour.
Rodding my own sewer main
Rented a 50' drain rodder from the Ace Hardware here in Zion and cleared our sewer main myself instead of calling a plumber. A plumber would have run me over $300 for the same job; the rental was under $60. Good use of an afternoon.
Building a real internal CA from scratch: TrustBridge
The rest of the day went into something I'd been wanting to build for a while: my own certificate authority — a system that issues and manages digital certificates for all my sites, instead of relying only on outside services for that. TrustBridge is a web front-end built on top of an open-source certificate engine, live now at pki.jpps.us — and by the end of the day it could issue four kinds of certificates (website encryption, code-signing, email, and login certificates), each with its own rules on how long it's valid for, plus a real audit trail and a way to check whether a certificate has been revoked.
A few things I had to get right along the way: the industry's maximum lifetime for a public website certificate keeps shrinking (it's 200 days right now, and dropping further over the next few years), and a code-signing certificate's private key has to live on an actual physical security key, not just on a hard drive, if it's going to be trusted. Built both paths: a software option for my own internal testing, and a hardware-backed one where the signing request comes from a YubiKey that never lets the private key leave it.
Also pulled the root key — the one thing every other certificate ultimately traces back to — completely offline once everything underneath it was signed and confirmed working. It's not on any running system anymore, just encrypted and backed up. The only reason it should ever come back out is to replace the certificate just below it.
Client certificates that actually log you in
The real point of all this: certificate-based login. I can now issue myself a client certificate from TrustBridge, install it on a device, and have that device log into admin panels with no password at all — falling back to normal login if no cert is presented.
rust-proxy, the reverse proxy that sits in front of every *.jpps.us site, can now check for one of these login certificates and let a site skip its normal password login if it sees a valid one — falling back to a normal login if no certificate is presented. A security review caught a real gap in my first version: I was telling each app behind the proxy who the verified certificate belonged to, but an app had no way to tell a real verified certificate from someone just forging that message. Fixed it by having the proxy send a shared secret alongside the real message, so an app can tell the difference.
Wired that into store (the licensing/store server) and wiki's admin logins the same way, plus TrustBridge's own admin panel. Later in the day, refined it further: a site can now require one specific person's certificate instead of accepting anyone's, and — the part that actually mattered for day-to-day browsing — rust-proxy now only asks a browser for a certificate on the handful of sites that use this at all, instead of prompting on every single site it fronts.
Finished by making the certificates themselves easier to actually use: a one-click download that bundles everything needed (the certificate, its key, and the chain back to TrustBridge) into one password-protected file, so installing a login certificate on a phone or tablet doesn't mean juggling separate files by hand.