reactor-ca: Manage and Deploy Homelab TLS Certificates

Overview

ReactorCA helps homelab and small-office administrators operate a private Certificate Authority and provide TLS certificates to internal services. It addresses the recurring work of renewing certificates and distributing them to hosts, with a centrally managed store that can be encrypted and kept alongside configuration in Git.

It is best suited to setups where an administrator wants to issue certificates on demand from a desktop or other workstation, rather than run a CA service or automated renewal server. Its workflow manages keys centrally and can run configured deployment commands for target systems.

Key Features

• Create, renew, rekey, import, and inspect a self-signed CA.
• Issue, renew, list, and inspect certificates for configured hosts.
• Encrypt private keys using age with passwords, SSH identities, or age plugins for hardware tokens.
• Export certificates and keys to configured paths, and deploy them using shell scripts.
• Configure X.509 extensions, including name constraints, key usage, and custom OIDs.
• Track certificate status and expiration, with list filters and JSON output.
• Build as a statically linked Go binary without runtime dependencies.

Use Cases

• A homelab administrator issues certificates for LAN services such as dashboards, then deploys them to hosts.
• A small office maintains certificates for internal devices and services without adopting a dedicated CA server.
• An infrastructure Git repository holds CA configuration and an encrypted certificate store, while private keys remain age-encrypted.
• An administrator rotates host keys and renews certificates for multiple devices with a CLI workflow.

Project Facts

• Language: Go
• License: BSD-2-Clause
• Stars: 125
• Forks: 5
• Topics: certificates, homelab, tls-certificate, x509
• Archived: no

Getting Started

Download a pre-built binary from the releases page, or build from source:

git clone https://github.com/serpent213/reactor-ca.git
cd reactor-ca
go build -o ca ./cmd/ca

Then run ca init to create configuration files. See the README for configuration, workflows, and security details.

Alternatives

• certbot: Certbot obtains and renews public certificates from ACME authorities, while ReactorCA manages a private CA and issues certificates for internal services.

Considerations

• ReactorCA is designed primarily for a single root CA directly signing certificates. Intermediate CA support is limited to manually creating and importing one.
• It does not provide certificate revocation, PKCS#12 bundle creation, or an automated renewal daemon. Scheduled renewals require an external tool such as cron or systemd timers.
• Deployment commands execute scripts, so review host configuration and commands before running them.
• Encrypted key protection depends on securely managing the password, SSH identity, or age-plugin hardware identity used to decrypt keys.