https://blogs.damiendye.uk/en/tags/client-certificates/ Recent content in Client-Certificates on Damien Dye's Blog Hugo en-GB Fri, 09 Oct 2026 18:20:00 +0100 https://blogs.damiendye.uk/en/certificates/step-ca-client-certificates-mtls/ Fri, 09 Oct 2026 18:20:00 +0100 https://blogs.damiendye.uk/en/certificates/step-ca-client-certificates-mtls/ Using step-ca to issue client certificates for mTLS, tested with nginx and Caddy. The 24-hour limit and how to raise it, a CRL that rejects everyone until its scope is fixed, the root CRL nginx needs, publishing CRLs over HTTP, the refresh job that stops them lapsing, and the PKCS12 file and CA certificates a phone needs. https://blogs.damiendye.uk/en/homeassistant/home-assistant-app-mtls-nginx-caddy/ Fri, 09 Oct 2026 18:00:00 +0100 https://blogs.damiendye.uk/en/homeassistant/home-assistant-app-mtls-nginx-caddy/ Locking the Home Assistant app to a client certificate with nginx or Caddy at home instead of Cloudflare. What changes when Cloudflare leaves, both configs tested over IPv4 and IPv6, why nginx can check revocation and Caddy cannot, the Home Assistant proxy settings, and what to install on the phone. https://blogs.damiendye.uk/en/homeassistant/home-assistant-app-over-cloudflare-mtls/ Fri, 09 Oct 2026 16:30:00 +0100 https://blogs.damiendye.uk/en/homeassistant/home-assistant-app-over-cloudflare-mtls/ Reaching Home Assistant from the Android app away from home without putting a login page on the internet. The options compared on cost, risk and battery, why Cloudflare Access does not suit the app, the free-plan client certificates and WAF rule that do, the Home Assistant proxy, ban and URL settings, and building the PKCS12 file the phone needs.