LLDAP

What does everyone use for their root CA or generating certs for LDAPS? Interested in minimal and fully drawn out solutions to weigh both

Expecting to use the lego acme client with DNS based cert issuance.
if I were to distribute self-signed certs, I'd probably take a look at the tools in the step-ca project.

Letsencrypt, you can probably reuse the http certificate? Not sure about that

This is one of my initial theories as well, I’m even wondering if I place Caddy in front of the application, if I can grab the certs it’s auto generating, but yeah will definitely look into this one further!

Thank you! Hadn’t heard of the step-ca project before and am definitely investigating

i use letsencrypt wildcard certs. i also do all tls termination in nginx, so the various apps i run on different subdomains don't get involved in certificates

i found it easier to update just nginx than figure out how each individual app handles renewals, sighups, reloads, restarts, yadda... just pushed it all through nginx (including LDAPS) and use non-TLS endpoints exposed only to localhost behind it