Really. This: https://jamielinux.com/docs/openssl-certificate-authority/ gives you a CA in about an hour. HashiCorp Vault will give you a CA in 5 minutes. certstrap will give you a CA in 15 seconds. It’s 2020, it ain’t voodoo anymore.
Just spinning up a CA is a couple of commands. Running one sanely (to include security of the private keys, availability and auditability of the signing machine, keeping backups, publishing a CRL, setting up ACME if you want any kind of automation) is significantly more involved.
But this is silly. If this isn’t completely trivial to add to your app then something has gone horribly wrong.
* Every machine in your infra already has backups, right? Nothing about your signing boxes are special in this regard.
* All your services are already HA, right? The API servers that now have to run some glorified OpenSSL commands aren’t any different than your normal API endpoints.
* You already have to protect secrets on your machines. DB passwords, API keys. What’s one more?
* You don’t have to implement ACME. These are your devices talking to your devices.
Most hardware in this category really needs to be set-and-forget, whether online or not. You can't have every random sound system and light controller having to dial out to a third party every month. You need to be able to come back five years later and still be able to configure the hardware.
