Internal certificate authority with ACME

What was built

Certificates went out by hand, so sometimes they didn't go out at all. I stood up an internal CA. The intermediate is signed by the corporate Windows CA, so nobody had to roll out a new root. ACME issues 60-day certs and renews them itself. Onboarding a service is one command plus a reload hook. Skip the hook and the renewed cert never reaches the daemon. Where ACME can't reach, a panel. Linux only in production so far.

Stack

Other work

• Single source of truth for infrastructure
• 2FA / SSO for mail on Keycloak + ANGIE
• Enterprise infrastructure from scratch
• Managed corporate access client
• Report access gateway on directory groups
• Workplace self-service: software and VDI
• Active Directory hygiene: GPO repair
• Active Directory modernization
• Zabbix + Grafana and automation
• Office-to-DC networking
• Virtualization and vCenter
• Distributed Veeam and DRP
• Infrastructure Q&A agent over MCP
• Multi-agent workflow for solo development
• LLM call analysis and BI/CRM pipeline