My Own Little Certificate Authority: AD CS, Auto-Enrollment and Goodbye to “Your Connection Is Not Private”

Tue, 29 Sep 2026 19:05:28 +0200

My homelab has three domain controllers, two clients, three iLO management boards and, until last week, exactly zero certificates anyone had a reason to trust. Every RDP session started with a warning, every iLO greeted me with “Your connection is not private” (issuer: Default Issuer (Do not trust), which is at least honest), and the domain controllers didn’t speak LDAPS at all.

I don’t run many internal web services, so for a while I assumed a private PKI was a solution looking for a problem. Wrong. A Windows domain has plenty of places where certificates quietly make things better. The trick is to let Active Directory hand them out on its own, so that I never have to think about renewing them again.

Enough YAML for Now: Three Servers, Windows Server 2025, and a Crash Course on the Dark Side

Wed, 23 Sep 2026 21:06:04 +0200

Confession time. After the Nextcloud migration battle log, a double-digit number of playbook runs, one nftables ruleset that cheerfully flushed K3s’ own tables, and more YAML than any human should read in a single week, I had officially had it up to here with Nextcloud, Ansible and anything containing the word “migration”.

So I did what any reasonable Linux nerd does when burned out on Linux: I went over to the other side. Three servers, three fresh installs of Windows Server 2025, and a few evenings of Active Directory, DNS, DHCP, Group Policy, Storage Spaces and BitLocker. No YAML. Just a lot of Get- and Set-.

AD CS – apt-upgrade.me – Homelab, Linux & DevSecOps

My Own Little Certificate Authority: AD CS, Auto-Enrollment and Goodbye to “Your Connection Is Not Private”

Enough YAML for Now: Three Servers, Windows Server 2025, and a Crash Course on the Dark Side