April 6, 2026
One binary to rule your certs?
Show HN: I rewrote my 2012 self-signed cert generator in Go – cert-depot.com
2012 weekend hack reborn in Go — devs cheer, ops groan about the real pain: trust
TLDR: A classic self‑signed certificate tool got rebuilt in Go as a single, no‑OpenSSL binary that streams certs without storing them. The crowd applauds the polish, but the loudest point is practical: making every device trust these certs is the real work—and where teams will feel the pain.
A 2012 weekend project just got a glow‑up: cert-depot.com is back, rewritten in Go as a slick, single-file tool that cranks out make-your-own certificates without touching OpenSSL. It streams everything from memory, stores nothing on the server, and packs modern must‑haves like Subject Alternative Names (the browser rule since Chrome 58), plus RSA and ECDSA options and ZIP or PFX downloads. The GitHub is here: dimastopel/certdepot.
Onlookers loved the “no more OpenSSL incantations” energy, but one early voice cut through the hype with a reality check: generating a certificate is the easy part — getting every machine to trust it is the real boss battle. As one commenter put it, SAN support is the right move, but deploying the internal “mini‑authority” across a zoo of laptops, servers, and browsers turns into a long-running headache. Translation: devs are clapping; ops are holding the Advil.
The mood swung between nostalgia and memes — “one binary to rule them all,” “RIP copy‑paste OpenSSL spells” — while the practical crowd warned that self‑signed setups shine for internal tools but come with ongoing maintenance costs. It’s a tidy love letter to Go simplicity, with a side of “don’t forget the trust stores,” and the thread’s energy is equal parts applause and caution tape.
Key Points
- •cert-depot.com was rewritten from scratch in Go as a single, dependency-free binary.
- •Certificate generation now uses Go’s crypto/x509, replacing reliance on OpenSSL.
- •Certificates are generated in memory and streamed; nothing is stored on the server.
- •Supports RSA (2048/4096) and ECDSA (P-256/P-384) with Subject Alternative Names.
- •Outputs available as ZIP of PEM files or as PFX/PKCS#12; source is on GitHub.