And by letting smallstep/certificates [1] handle ACME, it's just as easy as using LetsEncrypt for public certificates.

[1] https://github.com/smallstep/certificates

This is great, thanks for sharing.

So many hidden gems on github. I’d been searching for something like this.

Sure, distribute your own root CA, but then how do people get signed certificates? I tend to work with large companies, where getting a signed certificate involves opening a ticket and waiting for someone on the other side to respond.

ACME would be ideal, but the official response of Let's Encrypt is that ACME is overkill for corporate environments and you should roll your own certificate automation.

Delegating enroll permissions is a solved problem technically at least in a windows domain. At that point it's an org policy problem and ACME won't help.

In an enterprise, you use the API that a CA provides, and build it into the ticketing system. I helped build a system that took care of this with ServiceNow a few times now.

At one place we aggressively policed external facing certificates. Don’t follow the process, your service gets whacked.

It’s a process you should look into, because the compliance regimes will start paying attention to it someday soon.