Free, Long-Lived Certificates for Internal Infrastructure
ZerdgeCerts is a private Certificate Authority designed for internal infrastructure, development environments, and scenarios where public CAs like Let's Encrypt cannot be used.
To trust certificates issued by ZerdgeCerts, you need to install the root certificate on your devices.
Common Name: ZerdgeCerts Root CA
Issuer: Self-Signed
Valid From: February 14, 2026
Valid Until: January 21, 2126
CRL Distribution Point: https://iamcheese-man.github.io/Certificates/CertRevokeList
SHA-256 Fingerprint:
fa 8b 46 fa 03 a8 1d 02 56 1e a2 b9 b5 24 59 9c 91 db 01 93 c5 36 4b 79 ca c1 1c c9 d1 6e e5 ab
ZerdgeCerts maintains a public CRL endpoint for real-time certificate revocation checking. This ensures that revoked certificates are no longer trusted.
https://github.com/iamcheese-man/Certificates/blob/main/CertRevokeList/crl.json
To verify if a certificate has been revoked, download the CRL and check against the certificate serial number:
# Download the CRL
curl -O https://iamcheese-man.github.io/Certificates/CertRevokeList/crl.json
# View CRL contents
openssl crl -in crl.pem -noout -text
# Check specific certificate
openssl verify -crl_check -CAfile root.crt -CRLfile crl.pem cert.pem
# Run as Administrator
certutil -addstore -f "Root" ZerdgeCertsCA.crt
# Install to system keychain
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ZerdgeCertsCA.crt
# Copy to certificates directory
sudo cp ZerdgeCertsCA.crt /usr/local/share/ca-certificates/
# Update certificate store
sudo update-ca-certificates
Firefox uses its own certificate store:
ZerdgeCerts is ideal for scenarios where public certificate authorities cannot be used:
Secure your internal services without the complexity of Let's Encrypt DNS challenges.
Issue certificates for devices with IP addresses that public CAs won't sign.
Secure air-gapped or offline networks where external validation is impossible.
Test TLS configurations with realistic certificates in local environments.
Better than self-signed certificates for internal web applications.
Learn PKI concepts with a real working certificate authority.
ZerdgeCerts is NOT trusted by default in browsers or operating systems. It is designed for internal use only. For public-facing websites, use Let's Encrypt or a commercial CA.
Users must manually install the root certificate on each device. This makes it unsuitable for public services where you cannot control client devices.
Need a certificate issued by ZerdgeCerts? Certificate issuance requires proof of ownership to prevent mis-issuance.
You must prove ownership of the domain or IP address before a certificate will be issued. This ensures certificates are only issued to legitimate owners and prevents abuse.
To request a certificate or report security issues:
Include the following in your certificate request:
You will be asked to prove ownership using one of these methods:
Add a specific TXT record to your domain's DNS. This proves you control the domain's DNS settings.
_zerdgecerts-challenge.example.com
TXT "verification-token-12345"
Host a specific file at a well-known URL on your web server to prove control.
http://example.com/.well-known/
zerdgecerts-challenge.txt
Receive a verification code at admin@, postmaster@, or webmaster@ for your domain.
admin@example.com
postmaster@example.com
webmaster@example.com
For IP-based certificates, run a temporary service on a specific port to prove control.
# Listen on specified port
nc -l 192.168.1.100 8443
Submit a CSR proving you control the private key for the requested certificate.
openssl req -new -key private.key
-out request.csr
For internal IPs or special cases, provide evidence of infrastructure ownership (router admin, etc.).
Once ownership is verified, certificates are typically issued within 24-48 hours. Verification must be completed before issuance.
Information about how the root private key is stored and protected.
If you discover a mis-issued certificate or security issue, please report it immediately through GitHub issues or email. Compromised or mis-issued certificates will be revoked within 24 hours of verification.