Proxy server beginner question regarding certificate of authority

[patrick3000]

I have OPNsense set up as the firewall for my house. Both my spouse and I work form home, and we rely on the network extensively.

I would like to harden security, and I'm considering setting up a transparent proxy server in OPNsense so that I can subsequently install Zenarmor and ClamAV. However, I'm undecided about this because all the proxy server tutorials I've seen rely on self-signed certificates for SSL access, and there is no way I'd want to install trusted certificates on all client devices in my house, which include numerous Linux and Windows laptops and desktop PCs, as well as phones with IOS.

So, I'm wondering whether there is a way to buy a trusted certificate from an authority and install that in OPNsense for SSL access with the proxy server rather than using a self-signed certificate, which would avoid the need to do any configuration at the client level.  I would think this would be possible, and trusted certificates aren't expensive, but for some reason, all the tutorials I've seen rely on self-signed certificates, so I'm wondering if there's something I'm missing.

Bottom line: Is it possible to install a transparent proxy server on OPNsense and install a trusted certificate of authority, rather than self-signed, so that I can avoid the need to do any configuration at the client level?

[newsense]

Bottom Line:

NO

[patrick3000]

Thanks. I don't understand why, because trusted, signed certificates are available for purchase from various authorities, but I tend to believe that you're likely correct, because I have not yet seen a tutorial that discusses setting up a transparent proxy server with anything other than a self-signed certificate, and given the hassle of configuration at the client level that that entails, I'm guessing that if it were possible to use a trusted certificate form an authority, then the tutorials would discuss how to do so.

[newsense]

You can buy leaf certificates.

What you're asking is if it's not possible to buy an Intermediate CA able to issue _any_ certificates trusted worlwide -- for home use.

[Patrick M. Hausen]

The transparent proxy needs to generate and sign certificates for e.g. forum.opnsense.org, google.com, ... on the fly. So you need a CA certificate. These are not generally available for individuals.

[patrick3000]

Patrick M. Hausen that makes sense. Thanks for the explanation.

[Patrick M. Hausen]

Maybe ask Honest Achmed how to establish your own CA  ;)

https://bugzilla.mozilla.org/show_bug.cgi?id=647959

[patrick3000]

LOL.

On a more serious note, I am now considering setting up a transparent proxy on a single subnet, that's only used by me and has a couple of Linux laptops plus my Truenas servers, and seeing how much of a hassle it is to add the certificates at the client level, without doing it on the other subnets that are used for phones, television, my spouses Windows laptops, etc.

If it works well, maybe I'll expand it to the other subnets later.