Nobody needs ocsp or clr in their homelab. And if they’re a trained netsec professional they know that its far better with short-lived certs than any revocation model. Both zerossl and letsencrypt are easy to use - and works flawlessly with something like caddy on a wildcard domain, or an acme proxy. Openssl is easy, and you can clr with that or even use their ocsp for homelab.

If overcomplicating things is a concern for you, then just use let’s encrypt. Running your own ca is a pain in the ass and probably decreases security for most people due to the difficulty of doing it correctly.

This entire question has oxymorons all over it, but…

• EasyRSA - simple and well-known CLI implementation that is used almost everywhere for OpenVPN
• Step - newer on the block, but seems extremely well documented and fairly well used
• XCA - old-school, but still actively developed. May not even work on more modern machines

I think you search that: https://developer.hashicorp.com/vault/tutorials/pki/pki-engine

https://smallstep.com/docs/step-ca/index.html

There’s basically two executabled involved:

• step is the CLI app used to request certificates
• step-ca is the server process the step client connects to

I’ve got the CA portion bundled into Docker. It can also run as an ACME server (and is compatible with certbot).

Sadly, most of the ones I’ve found are too complicated, and getting all devices to accept the CA is more hassle than it’s worth for self hosting. I’ve given up and just buy my wildcard cert for 60$/yr and just put it on everything.