In my quest to issue self signed certifications to machines in the homelab, I first went down the OpenSSL path. Then XCA and now SmallStep. I think the SmallStep configuration may be a winner but then again I thought that about pure OpenSSL and XCA so we will see. Should know by tomorrow.
Regardless, this process is arduous for a fully disconnected network.