How Solo Devs Can Secure Internal Services with TLS and mTLS on a Zero Budget

A developer running a small two-server production setup — one hosting Redis, another running Postgres alongside NestJS containers — found that firewall rules and private networking alone did not encrypt inter-service traffic. To address this without costly managed PKI tools or Kubernetes-based solutions, they built a self-hosted Certificate Authority using only OpenSSL. The approach enables both standard TLS and mutual TLS (mTLS), where both client and server authenticate each other, making it suitable for service-to-service communication. The guide covers certificate generation, key custody rules, and lifecycle management including rotation and expiry monitoring. It is aimed at solo developers and small startups who need production-grade encryption without a dedicated security infrastructure budget.