2d8830960b
All checks were successful
Build and Deploy Hugo / Deploy Hugo Website (pull_request) Successful in 24s
Remove emojis and em dash separators Simplify introductory sentences Standardize section headings
306 lines
8.6 KiB
Markdown
306 lines
8.6 KiB
Markdown
---
|
|
title: "Self-Hosted Certificate Manager"
|
|
date: 2024-08-01T20:00:00+02:00
|
|
weight: 2
|
|
cascade:
|
|
type: docs
|
|
---
|
|
|
|
## Sources
|
|
|
|
- [Official documentation](https://smallstep.com/docs/tutorials/)
|
|
- [Step-CA as a systemd service](https://angrysysadmins.tech/index.php/2022/09/grassyloki/step-ca-run-as-a-systemd-service/)
|
|
- [Certificate management with OpenSSL](https://www.golinuxcloud.com/tutorial-pki-certificates-authority-ocsp/)
|
|
|
|
## About Step-CA
|
|
|
|
Step-CA is a toolset developed by Smallstep, a company specializing in secure identity management and certificate automation.
|
|
Its mission is to simplify setting up and managing your own certificate authorities (CAs).
|
|
|
|
### Key features
|
|
|
|
1. Certificate authority management: easily configure and manage your own CAs. Create root and intermediate CAs, issue certificates, and handle revocations.
|
|
|
|
2. Secure key management: follows best practices for securely storing and managing keys, so your cryptographic keys stay protected from unauthorized access.
|
|
|
|
3. Automation and scalability: works for small to large-scale deployments. APIs and integrations automate certificate issuance, renewal, and revocation across the lifecycle.
|
|
|
|
4. Modern cryptography: Step-CA supports industry-standard X.509 certificates using modern cryptographic algorithms and protocols for encryption and digital signatures.
|
|
|
|
5. Infrastructure integration: integrates with your existing tools and systems, and supports various authentication methods such as username/password, MFA, and external identity providers.
|
|
|
|
6. Auditability and compliance: comprehensive logging and auditing let you track certificate activity and meet compliance requirements.
|
|
|
|
7. Developer-friendly APIs: APIs and SDKs designed for developers make it easy to integrate certificate management into your applications and custom workflows.
|
|
|
|
Step-CA by Smallstep is built to make certificate authority management straightforward: you manage your certificates' lifecycle while keeping your infrastructure protected.
|
|
|
|
## Installation
|
|
|
|
### Binary installation
|
|
|
|
#### 1. Step CLI
|
|
|
|
```bash
|
|
wget https://dl.step.sm/gh-release/cli/docs-cli-install/v0.24.3/step-cli_0.24.3_amd64.deb
|
|
sudo dpkg -i step-cli_0.24.3_amd64.deb
|
|
```
|
|
|
|
#### 2. Step-CA
|
|
|
|
```bash
|
|
wget https://dl.step.sm/gh-release/certificates/docs-ca-install/v0.24.1/step-ca_0.24.1_amd64.deb
|
|
sudo dpkg -i step-ca_0.24.1_amd64.deb
|
|
```
|
|
|
|
#### 3. Creating a dedicated user
|
|
|
|
```bash
|
|
adduser adminCA
|
|
```
|
|
|
|
#### Configuration
|
|
|
|
```bash
|
|
$ step ca init --password-file=password.txt
|
|
✔ Deployment type: Standalone
|
|
What would you like to name your new PKI?
|
|
✔ (e.g. Smallstep) : Lab
|
|
✔ (e.g. ca.example.com[,10.1.2.3,etc.]) : ca.lab.loc, localhost, 192.168.1.101
|
|
What IP and port will your new CA bind to? (:443 will bind to 0.0.0.0:443). 1.101
|
|
✔ (e.g. :443 or 127.0.0.1:443) : :443
|
|
What would you like to name the CA's first provisioner?
|
|
✔ (e.g. you@smallstep.com) : contact@lab.loc
|
|
Choose a password for your CA keys and the first provisioner.
|
|
✔ [leave empty and we will generate one] :
|
|
|
|
Generating root certificate... done!
|
|
Generating intermediate certificate... done!
|
|
|
|
✔ Root certificate: /home/adminCA/.step/certs/root_ca.crt
|
|
✔ Root private key: /home/adminCA/.step/secrets/root_ca_key
|
|
✔ Root fingerprint: 7d754397c6897aa87d21e33c64daad7be087dc6fe18bf04627848ae1c8e26a4f
|
|
✔ Intermediate certificate: /home/adminCA/.step/certs/intermediate_ca.crt
|
|
✔ Intermediate private key: /home/adminCA/.step/secrets/intermediate_ca_key
|
|
✔ Database folder: /home/adminCA/.step/db
|
|
✔ Default configuration: /home/adminCA/.step/config/defaults.json
|
|
✔ Certificate Authority configuration: /home/adminCA/.step/config/ca.json
|
|
|
|
Your PKI is ready to go. To generate certificates for individual services, see `step help ca`.
|
|
|
|
**Feedback:**
|
|
The step utility is not instrumented for usage statistics. It does not contact a central server. Your feedback is, however, extremely valuable! Please consider writing to feedback@smallstep.com, joining GitHub Discussions, or joining us on Discord at [https://u.step.sm/discord](https://u.step.sm/discord).
|
|
```
|
|
|
|
Start Step-CA:
|
|
|
|
```bash
|
|
step-ca .step/config/ca.json
|
|
```
|
|
|
|
#### Enable ACME
|
|
|
|
```bash
|
|
$ step ca provisioner add acme --type ACME
|
|
✔ CA Configuration: /home/adminCA/.step/config/ca.json
|
|
|
|
Success! Your `step-ca` configuration has been updated. To pick up the new configuration, send a SIGHUP (kill -1 <pid>) or restart the step-ca process.
|
|
```
|
|
|
|
#### Running Step-CA as a systemd service
|
|
|
|
Create a file:
|
|
|
|
```bash
|
|
vim /etc/systemd/system/step-ca.service
|
|
```
|
|
|
|
Paste in the following:
|
|
|
|
```config
|
|
[Unit]
|
|
Description=step-ca
|
|
After=syslog.target network.target
|
|
|
|
[Service]
|
|
User=adminCA
|
|
Group=adminCA
|
|
ExecStart=/bin/sh -c '/bin/step-ca /home/adminCA/.step/config/ca.json --password-file=/home/step/.step/pwd >> /var/log/step-ca/output.log 2>&1'
|
|
Type=simple
|
|
Restart=on-failure
|
|
RestartSec=10
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
```
|
|
|
|
Create the log directory:
|
|
|
|
```bash
|
|
mkdir -p /var/log/step-ca
|
|
chown -R adminCA:adminCA /var/log/step-ca
|
|
```
|
|
|
|
Reload the systemd daemon:
|
|
|
|
```bash
|
|
systemctl daemon-reload
|
|
systemctl start step-ca.service
|
|
```
|
|
|
|
### Docker installation
|
|
|
|
```bash
|
|
docker run -it -v step:/home/step \
|
|
-p 9000:9000 \
|
|
-e "DOCKER_STEPCA_INIT_NAME=Lab" \
|
|
-e "DOCKER_STEPCA_INIT_DNS_NAMES=caserver.lab.loc,localhost,192.168.1.101" \
|
|
-e "DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT=true" \
|
|
-e "DOCKER_STEPCA_INIT_ACME=true" \
|
|
smallstep/step-ca
|
|
```
|
|
|
|
## Accessing the CA from another client
|
|
|
|
> [!NOTE] Adjust the port based on your installation:
|
|
>
|
|
> - **Binary:** port **443**
|
|
> - **Docker:** port **9000**
|
|
|
|
Install the Step CLI:
|
|
|
|
```bash
|
|
wget https://dl.step.sm/gh-release/cli/docs-cli-install/v0.24.3/step-cli_0.24.3_amd64.deb
|
|
sudo dpkg -i step-cli_0.24.3_amd64.deb
|
|
```
|
|
|
|
Initialize your CA:
|
|
|
|
```bash
|
|
step ca bootstrap --ca-url https://caserver.lab.loc:$PORT/ --fingerprint 685059c30eb305db5272a7a199a2b5823624d55c732121ac65c06b0915d3c887
|
|
```
|
|
|
|
> [!TIP] To get the **fingerprint**, simply run:
|
|
>
|
|
> ```bash
|
|
> step certificate fingerprint $(step path)/certs/root_ca.crt
|
|
> ```
|
|
>
|
|
> For Docker, check the container logs.
|
|
|
|
Example output:
|
|
|
|
```bash
|
|
admin@User:~$ step ca bootstrap --ca-url https://caserver.lab.loc:$PORT --fingerprint 685059c30eb305db5272a7a199a2b5823624d55c732121ac65c06b0915d3c887
|
|
The root certificate has been saved in /home/admin/.step/certs/root_ca.crt.
|
|
The authority configuration has been saved in /home/admin/.step/config/defaults.json.
|
|
```
|
|
|
|
Install the certificate:
|
|
|
|
```bash
|
|
step certificate install $(step path)/certs/root_ca.crt
|
|
```
|
|
|
|
---
|
|
|
|
> [!TIP] **Installation on Debian:**
|
|
>
|
|
> - Copy the individual CRT files (PEM format) into `/usr/local/share/ca-certificates/`
|
|
> - The files must be owned by `root:root` with `644` permissions
|
|
> - Make sure the `ca-certificates` package is installed (if not, install it)
|
|
> - Then, run as root:
|
|
>
|
|
> ```bash
|
|
> # /usr/sbin/update-ca-certificates
|
|
> ```
|
|
>
|
|
> All certificates will be consolidated into: `/etc/ssl/certs/ca-certificates.crt`
|
|
|
|
---
|
|
|
|
### Obtaining a certificate
|
|
|
|
```bash
|
|
admin@User:~$ step ca certificate nas.lab.loc srv.crt srv.key
|
|
✔ Provisioner: contact@lab.loc (JWK) [kid: chyGkrZqp-BGSHUZ8v3jsPipegt2JLcC7y6RPq4OOkU]
|
|
Please enter the password to decrypt the provisioner key:
|
|
✔ CA: https://caserver.lab.loc:443
|
|
✔ Certificate: srv.crt
|
|
✔ Private Key: srv.key
|
|
```
|
|
|
|
---
|
|
|
|
> [!TIP] To perform a health check:
|
|
>
|
|
> ```bash
|
|
> curl https://caserver.lab.loc:443/health -k
|
|
> ```
|
|
|
|
---
|
|
|
|
You may need to customize the `ca.json` file to increase the minimum certificate validity duration. Here's the directory structure:
|
|
|
|
```bash
|
|
.
|
|
|-- certs
|
|
| |-- intermediate_ca.crt
|
|
| `-- root_ca.crt
|
|
|-- config
|
|
| |-- ca.json
|
|
| `-- defaults.json
|
|
|-- db
|
|
| |-- 000000.vlog
|
|
| |-- 000020.sst
|
|
| |-- KEYREGISTRY
|
|
| |-- LOCK
|
|
| `-- MANIFEST
|
|
|-- secrets
|
|
| |-- intermediate_ca_key
|
|
| |-- password
|
|
| `-- root_ca_key
|
|
`-- templates
|
|
```
|
|
|
|
Example `ca.json` file:
|
|
|
|
```json
|
|
{
|
|
"root": "/home/step/certs/root_ca.crt",
|
|
"federatedRoots": null,
|
|
"crt": "/home/step/certs/intermediate_ca.crt",
|
|
"key": "/home/step/secrets/intermediate_ca_key",
|
|
"address": ":9000",
|
|
"insecureAddress": "",
|
|
"dnsNames": [
|
|
"caserver.lab.loc",
|
|
"caserver",
|
|
"localhost",
|
|
"192.168.1.200"
|
|
],
|
|
"logger": {
|
|
"format": "text"
|
|
},
|
|
"db": {
|
|
"type": "badgerv2",
|
|
"dataSource": "/home/step/db",
|
|
"badgerFileLoadingMode": ""
|
|
},
|
|
"authority": {
|
|
"enableAdmin": true,
|
|
"claims": {
|
|
"maxTLSCertDuration": "4380h"
|
|
}
|
|
},
|
|
"tls": {
|
|
"cipherSuites": [
|
|
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
|
|
],
|
|
"minVersion": 1.2,
|
|
"maxVersion": 1.3,
|
|
"renegotiation": false
|
|
}
|
|
}
|