UNiXPod

smallstep CA

Pull and Run container

podman pull docker.io/mallstep/step-ca:latest
podman run -itd --name smallstep \
-v /home/support/smallstep:/home/step \
-e "DOCKER_STEPCA_INIT_NAME=UNiXStep" \
-e "DOCKER_STEPCA_INIT_DNS_NAMES=localhost,$(hostname -f)" \
-e "DOCKER_STEPCA_INIT_PASSWORD=strongPassword123" \
--health-cmd 'curl -f -k https://localhost:9000/health || exit 1' \
--health-interval 10s \
--health-timeout 3s \
--health-retries 10 \
--health-start-period 10s \
docker.io/smallstep/step-ca:latest

Increase Min/Max/Default Certificate Duration

Minimum: 5 minutes
Maximum: 2 years and 30 days (18240 hours)
Default: 1 year (8760 hours)

jq '.authority.claims = {
  minTLSCertDuration: "5m",
  maxTLSCertDuration: "18240h",
  defaultTLSCertDuration: "8760h"
}' /home/support/smallstep/config/ca.json > ca.json.tmp && mv ca.json.tmp /home/support/smallstep/config/ca.json
podman restart smallstep

Create CA Bundle

cat /home/support/smallstep/certs/intermediate_ca.crt /home/support/smallstep/certs/root_ca.crt > /home/support/smallstep/certs/fullchain_ca.crt

Generate Server Certificate & Key

mkdir /home/support/smallstep/aws
podman exec -it smallstep step ca certificate aws aws/aws.crt aws/aws.key --san "*.eu-west-2.compute.amazonaws.com" --san "*.eu-west-2.compute.internal" --san "support" --san "localhost" --san "127.0.0.1" --san "::1" --not-after=8760h

Options

--kty=kty The kty to build the certificate upon. If unset, default is EC.

kty is a case-sensitive string and must be one of:

EC: Create an elliptic curve keypair
OKP: Create an octet key pair (for “Ed25519” curve)
RSA: Create an RSA keypair

--size=size The size (in bits) of the key for RSA and oct key types. RSA keys require a minimum key size of 2048 bits. If unset, default is 2048 bits for RSA keys and 128 bits for oct keys.

Renew Certificate

podman exec -it smallstep step ca renew aws/aws.crt aws/aws.key

Install Root\Intermediate CA Certificate on Windows

certutil -user -addstore "Root" root_ca.crt
certutil -user -addstore "Root" intermediate_ca.crt

Verify Server Certificate Against CA Certificate

openssl verify -CAfile fullchain_ca.crt aws.crt

# Output
aws.crt: OK

Display the Contents of a Certificate

openssl x509 -in aws.crt -noout -text

Remove your container

podman stop smallstep
podman rm smallstep