Automate Local TLS Certificates With Step-CA

Introduction

This tutorial will guide you through the process of automating local TLS certificate management using Step-CA, an open-source certificate authority. By following these steps, you can simplify the creation, renewal, and revocation of TLS certificates for your internal IT devices without exposing them to the public internet.

Step 1: Initial Setup

Before installing Step-CA, ensure you meet the following assumptions:

• You have a basic understanding of command line usage.
• You have access to a server where Step-CA can be installed.
• Your server has internet access for initial setup.

Installation

1. Install Step-CA:

   • Use the following command to download and install Step-CA:

     curl -sSL https://get.smallstep.com/ca | sh
     

2. Verify Installation:

   • Check if Step-CA is installed correctly by running:

     step-ca version
     

Step 2: Configure Password File

Step-CA requires a password file for secure operations.

1. Create Password File:

   • Use the command:

     touch ~/.step/secrets/password
     

2. Set Password:

   • Open the file and enter a strong password:

     nano ~/.step/secrets/password
     

3. Secure Password File:

   • Change the permissions to keep it secure:

     chmod 600 ~/.step/secrets/password
     

Step 3: Bootstrapping and Testing

Now that you have the basic setup, it's time to bootstrap your Step-CA and verify it works.

1. Bootstrap Step-CA:

   • Run the bootstrap command:

     step ca init
     

2. Test the CA:

   • After bootstrapping, generate a test certificate:

     step ca certificate example.com example.crt example.key
     

3. Verify Certificate:

   • Use the following command to check the validity of the generated certificate:

     step certificate inspect example.crt
     

Step 4: Set Up ACME Server

Step-CA supports ACME provisioning, which automates certificate management.

1. Configure ACME Server:

   • Edit the configuration file (found in ~/.step/config/):

     nano ~/.step/config/config.yaml
     

2. Enable ACME:

   • Ensure the following section is included:

     acme:
       enabled: true
     

3. Restart Step-CA:

   • After saving changes, restart the Step-CA service:

     step-ca $(step path)/config.json
     

Step 5: Configure Proxmox VE

Now that Step-CA is set up, you can configure Proxmox VE to use it for managing TLS certificates.

1. Access Proxmox VE Interface.

2. Navigate to Datacenter > Certificates.

3. Add New Certificate:

   • Choose to use an ACME certificate.
   • Enter your internal domain and select the Step-CA as the certificate authority.

4. Test Configuration:

   • Verify that Proxmox VE successfully obtains a certificate from Step-CA.

Conclusion

You've now automated the management of local TLS certificates with Step-CA, streamlining the process of creation, renewal, and revocation for your internal IT devices. Going forward, you can focus on other tasks, knowing your certificates are managed efficiently. For further exploration, consider integrating more features of Step-CA or checking out the documentation for advanced configurations.