Self-Hosted ACME (Automated Certificate Management Environment) Server with Step-CA on Linux 🌱

What is Step-CA?

[Step-CA is] a private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH. -https://github.com/smallstep/certificates

Installing Step-CA and Step-CLI

  1. Log into the Linux device
  2. Run the following commands in a terminal
    # update software repositories
    sudo apt update
    # install available software updates
    sudo apt upgrade -y
    # install prerequisites
    sudo apt install curl wget -y
    # clean up downloaded apt files
    sudo apt clean
    # lookup latest steps-ca release URL
    regex='"browser_download_url": "(https:\/\/github.com\/smallstep\/cli\/releases\/download\/[^/]*\/step-cli_[^/]*amd64\.deb)"' && response=$(curl -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/smallstep/cli/releases/latest) && [[ $response =~ $regex ]] && downloadURL="${BASH_REMATCH[1]}"
    # download steps-ca server
    wget -O ./steps-ca.deb $downloadURL
    # install steps-ca server
    sudo dpkg -i ./steps-ca.deb
    # lookup latest steps-cli release URL
    regex='"browser_download_url": "(https:\/\/github.com\/smallstep\/cli\/releases\/download\/[^/]*\/step-cli_[^/]*amd64\.deb)"' && response=$(curl -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/smallstep/cli/releases/latest) && && downloadURL="${BASH_REMATCH[1]}"
    # download steps-cli client
    wget -O ./steps-cli.deb $downloadURL
    # install steps-cli client
    sudo dpkg -i ./steps-cli.deb
    # create the /etc/step-ca directory
    sudo mkdir /etc/step-ca
    # elevate to root user
    sudo su
    # set the step-ca path
    export STEPPATH=/etc/step-ca

Initialize A New Certificate Authority

  1. Continue with the following commands in a terminal
    # initilize a CA
    step ca init
  2. Select standalone > press Enter
  3. Enter a name for the PKI/Certificate Authority [ie i12bretro Certificate Authority] > Press Enter
  4. Enter the IP address and/or DNS name of the Step-CA host [ie debian.i12bretro.local,192.168.0.57] > Press Enter
  5. Enter the port for Step-CA to listen on [ie :8443] > Press Enter
  6. Enter a first provisioner e-mail address [ie i12bretro@i12bretro.local] > Press Enter
  7. Enter a password for the CA or leave it blank to have a password generated > Press Enter

Installing Step-CA Service/Daemon

  1. Continue with the following commands in a terminal
    # add ACME provisioner
    step ca provisioner add acme --type ACME
    # exit root shell
    exit
    # create password.txt, replace with the CA password
    echo '$YourCAPassword!!' | sudo tee -a /etc/step-ca/password.txt > /dev/null
    # create step-ca user
    sudo useradd --system --home /etc/step-ca --shell /bin/false step-ca
    # set ownership of /etc/step-ca
    sudo chown step-ca:step-ca /etc/step-ca -R
    # limit permissions on the password.txt file
    sudo chmod 400 /etc/step-ca/password.txt
    # create step-ca log directory
    sudo mkdir /var/log/step-ca -p
    # set ownership of step-ca logs
    sudo chown step-ca:step-ca /var/log/step-ca -R
    # edit the ca configuration
    sudo nano /etc/step-ca/config/ca.json
  2. By default, step-ca certificates are only valid for 24 hours. To adjust this, paste the following inside each of the provisioners sections of the ca.json configuration file and adjust the values as needed

    "claims": {
    "maxTLSCertDuration":"26280h",
    "defaultTLSCertDuration":"8760h"
    },

  3. Press CTRL+O, Enter, CTRL+X to write the changes and close nano
  4. Continue with the following commands in a terminal
    # create service file
    sudo nano /etc/systemd/system/step-ca.service
  5. Paste the following configuration into step-ca.service

    [Unit]
    Description=step-ca service
    After=network.target
    StartLimitIntervalSec=0

    [Service]
    Type=simple
    Restart=always
    RestartSec=1
    User=step-ca
    Group=step-ca
    Environment=STEPPATH=/etc/step-ca
    ExecStart=/bin/sh -c "/usr/bin/step-ca ${STEPPATH}/config/ca.json --password-file=${STEPPATH}/password.txt >> /var/log/step-ca/step-ca.log 2>&1"

    [Install]
    WantedBy=multi-user.target

  6. Press CTRL+O, Enter, CTRL+X to write the changes and close nano
  7. Continue with the following commands to enable and start the service:
    # reload systemd services
    sudo systemctl daemon-reload
    # start step-ca service on boot and now
    sudo systemctl enable step-ca --now

Automating Certificate Requests

  1. Log into the server needing to request a certificate
  2. Continue following commands in a terminal window
    # copy the step-ca root certificate to trusted certs
    sudo cp /etc/step-ca/certs/root_ca.crt /usr/local/share/ca-certificates/
    # copy the step-ca intermediate certificate to trusted certs
    sudo cp /etc/step-ca/certs/intermediate_ca.crt /usr/local/share/ca-certificates/
    # update ca certs
    sudo update-ca-certificates
    # remove apt version of certbot if installed
    sudo apt remove certbot -y
    # install snapd
    sudo apt install snapd -y
    # install snap core and update
    sudo snap install core; sudo snap refresh core
    # install certbot snap
    sudo snap install --classic certbot
    # create certbot symbolic link
    sudo ln -s /snap/bin/certbot /usr/bin/certbot
    # request the certificate
    sudo REQUESTS_CA_BUNDLE=/etc/step-ca/certs/root_ca.crt certbot certonly --standalone -d <%host%> --server https://<%step-ca-host%>:<%step-ca-port%>/acme/acme/directory
  3. When prompted, enter an email address and agree to the terms of service
  4. Choose whether to share your email and receive emails from certbot
  5. Certbot will output information regarding the location of the certificate files

Sources: https://smallstep.com/docs/step-ca/installation
https://certbot.eff.org/instructions?ws=other&os=debianbuster
https://smallstep.com/docs/tutorials/acme-challenge/