Lion Cipher Lab
Run your own private certificate authority with step-ca
- Identity & Access Management
- Beginner
- ~45 min
- Free · no account required
Why it matters
The moment you run more than one service in a home lab — a dashboard, a Git server, an internal API — you want them on HTTPS, and you immediately hit a wall: a self-signed certificate makes every browser and client throw a scary warning, because nothing vouched for it. The usual bad fixes are to click through the warning every time (which trains you to ignore the exact alarm that protects you) or to disable certificate checking entirely (which throws away the identity guarantee the previous lab was all about). The real fix is the same one the public web uses: run a certificate authority. A…
What you'll learn
- understanding why an internal CA beats self-signed certificates
- the parts of a private PKI (root, intermediate, leaf)
- initializing a CA with step ca init
- running the step-ca server
- issuing a certificate with step ca certificate
- distributing and trusting your root on a client
- the ideas behind short-lived certificates, ACME, and revocation
Steps in this lab
- The self-signed wall — and why the answer is a CA
- The parts of a PKI — root, intermediate, leaf
- Install step and step-ca, then initialize your CA
- Start the CA server
- Issue your first certificate
- Trust your CA on a client
- The concepts that make a CA worth running — short-lived certs, ACME, revocation
- What you just built — and where it goes next