Deploy your own open-source CA server with Step-CA

Published on Feb 17, 2024

To make my home network safer, I added a FortiGate between my router and my home network. The FortiGate comes with a self-signed certificate for the webinterface, but I want more protection because I don’t trust my cat. So, I’m going to create my own certificate authority (CA) using step-ca. This way, I can manage and revoke certificates if needed.

Step 1: Installing step-ca

First, deploy step-ca as a Docker container with Portainer (which is a tool to manage Docker containers), but you can also do this directly using Docker or on different operating systems without using Docker.

First, create a container with image smallstep/step-ca. Make sure to map port 9000.

Connect a volume and map it to /home/step in the container. This is where the CA will store its data.

Set the following environment variables:

DOCKER_STEPCA_INIT_NAME: the name for your new CA server
DOCKER_STEPCA_INIT_DNS_NAMES: FQDN for your new CA server
DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT: true

Deploy the container and save the administrative username, password, and root fingerprint from the container logs in a secure place. Check if the server is running by going to https://<step-ca-domain>:9000/health.

Step 2: Installing step-cli

Next, make sure you have step-cli installed on your workstation. On MacOS, simply install it thought brew:

brew install step

Initialize step-cli by running

step ca bootstrap --ca-url https://<step-ca-domain>:9000 --fingerprint <root fingerprint> --install

Notice the step cli also installs the root certificate on our system, so the CA is trusted by our OS.

step ca bootstrap --ca-url https://step-ca.masterball.local:9000 --fingerprint 23e95xxxxxxxxxxxxxxxxxxxxxxx --install
The root certificate has been saved in /Users/remcokersten/.step/certs/root_ca.crt.
The authority configuration has been saved in /Users/remcokersten/.step/config/defaults.json.
Installing the root certificate in the system truststore... Password:
done.

To generate a certificate and sign it, we need a one-time token. Generate a token with step ca token <Subject Alternative Name> and save is to a variable to use it in the next step.

In this example I’ll create a token for fortigate.masterball.local and save in the TOKEN variable. When you get promted for the provisioner key, this is the administrative password

TOKEN = $(step ca token fortigate.masterball.local)
✔ Provisioner: admin(JWK)[kid: qFdStxxxxx - xxxxxxxxx - xxxxxxxx]
Please enter the password to decrypt the provisioner key:

Now create a certificate and let step-ca sign it. The command to do so is:

step ca certificate --token <created token> <SAN name> <filename for certificate> <filename for key>

In this step I’ll create a certificate for fortigate.masterball.local and let the CA sign it by providing my generated token.

➜  ~step ca certificate --token $TOKEN fortigate.masterball.local fortigate.crt fortigate.key
✔ CA: https://step-ca.masterball.local:9000
✔ Certificate: fortigate.crt
✔ Private Key: fortigate.key

Your certificate and key are now stored in your working directory. Keep them safe!

Step 3: Add the certificate to FortiGate

The certificate file contains two certificates: the certificate for the FortiGate itself, and the intermediate certificate. We need to grap the intermediate certificate and import in before importing the FortiGate certificate.

Open the fortigate.crt file and cut the last block into a separate file. Call this file something like intermediate.crt

Log in to your FortiGate and install the root (stored in the .step folder in your home folder) and intermediate certificate under System -> Certificates -> Import -> CA certificate

Install the generated certificate for fortigate under System -> Certificates -> Import -> Certificate -> Import Certificate

Under System -> Settings bind the HTTPS server certificate with the imported certificate

Now, when navigating to the FortiGate web interface, the connection is secure with the certificate hierarchy we created.

Conclusion

That’s it! Now my home network is more secure with certificates managed by my own CA, so hopefully my cat can’t capture my credentials.