Create Your Own Certificate Authority for Traefik SSL using Step CA

Introduction

In this post, I will show you how to create your own Certificate Authority (CA) for Traefik SSL. This is a very useful tool, as it will allow you to easily create SSL certificates for your home lab or development environment. This post will also cover how to use the Certificate Authority to generate SSL certificates for your Traefik reverse proxy automatically using your containerised Step-CA instance.

What is Traefik?

Traefik is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy. Traefik integrates with your existing infrastructure components (Docker, Swarm mode, Kubernetes, Marathon, Consul, Etcd, Rancher, Amazon ECS, ...) and configures itself automatically and dynamically. Point Traefik at your orchestrator, and it will automatically detect and manage your services.

What is Step-CA?

Step-CA is a zero trust certificate authority (CA) built on the smallstep platform. It is designed to be a simple, secure, and scalable CA that you can use to issue TLS certificates to your infrastructure. It also has an ACME provisioner which allows you to automatically generate certificates for your Traefik reverse proxy.

What is a Certificate Authority?

A Certificate Authority (CA) is an entity that issues digital certificates. A digital certificate is a small data file that binds a public key with an entity's details. The most common use for digital certificates is to enable Transport Layer Security (TLS).

Why use a Certificate Authority?

The main reason to use a Certificate Authority is to enable TLS. TLS is a cryptographic protocol that provides communication security over the Internet. It is used to secure HTTP, FTP, SMTP, POP3, IMAP and other applications that use the TCP/IP protocol to provide communication services.

Why use your own Certificate Authority?

Using your own Certificate Authority means that you don't have to pay for a certificate. This is especially useful if you are running a home lab, or you have a small website that doesn't need a lot of traffic.

Step 1: Create a Docker Compose file

Create your docker-compose.yml

docker-compose.yml

Yaml

version: "3.9"
services:
  step-ca:
    image: smallstep/step-ca
    environment:
      DOCKER_STEPCA_INIT_NAME: Smallstep
      DOCKER_STEPCA_INIT_DNS_NAMES: dev.local,local
      DOCKER_STEPCA_INIT_PROVISIONER_NAME: admin
      DOCKER_STEPCA_INIT_PASSWORD: pass123
    ports:
      - 9000:9000
    volumes:
      - ./data/step-ca:/home/step

Initialization of your step-ca instance

Create your data directory

Create data directory

Bash

mkdir -p "$PWD/data/step-ca" && sudo chown -R 1000:1000 "$PWD/data/step-ca"

Initialize your step-ca instance

Initialize step-ca

Bash

docker run --rm -it -v "$PWD/data/step-ca:/home/step" smallstep/step-ca step ca init

Add your password

Add password

Bash

echo <your password here> | sudo tee "$PWD/data/step-ca/secrets/password"
sudo chown -R 1000:1000 "$PWD/data/step-ca/secrets/password"

Start your step-ca Instance

Start step-ca

Bash

docker-compose up -d step-ca

Once going through, save your Root fingerprint somewhere to use afterwards. Step output

Bash

Generating root certificate...
all done!

Generating intermediate certificate...
all done!

✔ Root certificate: /home/step/certs/root_ca.crt
✔ Root private key: /home/step/secrets/root_ca_key
✔ Root fingerprint: f032205...
✔ Intermediate certificate: /home/step/certs/intermediate_ca.crt
✔ Intermediate private key: /home/step/secrets/intermediate_ca_key
✔ Database folder: /home/step/db
✔ Default configuration: /home/step/config/defaults.json
✔ Certificate Authority configuration: /home/step/config/ca.json

Your PKI is ready to go. To generate certificates for individual services see 'step help ca'.

FEEDBACK 😍 🍻
The step utility is not instrumented for usage statistics. It does not
phone home. But your feedback is extremely valuable. Any information you
can provide regarding how you’re using step helps. Please send us a
sentence or two, good or bad: feedback@smallstep.com or join
https://github.com/smallstep/certificates/discussions.

Check service health

Health check

Bash

curl https://localhost:9000/health

Enable ACME provisioner

Enable ACME

Bash

docker-compose exec step-ca step ca provisioner add acme --type ACME
docker-compose restart

Add CA to your development environment

Bootstrap CA

Bash

step ca bootstrap --ca-url https://localhost:9000 --install --fingerprint <fingerprint-acquired>

Example Bootstrap

Bash

step ca bootstrap --ca-url https://localhost:9000 --install --fingerprint f0322055102894cae067c9e23ed3139f670f39c54233a5012f2c723614868d58

Create a sample certificate for localhost

Generate certificate

Bash

step ca certificate site.myhost.local site_home_local.crt site_home_local.key

Run traefik first

Run Traefik and whoami

Bash

docker-compose up -d traefik && \
sleep 10 && \
docker-compose up -d whoami

Featured Image