Emmanuel Konan
Private PKI: a hands-on deployment guide
This guide sets up a private certificate authority with Step-CA, using separate Debian-based CA and client environments. It assumes network connectivity and administrative access to both.
It covers CA initialization, service accounts, file ownership, systemd integration and ACME certificate issuance. Commands and configuration are in the GitBook guide below.
The setup is a learning lab. Production use would require further work on root key protection, issuer authorization, renewal, revocation, monitoring and recovery. HSM integration is not covered.