https://blogs.damiendye.uk/en/tags/pki/ Recent content in Pki on Damien Dye's Blog Hugo en-GB Fri, 09 Oct 2026 18:30:00 +0100 https://blogs.damiendye.uk/en/certificates/step-ca-ssh-certificates/ Fri, 09 Oct 2026 18:30:00 +0100 https://blogs.damiendye.uk/en/certificates/step-ca-ssh-certificates/ Using step-ca as an SSH certificate authority: signing host keys so clients stop asking to trust them, signing user keys so servers need no authorized_keys, the two sshd_config lines and one known_hosts line it takes, what was refused in testing, and renewing host certificates. https://blogs.damiendye.uk/en/certificates/step-ca-client-certificates-mtls/ Fri, 09 Oct 2026 18:20:00 +0100 https://blogs.damiendye.uk/en/certificates/step-ca-client-certificates-mtls/ Using step-ca to issue client certificates for mTLS, tested with nginx and Caddy. The 24-hour limit and how to raise it, a CRL that rejects everyone until its scope is fixed, the root CRL nginx needs, publishing CRLs over HTTP, the refresh job that stops them lapsing, and the PKCS12 file and CA certificates a phone needs. https://blogs.damiendye.uk/en/certificates/step-ca-in-a-container/ Fri, 09 Oct 2026 17:50:00 +0100 https://blogs.damiendye.uk/en/certificates/step-ca-in-a-container/ Smallstep's step-ca in a Podman or Docker container as the certificate authority for everything inside the house: why it beats self-signed and public certificates for internal names, the two passwords the image makes, trusting the root, internal HTTPS over ACME, and renewing services that cannot do ACME.