skills.rest
L3DigitalNet
L3DigitalNetOFFICIAL
Explore all skills by this author →
WebsiteGitHub

step-ca

Manage Smallstep step-ca private certificate authority lifecycle via the step CLI.

6|1|Updated Feb 16, 2026
Search Tags:#tls#ssl#pki#acme#step-ca#certificate authority#smallstep
One-click install
npx skills add https://github.com/L3DigitalNet/Claude-Code-Plugins --skill step-ca
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: step-ca
Source: https://github.com/L3DigitalNet/Claude-Code-Plugins/tree/main/plugins/linux-sysadmin/skills/step-ca
Command: npx skills add https://github.com/L3DigitalNet/Claude-Code-Plugins --skill step-ca

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill simplifies the complex task of setting up and managing a private Certificate Authority (CA) using Smallstep's step-ca, enabling secure internal communication and authentication.

Core Features & Use Cases

  • CA Initialization: Easily set up a new private CA with root and intermediate certificates.
  • Certificate Issuance & Renewal: Generate and manage TLS certificates for internal services, hosts, and clients.
  • Provisioner Management: Configure different types of provisioners (ACME, JWK, OIDC) for automated certificate workflows.
  • SSH CA: Extend your PKI to manage SSH access securely.
  • mTLS: Implement mutual TLS for service-to-service authentication.
  • Use Case: Secure your homelab services (like Home Assistant, Grafana, or a private Git server) with automatically renewing TLS certificates issued by your own CA, ensuring encrypted communication and trusted access.

Quick Start

Initialize a new Smallstep CA with a DNS name of 'ca.internal' and listening on port 9000.

Frequently Asked Questions about step-ca

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up a private certificate authority for internal services?▼

To set up a private certificate authority, initialize a Smallstep CA with root and intermediate certificates using the CLI. You can then generate and manage TLS certificates to secure internal services and ensure encrypted communication.

Can I automate TLS certificate issuance and renewal for my homelab?▼

Yes, you can automate TLS certificate issuance and renewal by configuring provisioners like ACME. This allows services such as Home Assistant or Grafana to receive automatically renewing certificates issued by your private CA.

What is the best way to implement mutual TLS for service-to-service authentication?▼

The best way to implement mutual TLS is by using a private certificate authority to issue client and server certificates. This secures service-to-service communication by requiring both sides to present trusted certificates during the handshake.

Does step-ca support SSH certificate management alongside TLS?▼

Yes, step-ca supports SSH certificate management, allowing you to extend your PKI to manage SSH access. You can configure an SSH CA to securely issue and manage user and host SSH certificates.

How do I configure different provisioners for automated certificate workflows?▼

You configure provisioners like ACME, JWK, or OIDC in the ca.json file to manage automated certificate workflows. These provisioners define the rules and authentication methods clients use to request certificates.

Do I need to manually distribute root certificates to clients for a private CA?▼

No, you do not need to manually distribute root certificates because step-ca supports client bootstrapping. Clients can automatically retrieve and trust your root certificate using the step CLI, establishing trust without manual intervention.

Related Skills

Explore More Software Engineering Skills→
nnkiennnnkienn
1

3d-games

Explain 3D game development principles including rendering, shaders, physics, and camera systems.

Community
Intermediate
wesleyegbertowesleyegberto
3

mtls-configuration

Configure mutual TLS in Istio, Linkerd, and SPIFFE service meshes.

Community
Advanced
RedHatProductSecurityRedHatProductSecurity
47

oidc-integration

Implement OIDC authentication for inference engines with external identity providers.

Official
Intermediate
ivanuserivanuser

ssl-certificate-lifecycle

Automate TLS certificate issuance, renewal, and revocation across Let's Encrypt and internal PKI.

Community
Advanced