Private step-ca Runbook | AORXI Homelab

step-ca runs on sa-ca-01 for IPMI/BMC certificates and optional internal mTLS. Its private root is distributed only to managed clients that need to verify private-CA-issued identities.

Workload Specification

Field	Value
Workload	`sa-ca-01`
Host	`sa-stor-01`
Form	Ubuntu 22.04 LXC
VLAN	30 (VM Services)
IP	`10.10.30.30`
Resources	1 vCPU, 512 MB RAM, 8 GB disk

Install and Initialize

Check the Smallstep release page for the current supported version before using the version recorded by the source design.

wget https://dl.smallstep.com/gh-release/cli/gh-release-header/v0.27.0/step-cli_0.27.0_amd64.deb
wget https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.27.0/step-ca_0.27.0_amd64.deb
dpkg -i step-cli_0.27.0_amd64.deb step-ca_0.27.0_amd64.deb

step ca init \
  --name "Homelab Internal CA" \
  --dns "sa-ca-01.core.aorxi.io,10.10.30.30" \
  --address ":9000" \
  --provisioner "admin@aorxi.io" \
  --deployment-type standalone

Initialization creates:

/root/.step/certs/root_ca.crt: root certificate distributed to trusted clients
/root/.step/certs/intermediate_ca.crt: signing intermediate
/root/.step/secrets/: CA private keys that require encrypted backup

Record the provisioner password in the approved password manager; it cannot be recovered.

Run as a Service

# /etc/systemd/system/step-ca.service
[Unit]
Description=step-ca
After=network-online.target

[Service]
Type=simple
User=root
ExecStart=/usr/bin/step-ca /root/.step/config/ca.json
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

systemctl enable --now step-ca
curl -k https://10.10.30.30:9000/health

Issue IPMI Certificates

Get the root fingerprint, then issue a one-year certificate for each BMC:

step certificate fingerprint /root/.step/certs/root_ca.crt

step ca certificate \
  "ipmi-sa-stor-01.core.aorxi.io" \
  ipmi-sa-stor-01.crt \
  ipmi-sa-stor-01.key \
  --ca-url https://10.10.30.30:9000 \
  --root /root/.step/certs/root_ca.crt \
  --not-after 8760h \
  --provisioner "admin@aorxi.io"

Upload the PEM certificate and key through Supermicro → Configuration → SSL Certificate → Upload. Repeat for each BMC hostname in the certificate inventory.

Renewal

IPMI certificates do not renew themselves. The source design calls for a yearly reminder or a tested Redfish-based reissue and upload process.

Test Redfish Behavior per Firmware

The upload example is illustrative. Supermicro Redfish certificate endpoints vary by board and firmware; validate the exact endpoint and payload before automating renewal.

step ca certificate "ipmi-sa-stor-01.core.aorxi.io" new.crt new.key \
  --ca-url https://10.10.30.30:9000 \
  --root /root/.step/certs/root_ca.crt \
  --provisioner "admin@aorxi.io" \
  --not-after 8760h

curl -k -u ADMIN:<password> \
  -X POST https://10.10.10.20/redfish/v1/Managers/1/NetworkProtocol/HTTPS/Certificates \
  -H "Content-Type: application/json" \
  -d "{\"CertificateString\": \"$(cat new.crt new.key)\", \"CertificateType\": \"PEM\"}"

Distribute Root Trust

Install the root only on administration workstations and services that verify private certificates.

# Debian / Ubuntu
scp /root/.step/certs/root_ca.crt root@<host>:/usr/local/share/ca-certificates/homelab-root-ca.crt
ssh root@<host> update-ca-certificates

# macOS administration workstation
security add-trusted-cert -d -r trustRoot \
  -k /Library/Keychains/System.keychain homelab-root-ca.crt

Firefox uses its own certificate store; import the root through Preferences → Privacy & Security → Certificates.

Protect and Recover the CA

Do Not Expose step-ca to the Internet

Port 9000 on sa-ca-01 must never be internet-reachable. Permit only trusted administration networks and approved Site B traffic over WireGuard.

Back up /root/.step/, including /root/.step/secrets/, encrypted to PBS-A. Loss of the private keys without a backup prevents continued issuance and recovery of the private CA chain.

Proto	Source	Destination	Port	Purpose
TCP	VLANs 10, 20, 100	`10.10.30.30`	9000	Certificate issuance API
TCP	`10.20.30.0/24`	`10.10.30.30`	9000	Cross-site issuance over WireGuard

CA & Certificate Infrastructure: strategy and inventory
Public ACME Runbook: publicly trusted issuance paths
IPMI / KVM: BMC access and compatibility notes
PBS Backups: backup architecture and unresolved retention policy

On this page