This repo contains a certificate authority that runs standalone in a Docker container. To build the container, run build-container.sh. This is configurable to select the version of the Smallstep CLI and CA tools to install. When you first start the container, an initial setup process will run to create the necessary root certificate and key material, and configure the provisioner for using G Suite for user authentication out of the box.

To set this up, before you run the container for the first time, check out the files in the secrets.example/folder, configure them for your domain's settings, and place the resulting configured files in a new folder named secrets/. Do not commit the material in the secrets/ folder to revision control!.

Once configured, you can start up the container using the included docker-compose configuration file by typing the following:

docker-compose up

This should start up, go through the initial CA configuration, and print the fingerprint of the root certificate to the screen. Save this, as you'll need it for all of the client and SSH host setup to follow.

For more information (and the source of most of the code here), please see this Smallstep tutorial.

On machines that wil be logged into remotely via SSH, use the init_ssh_host.sh script in the repository to provision them. This script must be run as root.

When running init_ssh_host.sh, you'll have to select a provisioner to use for the initial key provisioning. For the default provisioner, the password to use is the one provided at CA setup time via the secrets/rootcert_pass.txt configuration file. Production deployments will use their own provisioner setups, the details of which are site-specific and beyond the scope of this README.

On user machines, install the ssh-agent binary and keychain package.

In the user's .bashrc or similar file, add the following:

# ssh-agent setup
eval $(keychain --systemd --quick --quiet)

Then, to get a user certificate for ssh login, just run the following command, replacing <username> with the G Suite e-mail address for the user.

step ssh login <username>