About

Imported from terminalskills/skills (skills/step-ca/SKILL.md). Install upstream with npx skills add terminalskills/skills --skill step-ca. Copyright stays with the author (Apache-2.0).

step-ca (Smallstep)

Name: step-ca
Author: terminalskills

Overview

step-ca is a private certificate authority for issuing TLS certificates to internal services. Automated certificate issuance, renewal, and revocation — like Let's Encrypt but for private infrastructure.

Instructions

Step 1: Initialize CA

brew install step
step ca init --name "Internal CA" --dns localhost --address :443 --provisioner admin

Step 2: Issue Certificates

step-ca $(step path)/config/ca.json    # start CA server
step ca certificate api.internal api.crt api.key    # issue cert

Step 3: Auto-Renewal

step ca renew --daemon api.crt api.key    # auto-renews before expiry

Step 4: mTLS Between Services

// server.ts — Node.js server with mutual TLS
import https from 'https'
import fs from 'fs'

const server = https.createServer({
  cert: fs.readFileSync('server.crt'),
  key: fs.readFileSync('server.key'),
  ca: fs.readFileSync('root_ca.crt'),
  requestCert: true,          // require client certificate
  rejectUnauthorized: true,
}, (req, res) => {
  const clientCN = req.socket.getPeerCertificate().subject.CN
  res.end('Hello ' + clientCN)
})

Guidelines

Use step-ca for internal services, Let's Encrypt for public-facing.
Short-lived certs (24h) with auto-renewal are more secure than long-lived ones.
ACME protocol support — works with Certbot, Caddy.
Integrates with Kubernetes cert-manager for automatic pod certificates.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/terminalskills-skills-step-ca/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

terminalskills-skills-step-ca.ocm.jsonjson

{
  "ocm": "1",
  "id": "terminalskills-skills-step-ca",
  "kind": "skill",
  "name": "step-ca",
  "description": "Run a private certificate authority with step-ca. Use when a user asks to issue internal TLS certificates, set up mTLS between services, create a private PKI, or manage certificates for internal infrastructure.",
  "publisher": "terminalskills",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "step-ca",
      "pki",
      "certificates",
      "mtls",
      "internal-tls",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Run a private certificate authority with step-ca. Use when a user asks to issue internal TLS certificates, set up mTLS between services, create a private PKI, or manage certificates for internal infrastructure."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/terminalskills/skills",
      "path": "skills/step-ca/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/terminalskills/skills/blob/HEAD/skills/step-ca/SKILL.md",
      "key": "terminalskills/skills/skills/step-ca/SKILL.md"
    },
    "compatibility": "Linux, macOS, Docker",
    "license": "Apache-2.0"
  },
  "instructions": "# step-ca (Smallstep)\n\n## Overview\n\nstep-ca is a private certificate authority for issuing TLS certificates to internal services. Automated certificate issuance, renewal, and revocation — like Let's Encrypt but for private infrastructure.\n\n## Instructions\n\n### Step 1: Initialize CA\n\n```bash\nbrew install step\nstep ca init --name \"Internal CA\" --dns localhost --address :443 --provisioner admin\n```\n\n### Step 2: Issue Certificates\n\n```bash\nstep-ca $(step path)/config/ca.json    # start CA server\nstep ca certificate api.internal api.crt api.key    # issue cert\n```\n\n### Step 3: Auto-Renewal\n\n```bash",
  "cost": {
    "context_tokens": 367
  }
}

Fetch it by URL: GET /api/v1/registry/terminalskills-skills-step-ca/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.