Create \/etc\/systemd\/system\/step-ca.service<\/p>\n
Fill it with this, make sure your directories are correct in the ExecStart line:<\/p>\n
[Unit]\r\nDescription=step-ca\r\nAfter=syslog.target network.target\r\n\r\n[Service]\r\nUser=step\r\nGroup=step\r\nExecStart=\/bin\/sh -c '\/bin\/step-ca \/home\/step\/.step\/config\/ca.json --password-file=\/home\/step\/.step\/pwd >> \/var\/log\/step-ca\/output.log 2>&1'\r\nType=simple\r\nRestart=on-failure\r\nRestartSec=10\r\n\r\n[Install]\r\nWantedBy=multi-user.target<\/pre>\nNext, populate the pwd file with the plaintext intermediate CA password. I put mine in \/home\/step\/.step\/pwd<\/p>\n
Next, configure the \/home\/step\/.step\/config\/ca.json file with the port and address you want to host the server behind. I’d recommend 127.0.0.1:8443 and then a nginx reverse proxy in front of it.<\/p>\n
Last, create the log file directories:<\/p>\n
mkdir -p \/var\/log\/step-ca\r\nchown -R step:step \/var\/log\/step-ca<\/pre>\nNow make damn sure it’s hard to login to that box and hard for anyone to read the pwd file.<\/p>\n","protected":false},"excerpt":{"rendered":"