This repo contains templates for generating root and intermediate CAs with step-ca and name constraints. Links:
- [Motivation][1]
- [step-ca name constraints documentation][2]
- [A relevant blog post][3]
To generate:
step-cli certificate create "my-pki root-ca" root-ca.crt root-ca.key --template root.tpl --not-after 87600hstep-cli certificate create "my-pki intermediate-ca" intermediate-ca.crt intermediate-ca.key --template intermediate.tpl --ca root-ca.crt --ca-key root-ca.key, first you will enter the password to decrypt the root key, then enter a new password for the intermediate key