ACME プロトコルで会話できるプライベート CA を立てる

version: "3"

services:
  ca:
    image: smallstep/step-ca:0.15.6
    restart: always
    ports:
      - "9000:9000"
    volumes:
      - "ca-data:/home/step"

volumes:
  ca-data:

~/step-ca$ docker-compose run --rm ca sh
Creating network "step-ca_default" with the default driver
Creating volume "step-ca_ca-data" with default driver
~ $ step ca init
? What would you like to name your new PKI? (e.g. Smallstep): EXAMPLE.COM
? What DNS names or IP addresses would you like to add to your new CA? (e.g. ca.smallstep.com[,1.1.1.1,etc.]): ca.example.com
? What address will your new CA listen at? (e.g. :443): :9000
? What would you like to name the first provisioner for your new CA? (e.g. you@smallstep.com): jwk
? What do you want your password to be? [leave empty and we'll generate one]:
? Password: b)_.u<[R7fd(uT_zit1s1MNd9<H(JlVr

Generating root certificate...
all done!

Generating intermediate certificate...
all done!

? Root certificate: /home/step/certs/root_ca.crt
? Root private key: /home/step/secrets/root_ca_key
? Root fingerprint: ef17bfc5dffda4d23257330b9e5b6aa75727c9663b32f59666c679ce3ec489c7
? Intermediate certificate: /home/step/certs/intermediate_ca.crt
? Intermediate private key: /home/step/secrets/intermediate_ca_key
? Database folder: /home/step/db
? Default configuration: /home/step/config/defaults.json
? Certificate Authority configuration: /home/step/config/ca.json

Your PKI is ready to go. To generate certificates for individual services see 'step help ca'.

FEEDBACK
      The step utility is not instrumented for usage statistics. It does not
      phone home. But your feedback is extremely valuable. Any information you
      can provide regarding how you’re using `step` helps. Please send us a
      sentence or two, good or bad: feedback@smallstep.com or join
      https://github.com/smallstep/certificates/discussions.
~ $ echo 'b)_.u<[R7fd(uT_zit1s1MNd9<H(JlVr' > /home/step/secrets/password
~ $ step ca provisioner add acme --type ACME
Success! Your `step-ca` config has been updated. To pick up the new configuration SIGHUP (kill -1 <pid>) or restart the step-ca process.
~ $ exit

~/step-ca$ docker-compose up -d
Creating step-ca_ca_1 ... done

docker cp step-ca_ca_1:/home/step/certs/root_ca.crt .

~/step-ca$ docker-compose run --rm -v $PWD/root_ca.crt:/tmp/root_ca.crt -v $PWD/root_ca_key:/tmp/root_ca_key ca sh
Creating network "step-ca_default" with the default driver
Creating volume "step-ca_ca-data" with default driver
~ $ step ca init --root=/tmp/root_ca.crt --key=/tmp/root_ca_key
? What would you like to name your new PKI? (e.g. Smallstep): EXAMPLE.COM
? What DNS names or IP addresses would you like to add to your new CA? (e.g. ca.smallstep.com[,1.1.1.1,etc.]): ca.example.com
? What address will your new CA listen at? (e.g. :443): :9000
? What would you like to name the first provisioner for your new CA? (e.g. you@smallstep.com): jwk
? What do you want your password to be? [leave empty and we'll generate one]:
? Password: 6~24(,i{um'3.RFd`2ol'k$,L2'2T>K8
...

www.example.com {
    respond "Hello World!!"
    tls {
        ca https://ca.example.com:9000/acme/acme/directory
        ca_root /etc/caddy/root.crt
    }
}

caddy_1  | {"level":"info","ts":1612702530.6507704,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"www.example.com","challenge_type":"tls-alpn-01","ca":"https://ca.example.com:9000/acme/acme/directory"}
caddy_1  | {"level":"info","ts":1612702530.6692169,"logger":"tls","msg":"served key authentication certificate","server_name":"www.example.com","challenge":"tls-alpn-01","remote":"192.168.160.1:53614","distributed":false}
caddy_1  | {"level":"info","ts":1612702530.9263132,"logger":"tls.issuance.acme.acme_client","msg":"validations succeeded; finalizing order","order":"https://ca.example.com:9000/acme/acme/order/xZCKSlnqGMB0V2YPWPUKNYEWiLvxHDHo"}
caddy_1  | {"level":"info","ts":1612702530.934317,"logger":"tls.issuance.acme.acme_client","msg":"successfully downloaded available certificate chains","count":1,"first_url":"https://ca.example.com:9000/acme/acme/certificate/ATdtrb5V2GuwyMuBKcd8j5XMIgAFZCoO"}
caddy_1  | {"level":"info","ts":1612702530.9358096,"logger":"tls.obtain","msg":"certificate obtained successfully","identifier":"www.example.com"}

# certbot certonly --standalone --server https://ca.example.com:9000/acme/acme/directory -d www.example.com -m admin@example.com --agree-tos
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for www.example.com
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/www.example.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/www.example.com/privkey.pem
   Your cert will expire on 2021-02-14. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"

ca.example.com:9000 {
    tls internal
    acme_server
}

version: "3"

services:
  caddy:
    image: caddy:2.3.0
    ports:
      - 9000:9000
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy-data:/data
      - caddy-config:/config

volumes:
  caddy-data:
  caddy-config:

...
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./certs/ca.example.com/root_ca.crt:/data/caddy/pki/authorities/local/root.crt
      - ./certs/ca.example.com/root_ca_key:/data/caddy/pki/authorities/local/root.key
      - ./certs/ca.example.com/intermediate_ca.crt:/data/caddy/pki/authorities/local/intermediate.crt
      - ./certs/ca.example.com/intermediate_ca_key:/data/caddy/pki/authorities/local/intermediate.key
      - caddy-data:/data
      - caddy-config:/config
...

...
"pki": {
    "certificate_authorities": {
        "local": {
            "root": {
                "certificate": "/etc/caddy/certs/root.crt",
                "private_key": "/etc/caddy/certs/root.key"
            },
            "intermediate": {
                "certificate": "/etc/caddy/certs/intermediate.crt",
                "private_key": "/etc/caddy/certs/intermediate.key"
            }
        }
    }
}
...

{
    "pebble": {
        "listenAddress": "0.0.0.0:14000",
        "managementListenAddress": "0.0.0.0:15000",
        "certificate": "/test/certs/localhost/cert.pem",
        "privateKey": "/test/certs/localhost/key.pem",
        "httpPort": 80,
        "tlsPort": 443
    }
}

version: '3'
services:
  pebble:
    image: letsencrypt/pebble:v2.3.1
    command: pebble -config /test/config/pebble-config.json
    ports:
      - 14000:14000
      - 15000:15000
    volumes:
      - ./config.json:/test/config/pebble-config.json

# certbot certonly --standalone --server https://pebble:14000/dir -d www.example.com -m admin@example.com --agree-tos
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for www.example.com
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/www.example.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/www.example.com/privkey.pem
   Your cert will expire on 2026-02-13. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"