🚀 Deployment

🐳 Docker

Docker image

To deploy the CA, use the following Docker image:

harbor.confirm.ch/ca/ca

Docker command

To deploy the CA service via a simple docker command, use the following CLI arguments:

docker run -d \
    --name ca \
    -e CA_DNS=ca.example.net \
    -e CA_NAME="Example CA" \
    -e CA_PROVISIONER=admin \
    -p 8443:8443 \
    -v ca:/ca \
    harbor.confirm.ch/ca/ca

Hint

It’s recommended to deploy the CA service via Docker Compose.

Docker Compose

Use the following docker-compose.yml file to start the CA:

---
services:

  ca:

    image: harbor.confirm.ch/ca/ca

    environment:
      CA_DNS: ca.example.net
      CA_NAME: Example CA
      CA_PROVISIONER: admin

    ports:
      - '8443:8443'

    volumes:
      - ca:/ca

    restart: unless-stopped

volumes:
  ca:

Then bring the stack up with:

docker compose up -d

Test deployment

To test the deployment, check if you can get the root certificate via step, curl, or wget:

# Get CA certificate via step CLI (on your client).
step ca roots --ca-url https://{FQDN}

# Get CA certificate via curl.
curl --insecure https://{CA FQDN}/roots.pem

# Get CA certificate via wget.
wget --no-check-certificate -O - https://{CA FQDN}/roots.pem

After that, try to get your first certificate via 👣 step CLI.

🛡️ Reverse proxy deployment

Important

When deploying the CA behind a reverse proxy, please check out the 🛡️ Reverse proxy chapter.