Files

Bryan Frimin 14604a3176 Replace Pebble with step-ca for local ACME

Pebble skipped real HTTP-01 validation, which hid integration gaps
for compliance-page custom domains. step-ca with a Caddy port-80
proxy exercises the same path production uses while keeping issued
certs persistent across compose restarts.

Signed-off-by: Bryan Frimin <bryan@probo.com>

2026-07-21 15:44:15 +02:00

README.md

Replace Pebble with step-ca for local ACME

2026-07-21 15:44:15 +02:00

README.md

step-ca local CA

This directory holds the persistent step-ca state for local custom-domain TLS. It is initialized on first make stack-up.

After the first run, install the root CA once so browsers and server-side TLS clients (e.g. CIMD OAuth) trust issued certificates across restarts:

step certificate install compose/step-ca/certs/root_ca.crt

The ACME directory URL is https://localhost:9000/acme/acme/directory.

step-ca shares the acme-http-01-proxy container network so HTTP-01 validation to http://<hostname>/.well-known/acme-challenge/... reaches Caddy on port 80, which forwards to probod's trust-center HTTP listener on the host.

Custom domain DNS (optional)

Managed compliance-page domains (*.probopage.localhost) resolve via the .localhost TLD and skip DNS checks.

For customer custom domains in local dev, point DNS at the host via /etc/hosts and ensure HTTP-01 reaches probod through the acme-http-01-proxy service on port 80.