--- title: Self-Hosted TRUST with your own Certificate Authority! description: A comprehensive guide to setting up a self-hosted private Certificate Authority using a 3-layer PKI model. Covers generating root and intermediate certificates... canonical: https://daily.dev/posts/self-hosted-trust-with-your-own-certificate-authority--mjnhlthmq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Self-Hosted TRUST with your own Certificate Authority! | daily.dev og:description: A comprehensive guide to setting up a self-hosted private Certificate Authority using a 3-layer PKI model. Covers generating root and intermediate certificates... og:url: https://daily.dev/posts/self-hosted-trust-with-your-own-certificate-authority--mjnhlthmq og:image: https://api.daily.dev/og/posts/MjNHLthMq.png og:image:alt: Self-Hosted TRUST with your own Certificate Authority! og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Self-Hosted TRUST with your own Certificate Authority! **[apalrd's adventures](https://daily.dev/sources/apalrd)** · 9 min read · 0 upvotes · 0 comments ## Summary A comprehensive guide to setting up a self-hosted private Certificate Authority using a 3-layer PKI model. Covers generating root and intermediate certificates with OpenSSL, storing intermediate keys on a Yubikey for hardware-backed security, installing and configuring Smallstep (step-ca) as an ACME server on Debian, enabling ACME challenges, and using the CA to issue certificates for services like Caddy. Explains trade-offs between 2-layer and 3-layer CA architectures and how to distribute trust to client machines. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between a 2-layer and 3-layer certificate authority setup? A 2-layer CA has a root CA that directly signs server certificates, while a 3-layer CA adds an intermediate CA between the root and leaf certificates. The 3-layer approach keeps the root private key entirely offline, allows the intermediate CA to be issued for a shorter lifetime to limit exposure if compromised, and enables CRL-based revocation of intermediate certificates without touching the root key. _Teams deciding on PKI architecture for internal services find the trade-offs covered on daily.dev._ ### Why does the Smallstep step-ca intermediate CA need a 2048-bit key when using a Yubikey? Yubikey's PIV application does not support 4096-bit RSA keys — only up to 2048-bit. The PGP application on the same Yubikey does support 4096-bit keys, but the PIV slot used for certificate storage is limited to 2048-bit, so the intermediate CA key must be generated at that size to be importable into the Yubikey PIV slot. _Developers securing homelab PKI with hardware tokens track gotchas like this on daily.dev._ ### How do I configure step-ca to use a Yubikey instead of a software private key? Edit /etc/step/config/ca.json and replace the key directive that points to a private key file with a KMS configuration block specifying the Yubikey as the key management system. After importing the intermediate CA private key into the Yubikey PIV slot using ykman, step-ca will use the hardware token for all signing operations instead of a file-based key. _Engineers hardening internal CA setups with hardware security modules share notes like these on daily.dev._ ## Similar posts on daily.dev - [Make a private CA with step-ca](https://daily.dev/posts/make-a-private-ca-with-step-ca-fo6ov1iqp) · Fedora Magazine · 0 upvotes · 0 comments - [Private Certificate Authority 101: From Setup to Management](https://daily.dev/posts/private-certificate-authority-101-from-setup-to-management-h7xlug7cd) · Security Boulevard · 0 upvotes · 0 comments - [ACME device attestation, smallstep and pkcs11: attezt](https://daily.dev/posts/acme-device-attestation-smallstep-and-pkcs11-attezt-plykdqsyv) · Lobsters · 0 upvotes · 0 comments - [A visual guide to Public Key Infrastructure\(PKI\) — From Plaintext to a Verified Certificate](https://daily.dev/posts/a-visual-guide-to-public-key-infrastructure-pki-from-plaintext-to-a-verified-certificate-kbxvo51s6) · Towards Dev · 0 upvotes · 0 comments - [Jan-Piet Mens :: SSH certificates: the better SSH experience](https://daily.dev/posts/jan-piet-mens-ssh-certificates-the-better-ssh-experience-f1ftumowi) · Jan-Piet Mens · 0 upvotes · 0 comments --- Tags: [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/self-hosted-trust-with-your-own-certificate-authority--mjnhlthmq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Self-Hosted TRUST with your own Certificate Authority!","url":"https://daily.dev/posts/self-hosted-trust-with-your-own-certificate-authority--mjnhlthmq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/self-hosted-trust-with-your-own-certificate-authority--mjnhlthmq"},"datePublished":"2026-08-11T08:54:00.049Z","dateModified":"2026-08-11T09:26:31.415Z","description":"A comprehensive guide to setting up a self-hosted private Certificate Authority using a 3-layer PKI model. Covers generating root and intermediate certificates...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63b768801718b20432d4832c92a7f18f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63b768801718b20432d4832c92a7f18f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"apalrd's adventures","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"apalrd's adventures","logo":"https://media.daily.dev/image/upload/s--4zkx8dRj--/f_auto,q_auto/v1786438309/logos/apalrd?_a=BAMAMicg0","url":"https://daily.dev/sources/apalrd"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/self-hosted-trust-with-your-own-certificate-authority--mjnhlthmq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cryptography","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"apalrd's adventures","item":"https://daily.dev/sources/apalrd"},{"@type":"ListItem","position":3,"name":"Self-Hosted TRUST with your own Certificate Authority!"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/self-hosted-trust-with-your-own-certificate-authority--mjnhlthmq#faq","mainEntity":[{"@type":"Question","name":"What is the difference between a 2-layer and 3-layer certificate authority setup?","acceptedAnswer":{"@type":"Answer","text":"A 2-layer CA has a root CA that directly signs server certificates, while a 3-layer CA adds an intermediate CA between the root and leaf certificates. The 3-layer approach keeps the root private key entirely offline, allows the intermediate CA to be issued for a shorter lifetime to limit exposure if compromised, and enables CRL-based revocation of intermediate certificates without touching the root key. Teams deciding on PKI architecture for internal services find the trade-offs covered on daily.dev."}},{"@type":"Question","name":"Why does the Smallstep step-ca intermediate CA need a 2048-bit key when using a Yubikey?","acceptedAnswer":{"@type":"Answer","text":"Yubikey's PIV application does not support 4096-bit RSA keys — only up to 2048-bit. The PGP application on the same Yubikey does support 4096-bit keys, but the PIV slot used for certificate storage is limited to 2048-bit, so the intermediate CA key must be generated at that size to be importable into the Yubikey PIV slot. Developers securing homelab PKI with hardware tokens track gotchas like this on daily.dev."}},{"@type":"Question","name":"How do I configure step-ca to use a Yubikey instead of a software private key?","acceptedAnswer":{"@type":"Answer","text":"Edit /etc/step/config/ca.json and replace the key directive that points to a private key file with a KMS configuration block specifying the Yubikey as the key management system. After importing the intermediate CA private key into the Yubikey PIV slot using ykman, step-ca will use the hardware token for all signing operations instead of a file-based key. Engineers hardening internal CA setups with hardware security modules share notes like these on daily.dev."}}]} ```