$ show smallstep/certificates
This repository implements `step-ca`, a production-grade online Certificate Authority (CA) server written in Go. It issues X.509 and SSH certificates via multiple protocols including ACME (RFC 8555), SCEP, and JWT-based provisioners. The architecture separates authorization (via pluggable provisioners: JWK, OIDC, AWS, Azure, GCP, Kubernetes, Nebula, X5C, and more) from certificate signing (via CAS backends: softcas, stepcas, cloudcas, vaultcas). The server exposes REST APIs for certificate lifecycle (sign, renew, revoke), SSH certificate management, CRLs, and an admin API for managing provisioners, policies, and webhooks. It supports external key management (AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault) and can run in RA (Registration Authority) mode proxying to an upstream step-ca. The codebase is extensively tested with unit and integration tests, uses a functional options pattern for configuration, and includes a client library for bootstrapping TLS connections. Notable reusable components include a custom error type with HTTP status codes, a policy engine for name constraints, webhook integration framework, request ID middleware, and template rendering engine.
The LLM identified 5 files worth highlighting for reuse:
Defines a custom `Error` type implementing `StatusCodedError` with HTTP status code, message, internal details, and request ID. Supports JSON marshaling and integration with rendering middleware. This is a standalone, reusable error abstraction for any HTTP API service.
Implements name constraint matching for X.509 and SSH certificates: DNS, IP, email, URI, and principal constraints. Includes wildcard handling, IPv4/IPv6 normalization, and RFC 2821 mailbox parsing. Could be extracted as a standalone library for any PKI application requiring policy enforcement.
Defines the request and response schema for enrichment and authorization webhooks used during certificate issuance. Includes serialization to/from JSON and HMAC signature validation. This schema can be reused as a contract for external webhook integrations in other systems.
A minimal HTTP middleware that reads a request ID from headers (X-Request-Id or X-Smallstep-Id) and passes it through the request context for logging and tracing. It is framework-agnostic and can be dropped into any Go HTTP server.
Provides a template rendering engine with custom Sprig-based functions for SSH and X.509 template execution. Supports output types: snippet, file, prepend line, and directory. The template structure and rendering logic are decoupled from the CA and could be reused for any configuration generation task.