Create a self-signed root CA in your current directory
step certificate create "Test Root" root.crt root.key
Issue a server certificate signed by that CA
step certificate create myservice.local server.crt server.key --ca root.crt --ca-key root.key
View the certificate details
step certificate inspect server.crt
You should see the certificate printed with all its metadata, including the digital signature from your root CA.
For more advanced use (like running a CA server for your team), check the official documentation: [https://smallstep.com/docs/step-cli](https://smallstep.com/docs/step-cli)
**Final Thoughts**
If you have ever found yourself writing a bash script to manage certificates, or if you want to implement short-lived TLS certificates in your infrastructure without using a third-party service, `step` is a genuinely useful tool. It removes the friction from PKI without dumbing it down. You still need to understand the fundamentals, but you no longer have to fight the tooling.
It is one of those tools that, once you use it, you wonder why you were doing things the hard way.
---
_Follow us at @githubprojects for more open source tools and developer resources._