Step-CA Certificate Renewal Guide

Back to Home

Overview

This guide configures automatic SSL/TLS certificate renewal using our internal Step-CA ACME server at https://stepca01.dcs.

What you'll achieve: Certificates will automatically renew every 90 days without manual intervention, keeping your services secure and avoiding browser warnings.

Prerequisites

Root or sudo access to the target VM
Apache or Nginx web server installed and running
Network connectivity to stepca01.dcs
Valid email address for certificate notifications

Troubleshooting

Verify network connectivity and DNS resolution:

ping stepca01.dcs
curl -I https://stepca01.dcs/acme/acme/directory
firewall-cmd --list-all

Check Certbot logs:

journalctl -u certbot-renew.service -n 50
tail -f /var/log/letsencrypt/letsencrypt.log
certbot certificates

Apache:

apachectl configtest
journalctl -u httpd -n 50

Nginx:

nginx -t
journalctl -u nginx -n 50

A plain certbot renew reuses the authenticator, installer, and Step-CA server URL recorded in the certificate's renewal config at issuance time. The automatic certbot.timer / certbot-renew.timer runs exactly that — with no extra flags — so renewal must work without passing --apache or --nginx.

If renewal fails unless you add --apache / --nginx, the renewal config recorded the wrong plugin (usually authenticator = standalone from a first issuance that did not go through the web-server plugin). The standalone authenticator cannot bind port 80 while Apache/Nginx is running, so the timer's unattended renewal will silently fail.

1. Inspect the renewal config:

grep -E 'authenticator|installer|server' /etc/letsencrypt/renewal/*.conf

For the web-server plugin you should see authenticator = apache (or nginx) and a matching installer, plus server = https://stepca01.dcs/acme/acme/directory.

2. Fix it by re-issuing through the correct plugin (this rewrites the renewal config):

# Apache
certbot --apache --server https://stepca01.dcs/acme/acme/directory --force-renewal

# Nginx
certbot --nginx --server https://stepca01.dcs/acme/acme/directory --force-renewal

3. Confirm the unattended path now works (no plugin flag):

certbot renew --dry-run

Quick Reference

Check certificates	`certbot certificates`
Test renewal	`certbot renew --dry-run`
Check timer	`systemctl list-timers \| grep certbot`
View logs	`journalctl -u certbot-renew.service`

What is ACME?

ACME (Automatic Certificate Management Environment) is a protocol that automates obtaining, renewing, and managing SSL/TLS certificates. It was developed for Let's Encrypt and is now an industry standard (RFC 8555).

Key Benefits

Automation — No manual certificate requests or renewals
Free — No cost for certificate issuance
Secure — Automated domain validation ensures you control the domain
Standardized — Works with any ACME-compatible CA

How ACME Works

Request: Your server requests a certificate from the ACME server
Challenge: The ACME server issues a challenge to prove you control the domain
Validation: Your server responds to the challenge (via HTTP or DNS)
Issuance: Once validated, the ACME server issues the certificate
Installation: The certificate is automatically installed on your web server

Let's Encrypt uses ACME to issue over 2 million certificates per day, powering HTTPS for millions of websites worldwide—completely free and automated!

What is Step-CA?

Step-CA is an open-source Certificate Authority that implements the ACME protocol. Unlike Let's Encrypt (which is public), Step-CA runs internally within our organization.

Why Use Step-CA Instead of Let's Encrypt?

Internal Services — Works for internal domains (like .dcs) that aren't publicly accessible
Control — Full control over certificate policies and lifetimes
Privacy — Certificate requests stay within the organization
Compliance — Meets internal security and compliance requirements
No Rate Limits — Unlike Let's Encrypt's public rate limits

Our Step-CA Server

URL: https://stepca01.dcs/acme/acme/directory
Purpose: Issues SSL/TLS certificates for internal services
Protocol: ACME (same as Let's Encrypt)
Client: Certbot (the same tool used with Let's Encrypt)

Why Do Certificates Need Renewal?

SSL/TLS certificates have expiration dates for important security reasons:

Security Reasons for Certificate Expiration

Limit Exposure — If a private key is compromised, damage is limited to the certificate's lifetime
Cryptographic Aging — Older certificates may use outdated encryption algorithms
Ownership Changes — Ensures current domain owners control the certificates
Revocation Efficiency — Shorter lifetimes reduce the need for complex revocation mechanisms

Certificate Lifetimes

Let's Encrypt: 90 days (industry standard for automated certificates)
Step-CA (typical): 90 days (configurable by administrators)
Traditional CAs: 1-2 years (but industry is moving toward shorter lifetimes)

What Happens If a Certificate Expires?

Web browsers show scary security warnings to users
HTTPS connections fail, breaking your website/service
API clients may refuse to connect
Users lose trust in your service

The Solution: Automatic Renewal

This guide sets up automatic renewal using Certbot and systemd timers:

Certbot checks for expiring certificates twice daily
Certificates are renewed 30 days before expiration
Your web server is automatically reloaded with the new certificate
Zero manual intervention required!