Is it possible to use Step-CA as just an ACME server

[Al7777]

Hello all,

I'm Alex , beginner in ACME in order to implement private ACME CA of my own with Step-CA, Certbot, my own CA module/instance i developed which means that my own CA issues SSL certificate as i want .

That means Step-CA works as just an ACME server while my CA module works certificate issuance/renewal/revokation of SSL certificate

1.My question is

1. I hope Step-CA works as an ACME server which means my CA i developed does certificate
   issuance/renewal/revocation. If that is possible, Would you please let me know how integrate Step-CA and my
   CA module.
   Is there any APIs or something which enables integration with my CA ?

I hope you're doing well and kindly help..

Thanks all,,

[tashian]

You could integrate in a couple ways:

• Directly through our Go libraries and build your own ACME server from our code (this is what Caddy server does)
• Customize RA mode with your own CA backend

Both of these would require a lot of custom development work, and we don't have documentation for either of these approaches.

[maraino]

You're describing a custom RA mode, right now we support RA for another step-ca, or Google CAS. There's also a PR for using Vault as the CA. Custom ones can be created if you implement this interface:

certificates/cas/apiv1/services.go

Lines 11 to 15 in dc9db5f

	type CertificateAuthorityService interface {
	CreateCertificate(req *CreateCertificateRequest) (*CreateCertificateResponse, error)
	RenewCertificate(req *RenewCertificateRequest) (*RenewCertificateResponse, error)
	RevokeCertificate(req *RevokeCertificateRequest) (*RevokeCertificateResponse, error)
	}

As a reference, you can use the implementations in this directory:

• softcas is the default implementation of the above interface, and step-ca acts as a CA.
• stepcas is an RA and another step-ca acts as a CA.
• cloudcas is an RA and Google CAS acts as the CA.