Derek Coleman & Associates Inc logoDerek Coleman & Associates Inc

Home / Support / Smallstep step-ca on Ubuntu 24.04 LTS

Smallstep step-ca on Ubuntu 24.04 LTS — Support & Quick Start

Smallstep step-ca on Ubuntu 24.04 LTS — step-ca is an online private certificate authority with ACME support — issue TLS certificates for internal services, mTLS and SSH from a root of trust you own. Published by Derek Coleman & Associates Inc on the Azure Marketplace, deployed in your own Azure …

Email support Product page Azure Marketplace listing

At a glance

Application ports9000 (CA HTTPS API, ACME)
Open in browserhttps://<VM-IP>:9000/health
Admin credential filesudo cat /root/step-ca-admin-credentials.txt
Sign in asprovisioner `admin` (JWK); the file holds the CA password, the provisioner password and the root fingerprint
Service(s)step-ca
Configuration/etc/step-ca/ (STEPPATH: config/ca.json, certs/, secrets/ — back it up; this VM generated a UNIQUE root of trust at first boot)
Logsjournalctl -u step-ca -f
Versionstep-ca 0.30.2 (step CLI 0.30.6)
PlatformUbuntu 24.04 LTS

Quick start

  1. Deploy from the Azure Marketplace (Get It Now → Create), choosing your SSH key at the Administration step.
  2. Allow inbound SSH (22) for yourself plus the application port(s): 9000 (CA API) — to the clients that need certificates — restrict to your own IP where possible. The in-image firewall already allows them; only the Network Security Group (NSG) keeps them closed.
  3. Bootstrap a client with the CA URL and fingerprint from the credential file (see First login below).
  4. Add an ACME provisioner (`step ca provisioner add acme --type ACME`) to let certbot/Caddy/Traefik enroll automatically.

First login / credentials

This image generates its admin credential on the VM at first boot — nothing is pre-set. SSH into the VM with the username + key you chose at deploy, then print the generated credential:

ssh <your-username>@<VM-IP>
sudo cat /root/step-ca-admin-credentials.txt

Sign in as provisioner `admin` (JWK); the file holds the CA password, the provisioner password and the root fingerprint.

  1. Print the credential file: CA URL, root fingerprint, CA password (decrypts the intermediate key) and the `admin` provisioner password (mints certificates).
  2. Bootstrap a client: step ca bootstrap --ca-url https://<VM-IP>:9000 --fingerprint <fingerprint>; then step ca certificate mysvc.example.com mysvc.crt mysvc.key.
  3. Move both passwords into a secrets manager and delete them from the file; back up /etc/step-ca (root/intermediate keys + database); scope port 9000 in the NSG to the clients that need the CA.

There is no web login. Trust is established with the root fingerprint; certificates are minted with the provisioner password (or ACME).

Still stuck?

Email support@dcassociatesgroup.com (response within 1 business day) or send a message via the contact form. Include the offer name, VM size, region, and any log output — sudo journalctl -u <service> -n 100 usually tells the story.