Book 3 · Lesson 3.4
Certificate Authority bootstrap
- Generate dev CA and service certs
- Explain SAN entries for localhost
- Verify cert chain with openssl
Prerequisites: 3.3
Stage 2 needs a trust anchor — in dev, you are the CA.
Script
bash infra/certs/generate-dev-certs.shCertAuthorityBootstrap simulates signing gateway, ingestion, analyzer.
Files in infra/certs/dev/
| File | Role |
|---|---|
ca.pem | Trust anchor (distribute to clients) |
ca-key.pem | Private — never commit to prod |
gateway.pem | Server + client cert for gateway |
ingestion.pem / analyzer.pem | Backend server certs |
Verify
openssl verify -CAfile infra/certs/dev/ca.pem infra/certs/dev/gateway.pemTeach-back prompt
Why add subjectAltName = DNS:localhost for local dev?
Generate dev certs
Lab complete — nice work.