> For the complete documentation index, see [llms.txt](https://gitbook.joeir.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.joeir.net/code/development-environment/public-key-infrastructure-pki.md).

# Public Key Infrastructure (PKI) Setup & Usage

This page describes how to set up your SSH keys which are used to authenticate with code repositories to contribute code or with remote machines to deploy software

## Create an SSH key-pair

The following should generate a 4096-bit key pair at `./id_rsa` and `./id_rsa.pub` for use with SSH Git pulls/SSH deploys/SSH login to VM:

```
ssh-keygen -t rsa -b 4096 -f ./id_rsa -q -N "";
```

## Create a certificate authority (CA)

The following creates a new CA with 3650 days validity at `testdomain.com`:

```
openssl genrsa -out ./cakey.pem 4096;
openssl req -new -x509 -sha256 \
        -key ./cakey.pem \
        -days 3650 \
        -extensions v3_ca \
        -subj "/C=SG/ST=Singapore/L=Singapore/O=zephinzer/OU=example/CN=testdomain.com" \
        -out ./cacert.pem;
```

## Create a certificate signing request (CSR)

The following creates a CSR at `./test.csr`

```
openssl req -new -sha256 \
  -key ./ssl/test.pem \
  -subj "/C=SG/ST=Singapore/L=Singapore/O=zephinzer-demo/OU=helm/CN=helmuser" \
  -out ./ssl/test.csr;
```

## Create a signed client certificate

Given a CA key and certificate at `./cakey.pem` and `./cacert.pem` respectively, the following creates a client certificate at `./test.pem` from the CSR at `./test.csr`

```
openssl x509 -req \
  -days 3650 \
  -CAcreateserial \
  -CA ./cacert.pem \
  -CAkey ./cakey.pem \
  -in ./test.csr \
  -out ./test.pem;
```

## Create an SSL key

```
openssl genrsa -out ./test.pem 4096;
```