Stand up your own CA + mTLS between two services

Goal

Build a working private PKI and use it to secure service-to-service traffic with mutual TLS. You create a root and intermediate CA, issue short-lived leaf certificates, wire a client and a server that each verify the other's certificate against your CA, and prove that identity — not just encryption — is what a certificate carries. The result demystifies the chain of trust, hostname validation, and the mTLS foundation of zero-trust setups.

Subject: full brief & instructions

Practices

• TLS/HTTPS & certificate management — the handshake, X.509, the chain-of-trust walk, and the certificate lifecycle this builds.
• Cryptography for engineers — the key exchange, signatures, and hybrid encryption the handshake composes.
• Authentication & authorization — mTLS as machine identity, the counterpart to user-level auth.
• Secrets management — private keys are the highest-value secrets; keep the CA key offline and out of images.
• Networking fundamentals — where the TLS handshake sits in the stack the two services talk over.

Milestones

1. Root the trust. Create a root CA (offline key) and an intermediate CA it signs with smallstep/step-ca (or raw openssl). Inspect both with openssl x509 -text — read the basicConstraints, key usage, and validity windows.
2. Issue a server leaf. Sign a leaf certificate with correct SANs, serve it from a TLS server, and connect with openssl s_client -connect host:443 -showcerts — confirm the full chain is served (the classic missing-intermediate bug is instructive to reproduce and fix).
3. Add the client leaf and require it. Issue a client certificate, configure the server to require and verify client certs against your CA, and confirm a client with no cert (or a cert from a different CA) is rejected — this is mTLS.
4. Prove identity is enforced. Have the server read the client cert's subject/SAN and authorize on it; show that swapping to an untrusted issuer breaks the connection at the handshake, not the application.
5. Operate it. Issue short-lived (hours) leaf certs and script renewal; alert on expiry. Feel why short lifetimes force automation and bound the compromise window.

Stretch goals

• Add a CRL or OCSP responder and revoke a leaf; observe soft-fail behavior.
• Introduce a service mesh / SPIFFE SVID and compare its automatic rotation to your manual scripts.

Related

• Personal CA + mTLS — subject — the full lab spec, verification steps, and acceptance checks for this exercise.
• TLS/HTTPS & certificate management — cites this exercise in its # Practice section.
• Cryptography for engineers — also cites it; the constructive counterpart to the Cryptopals breaking exercise.
• Cryptopals — crypto challenges — break the primitives there, compose them here.