Can the root CA cert have a duration longer than 10 years?

[Rapt88]

If this is possible, how can it be achieved? Looking to try and make this 20 years, with the idea that it provisions certs for IAs and then gets turned offline.

The IAs would then have lifespans of 10y etc

[mmalone]

Yes it is possible! But you'll need to use a slightly more elaborate workflow to initialize the CA infrastructure. Specifically, you'll need to generate a root CA key & certificate then pass those in to step ca init. Technically, you could use any tool to generate your root, but here's how you'd do this with step:

$ step certificate create "My Root CA" root_ca.crt root_ca_key --profile root-ca --not-after 175200h
$ step ca init --root root_ca.crt --key root_ca_key

When you run this command it will copy your root_ca_key into ~/.step/secrets/root_ca_key. The CA doesn't actually need this file though. You can delete it if you'd like.

[Rapt88]

I think with this answer you may have just answered my other query as well.

Ref: #383

Q: if the CA doesnt actually need the key, why does it copy it? Is it only used when it's initially provisioned/created? So every time afterwards if the CA is turned off and started again, it still would not need it?

[kopparam]

My understanging it that the root private key is needed to sign the intermediate certificate that step generates, but not sure if the source or the copied file is used for that though.