With the Linux Challenge happening and the talk that generates, I want to tell you about how today I had to read the source code of some software because the details were not covered in the documentation.

Firstly, I really love using Linux. I keep only 2 computers where I don't use Linux: my gaming laptop and my Macbook. Everywhere else, like my two workstations and servers, I use Linux. Fedora, specifically.

Recently, I have been going through the pain of trying to set up my own, private PKI infrastructure (the magic dust that makes HTTPS secure). This requires what are known as Certificate Authorities (CAs). These are professionally deployed in layers: You have your "root" CA and 1 or more intermediate CAs. The "root" CA is used to generate and sign the signing certificates used by the intermediate CAs and is a safety measure to quickly invalidate a rogue (hacked) CA's signing keys and, by extension, all the certificates and signatures it generated with the prior certificate. For this reason, the "root" CA is kept offline, and usually on a separate machine that is dedicated to the purpose and only booted when a new certificate needs to be generated. So far so "just use OpenSSL already!", right? Cool. That's simple enough. I keep mine as a bootable USB drive. The problem is the intermediate CA.

I decided early on that manually rotating the certificates for every service I make and deploy to be a pain in the ass. Thus, I opted to use the ACME server protocol, which is a nice, clean, and professionally supported way of rotating certificates. This requires a speciallized CA software called an "ACME server". OpenSSL doesn't do this (by itself). So, I opted to use another solution called "Smallstep Step CA". The concept is straightforward, the docs looked professional, the project actively, supported, and all that good shiz. Through some magical IT mumbo jumbo I won't list here for brevity, I got server setup and seemingly serving good certs. Until they started failing. Expired cert somewhere in the chain. This seemed an easy fix, but oh boy did it set off a cascade of documentation, JSON template, and SOURCE CODE spelunking. 1 month in on this whole project and I am still solving issues.

I won't stop because the problem I have isn't with "Step CA" so much as it is my own inability to use it properly. That said, in what universe is it acceptable for me to have to dig through the source code or an RFC to get a list of all the configuration fields? Why? Smallstep. I legit enjoy using your software and it is great when it is working. But, please don't make me have to dig through your source code or read some Go Programming Language documentation (yes, that happened too) to be able to configure your product.

So, is Linux the problem here? No, Smallstep Step CA is, but I feel this ancedote is illustrative of the pain point of using open source software for niche use cases that don't get a lot of attention (despite how vital they can be).