From 76a077ba3ea6a02fedbbcaa6ab56ffe06f3e1d05 Mon Sep 17 00:00:00 2001
From: Carl Tashian <carl@smallstep.com>
Date: Wed, 26 Feb 2020 10:59:38 -0800
Subject: [PATCH] Add CFSSL instructions

---
 docs/questions.md | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/docs/questions.md b/docs/questions.md
index ad1fbf7d..12dc1647 100644
--- a/docs/questions.md
+++ b/docs/questions.md
@@ -193,7 +193,36 @@ openssl ca -config [ROOT_CA_CONFIG_FILE] \
   -out intermediate.crt
 ```
 
-This process will yield an `intermediate.crt` certificate.  Transfer this file back to the machine running `step-ca`.
+**CFSSL**
+
+For CFSSL you'll need a signing profile that specifies a 10-year expiry:
+
+```bash
+cat > ca-smallstep-config.json <<EOF
+{
+  "signing": {
+    "profiles": {
+      "smallstep": {
+        "expiry": "87660h",
+        "usages": ["signing"]
+      }
+    }
+  }
+}
+EOF
+```
+
+Now use that config to sign the intermediate certificate:
+
+```bash
+cfssl sign -ca ca.pem \
+    -ca-key ca-key.pem \
+    -config ca-smallstep-config.json \
+    -profile smallstep
+    -csr intermediate.csr | cfssljson -bare
+```
+
+This process will yield a signed `intermediate.crt` certificate (or `cert.pem` for CFSSL). Transfer this file back to the machine running `step-ca`.
 
 Finally, replace the intermediate .crt and signing key produced by `step ca init` with the new ones we just created: