// docs · sample configs

Sample configurations

A starter for every CA and challenge. Each page shows only the part that differs — the [store], [[distribute]], and [logging] blocks are the same across all of them.

Every example lives in examples/ and is ready to copy to /etc/syscert/syscert.toml and edit. The full annotated reference is full.toml; it documents every option. The deliver/store/logging tail below is the same in all of them:

[store]
path = "/var/lib/syscert"

[[distribute]]
artifact = "fullchain"
path     = "/etc/nginx/tls/fullchain.pem"
owner    = "root"
group    = "root"
mode     = "0644"

[[distribute]]
artifact = "privkey"
path     = "/etc/nginx/tls/privkey.pem"
owner    = "root"
group    = "root"
mode     = "0600"          # key-bearing → not world-readable

[logging]
level  = "info"
format = "text"

What changes between setups is the CA and the challenge. Pick the one that matches how the CA can reach your host, or can’t:

Let’s Encrypt · DNS-01 — public cert via a DNS TXT record; no inbound ports. The most internal-friendly public option.
Let’s Encrypt · HTTP-01 — simplest public setup; no DNS provider, but needs inbound :80.
Let’s Encrypt · TLS-ALPN-01 — modern :443-only challenge; no DNS, no :80.
HashiCorp Vault · HTTP-01 — internal CA from Vault’s PKI ACME, validated over :80.
HashiCorp Vault · DNS-01 — internal CA via DNS-01; role-scoped directory + EAB, no inbound ports.
Smallstep step-ca · DNS-01 — internal CA from a step-ca provisioner; step-ca supports all three challenges.

Check any of these offline before you issue anything: sudo -u syscert syscert dry-run --config-only --config ./syscert.toml.

Next: Configuration reference · Quick start