% -*- mode: latex; fill-column: 120; -*-
With \OpenCHAMI{} a minimal open source certificate authority from smallstep is needed. The included automation initialized the CA on first startup. We can immediately download a certificate into the system trust bundle on the host for trusting all subsequent OpenCHAMI certificates. Notably, the certificate authority features ACME for automatic certificate rotation.

% begin_ohpc_run
% ohpc_comment_header Creating OpenCHAMI certificates \ref{sec:certificate_creation}
\begin{lstlisting}[language=bash,keywords={}]
[sms](*\#*) openchami-certificate-update update ${sms_name}
\end{lstlisting}
% ohpc_validation_newline
% end_ohpc_run
