Sort of related, one of the best resources I've used that helped me understand much more is this doc: https://jamielinux.com/docs/openssl-certificate-authority

Sort of related, one of the best resources I've used that helped me understand much more is this doc: https://jamielinux.com/docs/openssl-certificate-authority/ https://jamielinux.com/docs/openssl-certificate-authority/ It hasn't been updated for Subject Alternative Names or EC keys, but it's sort of like a Linux From Scratch for SSL CA ops that can help you understand what tools like smallstep-cli are doing behind the scenes.