We need a private key, server certificate, and root certificate to enable simple or mutual TLS. Either we get them from a CA or we self-generate them. We will be generating the certificates and keys using a small-step command line. To do this, we need to install the step CLI.
If you need a quick introduction to the Public Key Infrastructure (PKI), please refer to this excellent article by Mike Malone: https://smallstep.com/blog/everything-pki.html.