Smallstep

https://smallstep.com/docs/
Admin
Smallstep provides device identity and zero trust network access (ZTNA) solutions to secure...
Tokens:510,520
Snippets:4,390
Trust Score:10
Update:1 week ago
Show doc for...
Tokens:
Raw
### Python: Install dependencies and start server

Source: https://smallstep.com/docs/tutorials/acme-protocol-acme-clients

Install the acme and pem packages, then start the Python HTTPS server. The server uses the ACME client to obtain a certificate.

```bash
pip install acme
pip install pem
python https.py
```

--------------------------------

### Start webhook server

Source: https://smallstep.com/docs/step-ca/webhooks

Runs the example webhook server after updating its configuration.

```bash
go run main.go
```

--------------------------------

### Run the Python example server

Source: https://smallstep.com/docs/tutorials/user-authentication

Starts the Python mTLS server.

```bash
python server.py
```

--------------------------------

### Node.js: Install dependencies and start server

Source: https://smallstep.com/docs/tutorials/acme-protocol-acme-clients

Install the node-acme-client package and start the Node.js ACME server. The server uses the ACME client to obtain a certificate and serve HTTPS.

```bash
npm install node-acme-client
node acme.js
```

--------------------------------

### step-ca startup output

Source: https://smallstep.com/docs/step-ca/cryptographic-protection

Example output when step-ca starts, showing the server URL and root fingerprint.

```text
2022/09/20 16:28:45 The primary server URL is https://localhost:443
2022/09/20 16:28:45 Root certificates are available at https://localhost:443/roots.pem
2022/09/20 16:28:45 X.509 Root Fingerprint: b061dfca1013c074244b0f376e5be70b6eb0bd7f21d5438aa3af71fe62b0acf5
2022/09/20 16:28:45 Serving HTTPS on :443 ...
```

--------------------------------

### step-ca startup output with fingerprints and SSH keys

Source: https://smallstep.com/docs/step-ca/cryptographic-protection

Example output when starting step-ca, showing the X.509 root fingerprint and SSH host and user CA keys.

```text
2022/09/20 16:28:45 The primary server URL is https://localhost:443
2022/09/20 16:28:45 Root certificates are available at https://localhost:443/roots.pem
2022/09/20 16:28:45 X.509 Root Fingerprint: b061dfca1013c074244b0f376e5be70b6eb0bd7f21d5438aa3af71fe62b0acf5
2022/09/20 16:28:45 SSH Host CA Key: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIwmL7aDOJId/9UOVJGhVux6Rlvea+q2017aLsfze+/EwGQ5BdZ4k2Qh+5VekebBKZYLNO0LkSf9bZb4o9GSxIs=
2022/09/20 16:28:45 SSH User CA Key: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFE0VY9eLxkoHrXoWk5VxeOQTUt53U5xIo89pfsgYHh450cdE4c3mYw5YeOueESyu/lFUHfJoNS6twVR1wuCOdc=
2022/09/20 16:28:45 Serving HTTPS on :443 ...
```

--------------------------------

### Start step-ca server

Source: https://smallstep.com/docs/tutorials/ssh-certificate-login

Command to start the step-ca server with the example configuration, requiring passwords for intermediate CA, SSH host, and SSH user keys.

```bash
$ export STEPPATH=pwd/step
$ step-ca step/config/ca.json
Please enter the password to decrypt step/secrets/intermediate_ca_key: password
Please enter the password to decrypt step/secrets/ssh_host_key: password
Please enter the password to decrypt step/secrets/ssh_user_key: password
2019/09/11 22:59:01 Serving HTTPS on :443 ...
```

--------------------------------

### Rebuild NixOS system

Source: https://smallstep.com/docs/platform/smallstep-agent

Run this command to apply the NixOS configuration, which installs the package and enables/starts the agent, enrolling the device on first start.

```bash
sudo nixos-rebuild switch
```

--------------------------------

### Start step-ca

Source: https://smallstep.com/docs/step-ca/webhooks

Starts the step-ca server using the context created during initialization.

```bash
step-ca --context webhooks
```

--------------------------------

### Apache: Start and verify with curl

Source: https://smallstep.com/docs/tutorials/acme-protocol-acme-clients

Start Apache and verify the HTTPS setup using curl with the root CA certificate. The expected output is 'Hello TLS'.

```bash
$ curl --cacert $(step path)/certs/root_ca.crt https://foo.internal

Hello TLS
```

--------------------------------

### Install step CLI

Source: https://smallstep.com/docs/ssh/hosts-step-by-step

Downloads and installs the step CLI tool for Linux amd64.

```bash
$ curl -L -o step https://dl.smallstep.com/s3/cli/docs-ssh-host-step-by-step/step_latest_linux_amd64
$ install -m 0755 -t /usr/bin step

```

--------------------------------

### Download and install root certificate with step ca root and step certificate install

Source: https://smallstep.com/docs/certificate-manager/how-it-works

Downloads the root certificate from the CA and installs it into the system trust store. The first command saves the root certificate to root.crt; the second prompts for a password and installs it, displaying certificate details.

```bash
$ step ca root root.crt
The root certificate has been saved in root.crt.

$ step certificate install root.crt
Password:
Certificate r.crt has been installed.
X.509v3 Root CA Certificate (ECDSA P-256) [Serial: 1829...9147]
  Subject:     Root CA
  Issuer:      Root CA
  Valid from:  2020-09-18T20:55:03Z
          to:  2030-09-16T20:55:03Z

```

--------------------------------

### Example: step ca provisioner list

Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/list

Prints a JSON list with active provisioners.

```bash
$ step ca provisioner list
```

--------------------------------

### Example output from step ca init

Source: https://smallstep.com/docs/tutorials/docker-tls-certificate-authority

Example output from the step ca init command showing the interactive prompts and generated file paths. The root fingerprint value should be saved for client bootstrapping.

```text
✔ What would you like to name your new PKI? (e.g. Smallstep): Smallstep
✔ What DNS names or IP addresses would you like to add to your new CA? (e.g. ca.smallstep.com[,1.1.1.1,etc.]): localhost
✔ What address will your new CA listen at? (e.g. :443): :9000
✔ What would you like to name the first provisioner for your new CA? (e.g. you@smallstep.com): admin@smallstep.com
✔ What do you want your password to be? [leave empty and we'll generate one]:

Generating root certificate...
all done!

Generating intermediate certificate...
all done!

✔ Root certificate: /home/step/certs/root_ca.crt
✔ Root private key: /home/step/secrets/root_ca_key
✔ Root fingerprint: 86a278f34e58c7ab04313aff0e8e5114f1d1da955ecb20412b3d32cc2267ddcd
✔ Intermediate certificate: /home/step/certs/intermediate_ca.crt
✔ Intermediate private key: /home/step/secrets/intermediate_ca_key
✔ Database folder: /home/step/db
✔ Default configuration: /home/step/config/defaults.json
✔ Certificate Authority configuration: /home/step/config/ca.json

Your PKI is ready to go. To generate certificates for individual services see 'step help ca'.
```

--------------------------------

### Curl request to example server

Source: https://smallstep.com/docs/step-ca/getting-started

Makes a curl request to the example server. Works if the root CA was installed with `step certificate install`; otherwise fails with a certificate verification error.

```bash
curl https://localhost:9443/hi
```

--------------------------------

### SSH 'session start' event

Source: https://smallstep.com/docs/certificate-manager/webhook-events

Example of the response data for an SSH session start webhook event.

```APIDOC
## SSH 'session start' event

### Description
Example of the response data for an SSH session start webhook event.

### Response
#### Success Response (200)
- **category** (string) - The webhook event type. One of `ssh-session`, `certificate-request`, or `certificate-expiration`.
- **hostname** (string) - The name of the registered host
- **username** (string) - The posix username of the user responsible for the ssh session
- **id** (string) - The Smallstep ssh session id
- **timestamp** (string) - The time at which the event occurred
- **type** (string) - The specific type of SSH event type

#### Response Example

{
  "category": "ssh-session",
  "hostname": "example-host.example.com",
  "username": "tester",
  "id": "d0547bbd-aab6-4531-b809-868f60d0bda7",
  "timestamp": "2022-08-01 20:29:23.333679027 +0000 UTC",
  "type": "start"
}

```

--------------------------------

### step certificate fingerprint example

Source: https://smallstep.com/docs/step-cli/reference/ca/init

Example command to get the root certificate fingerprint, used with the --issuer-fingerprint flag.

```bash
$ step certificate fingerprint root_ca.crt
4fe5f5ef09e95c803fdcb80b8cf511e2a885eb86f3ce74e3e90e62fa3faf1531
```

--------------------------------

### Allow all URI subdomains of 'example.com' on provisioner level

Source: https://smallstep.com/docs/step-cli/reference/ca/policy/acme/x509/allow/uri

Adds a wildcard URI domain to the provisioner-level X.509 allow policy, specifying the provisioner name.

```bash
$ step ca policy provisioner x509 allow uri "*example.com" --provisioner my_provisioner
```

--------------------------------

### Initialize a Smallstep PKI with step ca init

Source: https://smallstep.com/docs/tutorials/ssh-certificate-login

Run this command to create a new PKI. The output shows the generated root and intermediate certificates, SSH keys, and configuration files.

```bash
step ca init
```

--------------------------------

### SSH 'session start' event response

Source: https://smallstep.com/docs/certificate-manager/webhook-events

Example JSON response for an SSH session start webhook event. Contains category, hostname, username, id, timestamp, and type fields.

```json
{
  "category": "ssh-session",
  "hostname": "example-host.example.com",
  "username": "tester",
  "id": "d0547bbd-aab6-4531-b809-868f60d0bda7",
  "timestamp": "2022-08-01 20:29:23.333679027 +0000 UTC",
  "type": "start"
}
```

--------------------------------

### Initialize CA and start step-ca

Source: https://smallstep.com/docs/step-ca/renewal

Commands to create a password file, initialize a new PKI with `step ca init`, and start the CA server. The password file avoids repeated password entry.

```bash
$ echo "p4ssword" > password.txt
$ step ca init --name "Speedy" --provisioner admin \
               --dns localhost --address ":443" \
               --password-file password.txt \
               --provisioner-password-file password.txt
$ step-ca $(step path)/config/ca.json --password-file password.txt
```

--------------------------------

### Example step-ca configuration (ca.json)

Source: https://smallstep.com/docs/step-ca/configuration

A complete example configuration file for step-ca, showing root, intermediate, SSH, database, authority, provisioners, and TLS settings.

```json
{
  "root": "examples/pki/secrets/root_ca.crt",
  "federatedRoots": ["examples/pki/secrets/federated_root_ca.crt"],
  "crt": "examples/pki/secrets/intermediate_ca.crt",
  "key": "examples/pki/secrets/intermediate_ca_key",
  "address": ":9000",
  "dnsNames": [
    "localhost"
  ],
  "logger": {
    "format": "text"
  },
  "ssh": {
    "hostKey": "/examples/pki/secrets/secrets.host.key",
    "userKey": "/examples/pki/secrets/secrets.user.key"
  },
  "db": {
    "type": "badgerv2",
    "dataSource": "/Users/carl/.step/authorities/config-example/db"
  }, 
  "crl": {
    "enabled": false
  }, 
  "authority": {
    "disableIssuedAtCheck": false,
    "claims": {
      "minTLSCertDuration": "5m",
      "maxTLSCertDuration": "24h",
      "defaultTLSCertDuration": "24h",
      "disableRenewal": false,
      "allowRenewalAfterExpiry": false,
      "minHostSSHCertDuration": "5m",
      "maxHostSSHCertDuration": "1680h",
      "defaultHostSSHCertDuration": "720h",
      "minUserSSHCertDuration": "5m",
      "maxUserSSHCertDuration": "24h",
      "defaultUserSSHCertDuration": "16h"
    },
    "policy": {
      "x509": {
        "allow": {
          "dns": ["*.local"]
        },
        "allowWildcardNames": false
      },
      "ssh": {
        "user": {
          "allow": {
            "email": ["@local"]
          }
        },
        "host": {
          "allow": {
            "dns": ["*.local"]
          }
        }
      }
    },
    "provisioners": [
      {
        "type": "jwk",
        "name": "mike@smallstep.com",
        "key": {
          "use": "sig",
          "kty": "EC",
          "kid": "YYNxZ0rq0WsT2MlqLCWvgme3jszkmt99KjoGEJJwAKs",
          "crv": "P-256",
          "alg": "ES256",
          "x": "LsI8nHBflc-mrCbRqhl8d3hSl5sYuSM1AbXBmRfznyg",
          "y": "F99LoOvi7z-ZkumsgoHIhodP8q9brXe4bhF3szK-c_w"
        },
        "encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjEwMDAwMCwicDJzIjoiVERQS2dzcEItTUR4ZDJxTGo0VlpwdyJ9.2_j0cZgTm2eFkZ-hrtr1hBIvLxN0w3TZhbX0Jrrq7vBMaywhgFcGTA.mCasZCbZJ-JT7vjA.bW052WDKSf_ueEXq1dyxLq0n3qXWRO-LXr7OzBLdUKWKSBGQrzqS5KJWqdUCPoMIHTqpwYvm-iD6uFlcxKBYxnsAG_hoq_V3icvvwNQQSd_q7Thxr2_KtPIDJWNuX1t5qXp11hkgb-8d5HO93CmN7xNDG89pzSUepT6RYXOZ483mP5fre9qzkfnrjx3oPROCnf3SnIVUvqk7fwfXuniNsg3NrNqncHYUQNReiq3e9I1R60w0ZQTvIReY7-zfiq7iPgVqmu5I7XGgFK4iBv0L7UOEora65b4hRWeLxg5t7OCfUqrS9yxAk8FdjFb9sEfjopWViPRepB0dYPH8dVI.fb6-7XWqp0j6CR9Li0NI-Q",
        "claims": {
          "minTLSCertDuration": "1m0s",
          "defaultTLSCertDuration": "2m0s"
        },
        "options": {
          "x509": {
            "templateFile": "templates/certs/x509/default.tpl"
          },
          "ssh": {
            "templateFile": "templates/certs/ssh/default.tpl"
          }
        }
      },
      {
        "type": "OIDC",
        "name": "Google",
        "clientID": "1087160488420-8qt7bavg3qesdhs6it824mhnfgcfe8il.apps.googleusercontent.com",
        "clientSecret": "udTrOT3gzrO7W9fDPgZQLfYJ",
        "configurationEndpoint": "https://accounts.google.com/.well-known/openid-configuration",
        "admins": ["you@smallstep.com"],
        "domains": ["smallstep.com"],
        "listenAddress": ":10000",
        "claims": {
          "maxTLSCertDuration": "8h",
          "defaultTLSCertDuration": "2h",
          "enableSSHCA": true,
          "disableRenewal": true
        },
        "options": {
          "x509": {
            "templateFile": "templates/certs/x509/default.tpl"
          },
          "ssh": {
            "templateFile": "templates/certs/ssh/default.tpl"
          }
        }
      },
      {
        "type": "SSHPOP",
        "name": "sshpop-smallstep",
        "claims": {
          "enableSSHCA": true
        }
      },
      {
        "type": "ACME",
        "name": "my-acme-provisioner"
      }
    ]
  },
  "tls": {
    "cipherSuites": [
      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
    ],
    "minVersion": 1.2,
    "maxVersion": 1.3,
    "renegotiation": false
  },
  "password": "p@55w0rd"
}
```

--------------------------------

### Get SSH Certificate Fingerprint

Source: https://smallstep.com/docs/step-cli/basic-crypto-operations

Use `step ssh fingerprint` to get the fingerprint of an SSH certificate or public key. The example shows the output for the same certificate, displaying the SHA256 fingerprint.

```bash
$ step ssh fingerprint < mycert.crt
256 SHA256:CQ6+r7ccb/wqoWK1ror10c44nNvvYXp2mgbPrsTmCbw c (ECDSA-CERT)
```

--------------------------------

### Get public key of a certificate

Source: https://smallstep.com/docs/step-cli/reference/certificate/key

Example command that prints the public key of a certificate. The output shows a PEM-encoded public key.

```bash
$ step certificate key certificate.crt
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEio9DLyuglMxakS3w00DUKdGbeXXB
2Mfg6tVofeXYan9RbvftZufiypIAVqGZqO7CR9EbkoyHb/7GcKQa5HZ9rA==
-----END PUBLIC KEY-----
```

--------------------------------

### Install step manually on Windows via PowerShell

Source: https://smallstep.com/docs/step-cli/installation

Downloads the Windows binary and extracts it, then runs the version command to verify installation.

```powershell
curl.exe -LO https://dl.smallstep.com/cli/docs-cli-install/latest/step_windows_amd64.zip
Expand-Archive -LiteralPath .\step_windows_amd64.zip -DestinationPath .
step_windows_amd64\bin\step.exe version
```

--------------------------------

### Initialize PKI with step ca init

Source: https://smallstep.com/docs/design-document

Creates root and intermediate certificates, private keys, configuration files, and a provisioner. The --name flag sets the CA's human-readable name, and --dns specifies the CA's DNS name. The command outputs the generated artifacts and their paths.

```bash
ca$ echo "p4ss" > password.txt

ca$ step ca init --name "Smallstep" --provisioner admin \
                    --dns "ca.internal" --address ":443" \
                    --password-file password.txt \
                    --provisioner-password-file password.txt

Generating root certificate... all done!

Generating intermediate certificate... all done!

✔ Root certificate: certs/root_ca.crt
✔ Root private key: secrets/root_ca_key
✔ Root fingerprint: 0601bb45459f9e8230b6f09cd9e69c746669fd82e960fe421b7af0cdfd329ac2
✔ Intermediate certificate: certs/intermediate_ca.crt
✔ Intermediate private key: secrets/intermediate_ca_key
✔ Default configuration: config/defaults.json
✔ Certificate Authority configuration: config/ca.json

Your PKI is ready to go. To generate certificates for individual services see 'step help ca'.
```

--------------------------------

### Get device TPM fingerprint

Source: https://smallstep.com/docs/platform/smallstep-agent

Navigate to the agent installation directory and run the smallstep-agent.exe command to obtain the device's TPM fingerprint.

```powershell
cd 'C:\Program Files\Smallstep\SmallstepAgent\'
.\smallstep-agent.exe tpm --fingerprint
```

--------------------------------

### Get public key of a CSR and save to file

Source: https://smallstep.com/docs/step-cli/reference/certificate/key

Example command that extracts the public key from a CSR and saves it to a file using the `--out` option.

```bash
$ step certificate key certificate.csr --out key.pem
```

--------------------------------

### Bootstrap and configure host

Source: https://smallstep.com/docs/ssh/how-it-works

Set up mTLS and configure SSH to use certificates on a host.

```bash
step ca bootstrap
```

```bash
step ssh config --host
```

--------------------------------

### Run Go server in background

Source: https://smallstep.com/docs/step-ca/getting-started

Runs the example Go server as a background process.

```bash
go run srv.go &
```

--------------------------------

### Add Smallstep Helm repository

Source: https://smallstep.com/docs/registration-authorities/acme-for-certificate-manager

Adds the Smallstep Helm charts repository and updates it. These commands are part of the Helm setup for installing the RA chart.

```bash
$ helm repo add smallstep https://smallstep.github.io/helm-charts/
```

```bash
$ helm repo update smallstep
```

--------------------------------

### Create a Certificate Authority with Let's Encrypt

Source: https://smallstep.com/docs/step-cli/basic-crypto-operations

Requests an SSL certificate from Let's Encrypt, starts a standalone HTTP server on port 80 to serve the http-01 challenge, and saves the certificate and private key to example.com.crt and example.com.key. Use --webroot <path> to place the token file instead of running a server. For a dry run, use the staging server URL https://acme-staging-v02.api.letsencrypt.org/directory.

```shell
step ca certificate example.com example.com.crt example.com.key
```

--------------------------------

### Get certificate for localhost

Source: https://smallstep.com/docs/step-ca/getting-started

Requests a certificate (`srv.crt`) and private key (`srv.key`) from the CA for the example server on `localhost`. Prompts for the provisioner password and displays the CA URL and output file paths.

```bash
step ca certificate localhost srv.crt srv.key

✔ Key ID: rQxROEr7Kx9TNjSQBTETtsu3GKmuW9zm02dMXZ8GUEk (bob@example.com)
✔ Please enter the password to decrypt the provisioner key: abc123
✔ CA: https://localhost:8443/1.0/sign
✔ Certificate: srv.crt
✔ Private Key: srv.key
```

--------------------------------

### Run step-ca with a configuration file

Source: https://smallstep.com/docs/step-ca/configuration

Use this command to start step-ca with the configuration file created by 'step ca init'. The path is obtained via 'step path'.

```shell
$ step-ca $(step path)/config/ca.json
```

--------------------------------

### Request certificate with custom not-before and not-after durations

Source: https://smallstep.com/docs/certificate-manager/custom-certs

Use --not-before and --not-after together to set a validity window. This example creates a certificate valid starting 5 minutes from now until 10 days from now.

```bash
$ step ca certificate localhost localhost.crt localhost.key --not-before=5m --not-after=240h
```

--------------------------------

### Allow DNS subdomains on provisioner level

Source: https://smallstep.com/docs/step-cli/reference/ca/policy/acme/x509/allow/dns

Adds all DNS subdomains of "example.com" to the allowed DNS names in X.509 certificates for the specified provisioner.

```shell
$ step ca policy provisioner x509 allow dns "*example.com" --provisioner my_provisioner
```

--------------------------------

### Bash script to get SmallstepAgent version from plist

Source: https://smallstep.com/docs/tutorials/connect-jamf-pro-to-smallstep

This script reads the CFBundleShortVersionString from the plist, falling back to CFBundleVersion if not available. It outputs the version in a Jamf Pro extension attribute format, or 'Not Installed' if the plist is missing.

```bash
VERSION=$(/usr/bin/defaults read "$PLIST" CFBundleShortVersionString 2>/dev/null)
if [ -z "$VERSION" ]; then
  VERSION=$(/usr/bin/defaults read "$PLIST" CFBundleVersion 2>/dev/null)
fi
echo "<result>$VERSION</result>"
else
  echo "<result>Not Installed</result>"
fi
```

--------------------------------

### cron-based renewal setup for step ca renew

Source: https://smallstep.com/docs/step-ca/renewal

Example of setting up cron-based renewal on a Debian-based system. The command writes a cron job to /etc/cron.d/step-ca-renew that runs step ca renew every five minutes with --expires-in 4h. The user 'step' must have write access to the certificate and key files.

```bash
$ cat <<EOF | sudo tee /etc/cron.d/step-ca-renew
# Check for possible certificate renewal every five minutes
*/5 * * * *   step   step ca renew --force --expires-in 4h /home/step/foo.crt /home/step/foo.key
EOF
```

--------------------------------

### Bootstrap and install root certificate

Source: https://smallstep.com/docs/step-cli/reference/ca/bootstrap

Bootstraps and installs the root certificate into the system's default trust store using the --install flag.

```bash
$ step ca bootstrap --ca-url https://ca.example.com \
  --fingerprint d9d0978692f1c7cc791f5c343ce98771900721405e834cd27b9502cc719f5097 \
  --install
```

--------------------------------

### Install root certificate in Java and system trust stores

Source: https://smallstep.com/docs/step-cli/reference/certificate/install

Installs the root certificate in Java's key store and the system's default trust store using the `--java` flag.

```bash
$ step certificate install --java root-ca.pem
```

--------------------------------

### Install step on macOS with Homebrew

Source: https://smallstep.com/docs/design-document

Installs the step CLI on macOS using Homebrew. For Linux, Docker, or Kubernetes, refer to the installation instructions in the repositories.

```bash
brew install step
```

--------------------------------

### Install step-cli on Arch Linux via pacman

Source: https://smallstep.com/docs/step-cli/installation

Installs the community-maintained step-cli package on Arch Linux. The binary is installed as step-cli, so a symlink is needed to use 'step'.

```bash
sudo pacman -S step-cli
```

```bash
sudo ln -s /usr/bin/step-cli /usr/local/bin/step
```

--------------------------------

### Usage: step ca provisioner list

Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/list

Shows the command syntax with optional flags for CA URL, root certificate, and context.

```bash
step ca provisioner list
[--ca-url=<uri>] [--root=<file>] [--context=<name>]
```

--------------------------------

### Silent MSI installation of Smallstep Agent

Source: https://smallstep.com/docs/platform/smallstep-agent

Manual installation command for the agent installer. Use the appropriate MSI file for your system: step-agent_amd64_latest.msi for most systems, step-agent_arm64_latest.msi for ARM64.

```powershell
msiexec.exe /i "path\to\step-agent_amd64_latest.msi" /quiet
```

--------------------------------

### X5C Provisioner Configuration Example

Source: https://smallstep.com/docs/step-ca/provisioners

Example configuration for an X5C provisioner, showing required fields (type, name, roots) and optional fields (claims, options). The type must be 'X5C' and roots are base64-encoded PEM blocks.

```json
{
  "type": "X5C",
  "name": "x5c",
  "roots": ["base64-encoded-root-cert"]
}
```

--------------------------------

### Start step-ca server with generated configuration

Source: https://smallstep.com/docs/tutorials/ssh-certificate-login

Launch the step-ca server using the configuration generated by step ca init. You will be prompted for the passwords to decrypt the intermediate and SSH host/user keys.

```bash
$ step-ca $(step path)/config/ca.json
Please enter the password to decrypt /tmp/mystep/secrets/intermediate_ca_key:
Please enter the password to decrypt /tmp/mystep/secrets/ssh_host_key:
Please enter the password to decrypt /tmp/mystep/secrets/ssh_user_key:
2019/09/11 23:34:13 Serving HTTPS on :443 ...
```
Tokens:
Raw