### Install Dependencies and Start Node.js ACME Client

Source: https://smallstep.com/docs/tutorials/acme-protocol-acme-clients

Commands to install the 'node-acme-client' package and start the ACME client server. Ensure Node.js and npm are installed.

```shell
npm install node-acme-client
node acme.js
```

--------------------------------

### Start Caddy Web Server

Source: https://smallstep.com/docs/tutorials/acme-protocol-acme-clients

Command to start the Caddy web server. Ensure Caddy is installed and configured before running this command.

```shell
$ sudo caddy start
```

--------------------------------

### step-ca Startup Output with X.509 Root Fingerprint

Source: https://smallstep.com/docs/step-ca/cryptographic-protection

Example output when starting step-ca, showing the server URL, root certificates availability, and the X.509 root fingerprint.

```text
2022/09/20 16:28:45 The primary server URL is https://localhost:443
2022/09/20 16:28:45 Root certificates are available at https://localhost:443/roots.pem
2022/09/20 16:28:45 X.509 Root Fingerprint: b061dfca1013c074244b0f376e5be70b6eb0bd7f21d5438aa3af71fe62b0acf5
2022/09/20 16:28:45 Serving HTTPS on :443 ...
```

--------------------------------

### Install step CLI

Source: https://smallstep.com/docs/tutorials/docker-tls-certificate-authority

To interact with `step-ca`, install the `step` client in your host environment. Refer to the installation documentation for detailed instructions.

```bash
# Install the step CLI
curl https://get.smallstep.com/cli | sh
```

--------------------------------

### Start Webhook Server

Source: https://smallstep.com/docs/step-ca/webhooks

Starts the Go webhook server. Ensure the webhookIDsToSecrets and db maps in main.go are updated prior to starting.

```bash
go run main.go
```

--------------------------------

### Install step-cli and step-ca on Debian/Ubuntu

Source: https://smallstep.com/docs/step-ca/installation

Adds the Smallstep APT repository and installs the step-cli and step-ca packages. Ensure curl, gpg, and ca-certificates are installed first.

```bash
apt-get update && apt-get install -y --no-install-recommends curl gpg ca-certificates
curl -fsSL https://packages.smallstep.com/keys/apt/repo-signing-key.gpg -o /etc/apt/keyrings/smallstep.asc
cat << EOF > /etc/apt/sources.list.d/smallstep.sources
Types: deb
URIs: https://packages.smallstep.com/stable/debian
Suites: debs
Components: main
Signed-By: /etc/apt/keyrings/smallstep.asc
EOF
apt-get update && apt-get -y install step-cli step-ca
```

--------------------------------

### Run Python Example Server

Source: https://smallstep.com/docs/tutorials/user-authentication

Execute the Python script to start the mTLS server on port 8443.

```bash
python server.py
```

--------------------------------

### Install step-cli and step-ca on RHEL/Fedora

Source: https://smallstep.com/docs/step-ca/installation

Adds the Smallstep DNF repository and installs the step-cli and step-ca packages.

```bash
cat <<EOT > /etc/yum.repos.d/smallstep.repo
[smallstep]
name=Smallstep
baseurl=https://packages.smallstep.com/stable/fedora/
enabled=1
repo_gpgcheck=0
gpgcheck=1
gpgkey=https://packages.smallstep.com/keys/smallstep-0x889B19391F774443.gpg
EOT
dnf makecache && dnf install -y step-cli step-ca
```

--------------------------------

### Install step on Wolfi

Source: https://smallstep.com/docs/step-cli/installation

Installs the maintained step package on Wolfi using apk.

```bash
apk add step

```

--------------------------------

### Install step-cli on Debian/Ubuntu

Source: https://smallstep.com/docs/step-cli/installation

Add Smallstep as a source and install the `step-cli` package on Debian or Ubuntu. This involves updating package lists, installing prerequisites, adding the Smallstep repository key and source list, and finally installing the package. To uninstall, run `sudo dpkg -r step-cli` and remove the `$HOME/.step` configuration directory.

```bash
apt-get update && apt-get install -y --no-install-recommends curl gpg ca-certificates
curl -fsSL https://packages.smallstep.com/keys/apt/repo-signing-key.gpg -o /etc/apt/keyrings/smallstep.asc
cat << EOF > /etc/apt/sources.list.d/smallstep.sources
Types: deb
URIs: https://packages.smallstep.com/stable/debian
Suites: debs
Components: main
Signed-By: /etc/apt/keyrings/smallstep.asc
EOF
apt-get update && apt-get -y install step-cli
```

--------------------------------

### Install step-ca on Wolfi

Source: https://smallstep.com/docs/step-ca/installation

Installs the step-ca package using apk.

```bash
apk add step-ca
```

--------------------------------

### Install Root Certificate

Source: https://smallstep.com/docs/certificate-manager/how-it-works

Add a downloaded root certificate to your system's trust store using `step certificate install`. You will be prompted for a password to complete the installation.

```bash
$ step certificate install root.crt
Password:
Certificate r.crt has been installed.
X.509v3 Root CA Certificate (ECDSA P-256) [Serial: 1829...9147]
  Subject:     Root CA
  Issuer:      Root CA
  Valid from:  2020-09-18T20:55:03Z
          to:  2030-09-16T20:55:03Z

```

--------------------------------

### Test step-cli Installation

Source: https://smallstep.com/docs/step-cli/installation

Tests the step-cli installation by inspecting a certificate from smallstep.com.

```bash
$ step certificate inspect https://smallstep.com
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 326381749415081530968054238478851085504954 (0x3bf265673332db2d0c70e48a163fb7d11ba)
    Signature Algorithm: SHA256-RSA
        Issuer: C=US,O=Let's Encrypt,CN=Let's Encrypt Authority X3
        Validity
            Not Before: Feb 8 13:07:44 2019 UTC
            Not After : May 9 13:07:44 2019 UTC
        Subject: CN=smallstep.com
[...]

```

--------------------------------

### Start Vagrant VM

Source: https://smallstep.com/docs/tutorials/ssh-certificate-login

This command starts a Vagrant VM, configures its network, and sets up SSHD to accept user certificates. It also prints instructions for configuring your local SSH client.

```bash
$ vagrant up
Bringing machine 'testhost' up with 'virtualbox' provider...
==> testhost: Importing base box 'ubuntu/bionic64'...
    [...] 
==> testhost: Preparing network interfaces based on configuration...
    testhost: Adapter 1: nat
    testhost: Adapter 2: hostonly
==> testhost: Forwarding ports...
    testhost: 22 (guest) => 2222 (host) (adapter 1)
==> testhost: Running 'pre-boot' VM customizations...
==> testhost: Booting VM...
==> testhost: Waiting for machine to boot. This may take a few minutes...
    testhost: SSH address: 127.0.0.1:2222
    testhost: SSH username: vagrant
    testhost: SSH auth method: private key
    testhost: VirtualBox Version: 6.0
    [...] 
==> testhost: Setting hostname...
==> testhost: Configuring and enabling network interfaces...
==> testhost: Mounting shared folders...
    testhost: /keys => /Users/sourishkrout/dev/src/smallstep/code/src/github.com/smallstep/step-examples/ssh-example/keys
    testhost: /vagrant => /Users/sourishkrout/dev/src/smallstep/code/src/github.com/smallstep/step-examples/ssh-example
==> testhost: Running provisioner: shell...
    testhost: Running: inline script
    testhost: Add following line to your local hosts ~/.ssh/known_hosts file to accept host certs
    testhost: @cert-authority * ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJJM+jkIdieQvdPb8DwnfnJudEc9PgVBqLDWHKgvqoIiMXhuIyGstQ9ULOBMdJkqxMjkRTFZp1iFvIk+iU6hwTA=
    testhost: Add a /etc/hosts file entry testhost to resolve to 192.168.0.101
    testhost: Check out README.md to learn how to grab user ssh certs to log into testhost

```

--------------------------------

### Install step-cli and step-certificates on Alpine Linux

Source: https://smallstep.com/docs/step-ca/installation

Installs the step-cli and step-certificates packages using apk.

```bash
apk add step-cli step-certificates
```

--------------------------------

### Install step CLI Tool

Source: https://smallstep.com/docs/ssh/hosts-step-by-step

Downloads and installs the latest step CLI tool for Linux AMD64 architecture. Ensure the tool is executable and placed in the system's PATH.

```bash
$ curl -L -o step https://dl.smallstep.com/s3/cli/docs-ssh-host-step-by-step/step_latest_linux_amd64
$ install -m 0755 -t /usr/bin step
```

--------------------------------

### Add Smallstep Repository and Install on RHEL/Fedora

Source: https://smallstep.com/docs/step-cli/installation

Adds the Smallstep repository and installs step-cli and step-ca packages using dnf. Ensure you run this as root.

```bash
cat <<EOT > /etc/yum.repos.d/smallstep.repo
[smallstep]
name=Smallstep
baseurl=https://packages.smallstep.com/stable/fedora/
enabled=1
repo_gpgcheck=0
gpgcheck=1
gpgkey=https://packages.smallstep.com/keys/smallstep-0x889B19391F774443.gpg
EOT
dnf makecache && dnf install -y step-cli step-ca

```

--------------------------------

### Start and Enable Smallstep Agent Service

Source: https://smallstep.com/docs/platform/smallstep-agent

Use systemctl commands to reload the daemon, enable, and start the step-agent service on Linux systems.

```bash
sudo systemctl daemon-reload
sudo systemctl enable --now step-agent
```

--------------------------------

### Install Smallstep SSH on a Bastion Host

Source: https://smallstep.com/docs/ssh/hosts

Use this command as root to install the Smallstep SSH host script on a bastion host. This script automates the installation and bootstrapping process.

```bash
$ curl -sSLO https://files.smallstep.com/ssh-host.sh
$ bash ssh-host.sh --is-bastion

```

--------------------------------

### Install step-cli and step-ca on Arch Linux

Source: https://smallstep.com/docs/step-ca/installation

Installs the step-cli and step-ca packages using pacman.

```bash
pacman -S step-cli step-ca
```

--------------------------------

### Start Keycloak Docker Containers

Source: https://smallstep.com/docs/tutorials/keycloak-oidc-provisioner

After creating the docker-compose.yml and certs directory, use this command to start the Keycloak and MySQL services.

```bash
docker-compose up

```

--------------------------------

### Add Scoop Bucket and Install step

Source: https://smallstep.com/docs/step-cli/installation

Adds the Smallstep scoop bucket and installs the step package using scoop.

```powershell
scoop bucket add smallstep https://github.com/smallstep/scoop-bucket.git
scoop install smallstep/step

```

--------------------------------

### Start HTTP File Server

Source: https://smallstep.com/docs/step-cli/reference/fileserver

Starts an HTTP file server on the specified address and directory. Useful for testing web content delivery.

```bash
step fileserver --address :8080 /path/to/web-root
```

--------------------------------

### Start HTTPS File Server with Certificates

Source: https://smallstep.com/docs/step-cli/reference/fileserver

Starts an HTTPS file server using provided TLS certificate and key files. This is suitable for secure file serving in test environments.

```bash
step ca certificate 127.0.0.1 localhost.crt localhost.key
step fileserver --address 127.0.0.1:8443 \
  --cert localhost.crt --key localhost.key /path/to/web-root
```

--------------------------------

### Install step-cli on Alpine Linux

Source: https://smallstep.com/docs/step-cli/installation

Installs the community-maintained step-cli package using apk.

```bash
apk add step-cli

```

--------------------------------

### JWK Provisioner Configuration Example

Source: https://smallstep.com/docs/step-ca/provisioners

An example of a complete JWK provisioner configuration within the ca.json file. This illustrates the structure and required fields for a JWK provisioner.

```json
{
    "type": "JWK",
    "name": "you@smallstep.com",
    "key": {
        "use": "sig",
        "kty": "EC",
        "kid": "NPM_9Gz_omTqchS6Xx9Yfvs-EuxkYo6VAk4sL7gyyM4",
        "crv": "P-256",
        "alg": "ES256",
        "x": "bBI5AkO9lwvDuWGfOr0F6ttXC-ZRzJo8kKn5wTzRJXI",
        "y": "rcfaqE-EEZgs34Q9SSH3f9Ua5a8dKopXNfEzDD8KRlU"
    },
    "encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjEwMDAwMCwicDJzIjoiTlV6MjlEb3hKMVdOaFI3dUNjaGdYZyJ9.YN7xhz6RAbz_9bcuXoymBOj8bOg23ETAdmSCRyHpxGekkV0q3STYYg.vo1oBnZsZjgRu5Ln.Xop8AvZ74h_im2jxeaq-hYYWnaK_eF7MGr4xcZGodMUxp-hGPqS85oWkyprkQLYt1-jXTURfpejtmPeB4-sxgj7OFxMYYus84BdkG9BZgSBmMN9SqZItOv4pqg_NwQA0bv9g9A_e-N6QUFanxuYQsEPX_-IwWBDbNKyN9bXbpEQa0FKNVsTvFahGzOxQngXipi265VADkh8MJLjYerplKIbNeOJJbLd9CbS9fceLvQUNr3ACGgAejSaWmeNUVqbho1lY4882iS8QVx1VzjluTXlAMdSUUDHArHEihz008kCyF0YfvNdGebyEDLvTmF6KkhqMpsWn3zASYBidc9k._ch9BtvRRhcLD838itIQlw",
    "claims": {
        "minTLSCertDuration": "5m",
        "maxTLSCertDuration": "24h",
        "defaultTLSCertDuration": "24h",
        "disableRenewal": false,
        "minHostSSHCertDuration": "5m",
        "maxHostSSHCertDuration": "1680h",
        "minUserSSHCertDuration": "5m",
        "maxUserSSHCertDuration": "24h",
        "enableSSHCA": true
    },
    "options": {
        "x509": {
            "templateFile": "templates/certs/x509/default.tpl"
        },
        "ssh": {
            "templateFile": "templates/certs/ssh/default.tpl"
        }
    }
}
```

--------------------------------

### Clone Webhook Example Repository

Source: https://smallstep.com/docs/step-ca/webhooks

Clones the official Step CA webhook example repository to your local machine for customization or testing.

```bash
git clone https://github.com/smallstep/webhooks.git
cd webhooks
```

--------------------------------

### Enable and Start step Daemon Service

Source: https://smallstep.com/docs/step-ca/renewal

Enable and start the systemd service for the step CA renew daemon.

```bash
sudo systemctl enable --now step
```

--------------------------------

### Install step-cli on Arch Linux

Source: https://smallstep.com/docs/step-cli/installation

Installs the community-maintained step-cli package using pacman. A symlink is created for convenience.

```bash
sudo pacman -S step-cli

```

```bash
sudo ln -s /usr/bin/step-cli /usr/local/bin/step

```

--------------------------------

### Start Step CA

Source: https://smallstep.com/docs/step-ca/webhooks

Starts the Step CA server in a separate window, allowing it to process requests and interact with webhooks.

```bash
step-ca --context webhooks
```

--------------------------------

### Install step via Winget on Windows

Source: https://smallstep.com/docs/step-cli/installation

Installs the step package using the Winget package manager. A terminal restart may be required.

```powershell
winget install Smallstep.step

```

--------------------------------

### Install step-ca on Windows using Winget

Source: https://smallstep.com/docs/step-ca/installation

Installs the `step-ca.exe` and `step.exe` binaries using the Winget package manager. A terminal restart may be required for the path to update.

```bash
winget install Smallstep.step-ca
```

--------------------------------

### Install Smallstep Agent via Winget on Windows

Source: https://smallstep.com/docs/platform/smallstep-agent

Install the Smallstep Agent on Windows using the winget package manager.

```powershell
winget install Smallstep.step-agent
```

--------------------------------

### Add Smallstep Scoop bucket and install step-ca

Source: https://smallstep.com/docs/step-ca/installation

Adds the Smallstep Scoop bucket and installs both the `step` CLI and `step-ca` using Scoop. The configuration directory `$HOME/.step` should be removed upon uninstallation.

```bash
scoop bucket add smallstep https://github.com/smallstep/scoop-bucket.git
scoop install smallstep/step
scoop install smallstep/step-ca
```

--------------------------------

### Clone Repository and Navigate to Directory

Source: https://smallstep.com/docs/tutorials/pki-trust-model-federation

Clone the smallstep certificates repository and navigate to the basic-federation folder to access the tutorial's code examples.

```bash
git clone https://github.com/smallstep/certificates.git
cd ./certificates/examples/basic-federation
```

--------------------------------

### Install Smallstep Agent and OpenSSL TPM2 Engine on Ubuntu

Source: https://smallstep.com/docs/platform/smallstep-agent

Install the Smallstep agent plugin and the OpenSSL TPM2 engine on Ubuntu after setting up the repository.

```bash
sudo apt-get update && sudo apt-get -y install step-agent-plugin openssl-tpm2-engine
```

--------------------------------

### Start Demo Server with Cloud CA Token

Source: https://smallstep.com/docs/tutorials/pki-trust-model-federation

Launch the demo server using a certificate obtained from the Cloud CA. The server will report the root certificates it uses for authentication.

```bash
go run server/main.go $(step ca token --ca-url https://localhost:1443 --root ./pki/cloud/certs/root_ca.crt 127.0.0.1)
✔ Key ID: EE1ZiqkMaxsUdpz8SCSkRBzwK9TWUoidQnMnJ8Eryn8 (sebastian@smallstep.com)
✔ Please enter the password to decrypt the provisioner key: password
Server is using federated root certificates
Accepting certs anchored in CN=Smallstep Public Cloud Root CA
Accepting certs anchored in CN=Smallstep Kubernetes Root CA
Listening on :8443 ...
```

--------------------------------

### Get Base Step Path with STEPPATH Override

Source: https://smallstep.com/docs/step-cli/reference/path

This example shows how to get the base Step path when the STEPPATH environment variable is set, overriding the default location. The output will be the base directory specified by STEPPATH.

```bash
export STEPPATH=/tmp/step
step path --base
```

--------------------------------

### Request Certificate with Custom Start and End Times

Source: https://smallstep.com/docs/certificate-manager/custom-certs

Specify both --not-before and --not-after flags to control the exact validity window of a certificate. This example sets the certificate to be valid starting in 5 minutes and expiring in 10 days.

```bash
$ step ca certificate localhost localhost.crt localhost.key --not-before=5m --not-after=240h
```

--------------------------------

### Manually Install step-cli on Windows

Source: https://smallstep.com/docs/step-cli/installation

Downloads the Windows binary, expands it, and checks the version. The binary should then be moved to a PATH location.

```powershell
curl.exe -LO https://dl.smallstep.com/cli/docs-cli-install/latest/step_windows_amd64.zip
Expand-Archive -LiteralPath .\step_windows_amd64.zip -DestinationPath .
step_windows_amd64\bin\step.exe version

```

--------------------------------

### Install Smallstep SSH on Any Other Host

Source: https://smallstep.com/docs/ssh/hosts

Use this command as root to install the Smallstep SSH host script on any host not covered by the bastion or behind-bastion scenarios. This command downloads and executes the script.

```bash
bash <(curl -sSf https://files.smallstep.com/ssh-host.sh)

```

--------------------------------

### Get Step Path with STEPPATH Override

Source: https://smallstep.com/docs/step-cli/reference/path

This example demonstrates how the 'step path' command respects the STEPPATH environment variable, overriding the default path. The output reflects the custom path set by the environment variable.

```bash
export STEPPATH=/tmp/step
step path
```

--------------------------------

### Testing ACME Certificate with curl

Source: https://smallstep.com/docs/tutorials/acme-protocol-acme-clients

Example command to test the ACME certificate obtained by Traefik. It starts a simple HTTP server and then uses curl to access the service using the obtained certificate, specifying the root CA certificate for validation.

```bash
$ echo "Hello TLS!" > index.html
$ python -m SimpleHTTPServer 8000 &
$ curl https://foo.internal --cacert $(step path)/certs/root_ca.crt

```

--------------------------------

### Download Helm Chart Values File

Source: https://smallstep.com/docs/registration-authorities/acme-for-certificate-manager

Download the example `step_values.yml` file for configuring the Helm chart. This file contains default settings that need to be customized for your specific environment.

```bash
$ curl -o step_values.yml -sSL https://raw.githubusercontent.com/smallstep/helm-charts/master/step-certificates/examples/registration_authority/values.yml

```

--------------------------------

### Verify Smallstep Agent Installation on Fedora

Source: https://smallstep.com/docs/platform/smallstep-agent

Check the installed version of the Smallstep agent plugin on Fedora to confirm successful installation.

```bash
step-agent-plugin version
```

--------------------------------

### Bootstrap CA Configuration

Source: https://smallstep.com/docs/design-document

Initialize the `step` client configuration and download the root certificate for a given CA URL and fingerprint. This sets up the necessary files for subsequent operations.

```bash
foo$ step ca bootstrap --ca-url https://ca.internal \
                        --fingerprint 0601bb45459f9e8230b6f09cd9e69c746669fd82e960fe421b7af0cdfd329ac2
```

--------------------------------

### Install Dependencies for Smallstep Agent on Ubuntu

Source: https://smallstep.com/docs/platform/smallstep-agent

Install necessary dependencies for the Smallstep Agent on Ubuntu, ensuring non-interactive frontend for unattended installations.

```bash
DEBIAN_FRONTEND=noninteractive
sudo apt-get update && sudo apt-get install -y --no-install-recommends curl gpg ca-certificates
```

--------------------------------

### Install cert-manager using Helm

Source: https://smallstep.com/docs/certificate-manager/kubernetes-tls/kubernetes-step-issuer

Installs the cert-manager Helm chart into a dedicated namespace. Ensures CRDs are installed with the chart. This command deploys cert-manager version v1.7.1.

```bash
helm install \
   cert-manager jetstack/cert-manager \
   --namespace cert-manager \
   --create-namespace \
   --version v1.7.1 \
   --set installCRDs=true
NAME: cert-manager
LAST DEPLOYED: Thu Mar 17 14:19:59 2022
NAMESPACE: cert-manager
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
cert-manager v1.7.1 has been deployed successfully!

In order to begin issuing certificates, you will need to set up a ClusterIssuer
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).

More information on the different types of issuers and how to configure them
can be found in our documentation:

https://cert-manager.io/docs/configuration/

For information on how to configure cert-manager to automatically provision
Certificates for Ingress resources, take a look at the 'ingress-shim'
documentation:

https://cert-manager.io/docs/usage/ingress/
```

--------------------------------

### Example Provisioner Configuration with X.509 and SSH Templates

Source: https://smallstep.com/docs/step-ca/templates/index.html

This JSON configuration shows how to define custom X.509 and SSH templates within a provisioner's options. It specifies template files and provides data for the X.509 template.

```json
{
  "type": "JWK",
  "name": "jane@doe.com",
  "key": {
      "use": "sig",
      "kty": "EC",
      "kid": "lq69QCCEwEhZys_wavar9RoqRLdJ58u_OGzJK0zswSU",
      "crv": "P-256",
      "alg": "ES256",
      "x": "pt7T0n98qREZUkyUX6b4kXJ5FkJlIdiMfJaLFclZIng",
      "y": "Pw1y1xqe4g4YARwyBSkEkcjNrtPYxdKlYDLI512t2_M"
  },
  "encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjEwMDAwMCwicDJzIjoiQ1dWZG5zWTR2bGZJbG9BQ1dOaUdNUSJ9.12dowlkvESpxJgrNJgP2ELDQz750HSh2w6Ux6BmatBE5-ybAJFFO7g.1cjU2-CTrV3gbUE7.m8a95nv4qLnN_K_PG7lzgzYXBGnw_aHCf-znJ34AZxzPy2QDGGEjN_V0jX3kvHH9AIg3cs8I8NRm__RDm2iezU5AhPoAHaqnPnZdKh0ReBZ4hNpYXUHlTPf4fRaCXXDQiKatxNzCMBpyqKpudf3xYUzZPRNMN78WM0ZeIzmv_jFzbryOpxD8bJ3Bnxa4e8Am_pPdAANHphodlKN2nDr4701OLKgitImm8RoA20sWdAI_LkTS_Abk_TqBo_3qOGdjmnRBtATFSu3BdQw5wZMjywfwCWKXUK_OUt-cjVIe11xUT43SoE8fR2GJJEKomAHP0vn0MUUMqY9P9icUejw.eEYI_H7WfrYDL4yhsnsJxg",
  "claims": {
    "enableSSHCA": true
  }
  "options": {
    "x509": {
      "templateFile": "templates/certs/x509/leaf.tpl",
      "templateData": {
        "OrganizationalUnit": "Engineering Team"
      }
    },
    "ssh": {
      "templateFile": "templates/certs/ssh/host.tpl"
    }
  }
}
```

--------------------------------

### Bootstrap CA with Context

Source: https://smallstep.com/docs/step-cli/the-step-command

Enable contexts by passing the --context flag to Step setup commands. This saves configuration and state data in context-specific directories.

```bash
$ step ca bootstrap \
       --ca-url https://ca.internal:4443 \
	   --fingerprint c8d3...7aa \
	   --context vpn
```

--------------------------------

### Initialize Step CA and Provisioner

Source: https://smallstep.com/docs/step-ca/renewal

Initializes a new Certificate Authority (CA) and configures an administrative provisioner. A password file is used to avoid interactive prompts.

```bash
$ echo "p4ssword" > password.txt
$ step ca init --name "Speedy" --provisioner admin \
               --dns localhost --address ":443" \
               --password-file password.txt \
               --provisioner-password-file password.txt
$ step-ca $(step path)/config/ca.json --password-file password.txt
```

--------------------------------

### Install Step CLI using Homebrew

Source: https://smallstep.com/docs/design-document

Use this command to install the Step CLI on macOS using the Homebrew package manager. Ensure Homebrew is installed before running this command.

```bash
brew install step
```

--------------------------------

### Install Smallstep Agent Silently

Source: https://smallstep.com/docs/platform/smallstep-agent

Use this command to silently install the Smallstep Agent MSI package on a Windows system. Ensure you replace 'path\to\' with the actual path to the downloaded installer.

```powershell
msiexec.exe /i "path\to\step-agent_amd64_latest.msi" /quiet
```

--------------------------------

### Initialize Certificate Authority

Source: https://smallstep.com/docs/step-ca/getting-started

Run this command to configure your CA. You will be prompted for project, DNS, and other information.

```bash
step ca init
```

--------------------------------

### Verify Smallstep CLI Installation

Source: https://smallstep.com/docs/step-ca/installation

Checks the installed version of the Smallstep CLI.

```bash
step version
```

--------------------------------

### Run Demo Client with Kubernetes CA Token

Source: https://smallstep.com/docs/tutorials/pki-trust-model-federation

Execute the demo client, which uses a certificate from the Kubernetes CA to establish a mutually authenticated connection with the demo server.

```bash
go run client/main.go $(step ca token sdk_client --ca-url https://localhost:2443 --root ./pki/kubernetes/certs/root_ca.crt)
✔ Key ID: S5gYgpeqcIAgc1Zr4myZXpgJ_Ao4ryS6F6wqg9o8RYo (sebastian@smallstep.com)
✔ Please enter the password to decrypt the provisioner key: password
Server responded: Hello sdk_client (cert issued by 'Smallstep Kubernetes Root CA') at 2019-01-23 00:51:38.576648 +0000 UTC
```

--------------------------------

### Verify Smallstep CA Installation

Source: https://smallstep.com/docs/step-ca/installation

Checks the installed version of the Smallstep Certificate Authority.

```bash
step-ca version
```

--------------------------------

### Generate a Certificate and Private Key

Source: https://smallstep.com/docs/step-ca/basic-certificate-authority-operations

Use `step ca certificate` to generate a private key and obtain a signed X.509 certificate for a given hostname. You will be prompted for the provisioner key password.

```bash
$ step ca certificate svc.example.com svc.crt svc.key
✔ Provisioner: carl@smallstep.com (JWK) [kid: JxCvTLC67zKCOi-yyMoHpO5vAj_MnXs80PR0nh7IjUg]
✔ Please enter the password to decrypt the provisioner key:
✔ CA: https://127.0.0.1:4337
✔ Certificate: svc.crt
✔ Private Key: svc.key

```

--------------------------------

### Compare CA Configuration Files

Source: https://smallstep.com/docs/tutorials/pki-trust-model-federation

View the differences between the standard CA configuration and the federated CA configuration for the Cloud CA.

```bash
diff pki/cloud/config/ca.json pki/cloud/config/ca.federated.json
3c3
< "federatedRoots": [],
---
> "federatedRoots": ["pki/cloud/certs/kubernetes_root_ca.crt"],
```

--------------------------------

### Package Certificate, Key, and Intermediate

Source: https://smallstep.com/docs/step-cli/reference/certificate/p12

Include an intermediate certificate in the .p12 file along with the main certificate and private key.

```bash
step certificate p12 foo.p12 foo.crt foo.key --ca intermediate.crt
```

--------------------------------

### Bootstrap Local Client to Certificate Manager Authority

Source: https://smallstep.com/docs/certificate-manager/getting-started

Configure your local 'step' CLI to connect with your hosted Certificate Manager Authority by downloading the CA Root certificate. Replace placeholders with your Authority's URL and fingerprint.

```bash
step ca bootstrap --ca-url [YOUR CA URL] --fingerprint [YOUR AUTHORITY FINGERPRINT]
```

--------------------------------

### Get Fingerprint for Local Root Certificate

Source: https://smallstep.com/docs/step-cli/reference/certificate/fingerprint

Use this command to get the fingerprint of a local root certificate file.

```bash
$ step certificate fingerprint /path/to/root_ca.crt
0d7d3834cf187726cf331c40a31aa7ef6b29ba4df601416c9788f6ee01058cf3
```

--------------------------------

### Initialize a New Certificate Authority

Source: https://smallstep.com/docs/step-ca/getting-started

Use this command to set up a new Public Key Infrastructure (PKI) for your CA. It prompts for configuration details like names, addresses, and provisioner information.

```bash
$ step ca init

✔ What would you like to name your new PKI? (e.g. Smallstep): Example Inc.
✔ What DNS names or IP addresses would you like to add to your new CA? (e.g. ca.smallstep.com[,1.1.1.1,etc.]): localhost
✔ What address will your new CA listen at? (e.g. :443): 127.0.0.1:8443
✔ What would you like to name the first provisioner for your new CA? (e.g. you@smallstep.com): bob@example.com
✔ What do you want your password to be? [leave empty and we will generate one]: abc123

Generating root certificate...
all done!

Generating intermediate certificate...
all done!

✔ Root certificate: /Users/bob/.step/certs/root_ca.crt
✔ Root private key: /Users/bob/.step/secrets/root_ca_key
✔ Root fingerprint: 702a094e239c9eec6f0dcd0a5f65e595bf7ed6614012825c5fe3d1ae1b2fd6ee
✔ Intermediate certificate: /Users/bob/.step/certs/intermediate_ca.crt
✔ Intermediate private key: /Users/bob/.step/secrets/intermediate_ca_key
✔ Default configuration: /Users/bob/.step/config/defaults.json
✔ Certificate Authority configuration: /Users/bob/.step/config/ca.json

Your PKI is ready to go.

```

--------------------------------

### Install cert-manager in Kubernetes

Source: https://smallstep.com/docs/tutorials/kubernetes-acme-ca

Apply the cert-manager installation manifest to your Kubernetes cluster. Ensure you use the correct release version.

```bash
kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.12.0/cert-manager.yaml
```

--------------------------------

### Initialize step-ca Configuration

Source: https://smallstep.com/docs/tutorials/intermediate-ca-new-ca

Run `step ca init` to generate boilerplate configuration files and artifacts. These include default CA certificates and keys.

```bash
$ step ca init
```

--------------------------------

### Download and install step binary on amd64 Linux

Source: https://smallstep.com/docs/step-ca/installation

Downloads the latest step binary tarball for amd64 Linux and copies the step executable to /usr/bin.

```bash
curl -LO https://dl.smallstep.com/cli/docs-ca-install/latest/step_linux_amd64.tar.gz
tar -xf step_linux_amd64.tar.gz
sudo cp step_linux_amd64/bin/step /usr/bin
```

--------------------------------

### Install Smallstep Agent on Debian

Source: https://smallstep.com/docs/platform/smallstep-agent

Install the Smallstep agent plugin on Debian after adding the repository and updating the package list.

```bash
sudo apt-get update && sudo apt-get -y install step-agent-plugin
```

--------------------------------

### Install step-issuer Helm Chart

Source: https://smallstep.com/docs/certificate-manager/kubernetes-tls/kubernetes-step-issuer

Installs the `step-issuer` Helm chart into a specified Kubernetes namespace. It creates the namespace if it does not exist.

```bash
$ helm install \
   step-issuer smallstep/step-issuer \
   --namespace step-issuer \
   --create-namespace
NAME: step-issuer
LAST DEPLOYED: Thu Mar 17 15:39:29 2022
NAMESPACE: default
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
⚙️  To get step-issuer up and running follow the next steps:
....

```

--------------------------------

### Download and install step-ca binary on amd64 Linux

Source: https://smallstep.com/docs/step-ca/installation

Downloads the latest step-ca binary tarball for amd64 Linux and copies the step-ca executable to /usr/bin.

```bash
curl -L https://dl.smallstep.com/certificates/docs-ca-install/latest/step-ca_linux_amd64.tar.gz
tar -xf step-ca_linux_amd64.tar.gz
sudo cp step-ca_linux_amd64/step-ca /usr/bin
```

--------------------------------

### Step CLI Help Command Usage

Source: https://smallstep.com/docs/step-cli/reference/help

Displays the general usage syntax for the 'step help' command.

```bash
step help <command>
```

--------------------------------

### Example Smallstep CA Configuration

Source: https://smallstep.com/docs/step-ca/configuration

A comprehensive example of a Smallstep CA configuration file, demonstrating various settings for root certificates, network, logging, database, SSH CA, certificate policies, provisioners, and TLS.

```json
{
  "root": "examples/pki/secrets/root_ca.crt",
  "federatedRoots": ["examples/pki/secrets/federated_root_ca.crt"],
  "crt": "examples/pki/secrets/intermediate_ca.crt",
  "key": "examples/pki/secrets/intermediate_ca_key",
  "address": ":9000",
  "dnsNames": [
    "localhost"
  ],
  "logger": {
    "format": "text"
  },
  "ssh": {
    "hostKey": "/examples/pki/secrets/secrets.host.key",
    "userKey": "/examples/pki/secrets/secrets.user.key"
  },
  "db": {
    "type": "badgerv2",
    "dataSource": "/Users/carl/.step/authorities/config-example/db"
  }, 
  "crl": {
    "enabled": false
  }, 
  "authority": {
    "disableIssuedAtCheck": false,
    "claims": {
      "minTLSCertDuration": "5m",
      "maxTLSCertDuration": "24h",
      "defaultTLSCertDuration": "24h",
      "disableRenewal": false,
      "allowRenewalAfterExpiry": false,
      "minHostSSHCertDuration": "5m",
      "maxHostSSHCertDuration": "1680h",
      "defaultHostSSHCertDuration": "720h",
      "minUserSSHCertDuration": "5m",
      "maxUserSSHCertDuration": "24h",
      "defaultUserSSHCertDuration": "16h"
    },
    "policy": {
      "x509": {
        "allow": {
          "dns": ["*.local"]
        },
        "allowWildcardNames": false
      },
      "ssh": {
        "user": {
          "allow": {
            "email": ["@local"]
          }
        },
        "host": {
          "allow": {
            "dns": ["*.local"]
          }
        }
      }
    },
    "provisioners": [
      {
        "type": "jwk",
        "name": "mike@smallstep.com",
        "key": {
          "use": "sig",
          "kty": "EC",
          "kid": "YYNxZ0rq0WsT2MlqLCWvgme3jszkmt99KjoGEJJwAKs",
          "crv": "P-256",
          "alg": "ES256",
          "x": "LsI8nHBflc-mrCbRqhl8d3hSl5sYuSM1AbXBmRfznyg",
          "y": "F99LoOvi7z-ZkumsgoHIhodP8q9brXe4bhF3szK-c_w"
        },
        "encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjEwMDAwMCwicDJzIjoiVERQS2dzcEItTUR4ZDJxTGo0VlpwdyJ9.2_j0cZgTm2eFkZ-hrtr1hBIvLxN0w3TZhbX0Jrrq7vBMaywhgFcGTA.mCasZCbZJ-JT7vjA.bW052WDKSf_ueEXq1dyxLq0n3qXWRO-LXr7OzBLdUKWKSBGQrzqS5KJWqdUCPoMIHTqpwYvm-iD6uFlcxKBYxnsAG_hoq_V3icvvwNQQSd_q7Thxr2_KtPIDJWNuX1t5qXp11hkgb-8d5HO93CmN7xNDG89pzSUepT6RYXOZ483mP5fre9qzkfnrjx3oPROCnf3SnIVUvqk7fwfXuniNsg3NrNqncHYUQNReiq3e9I1R60w0ZQTvIReY7-zfiq7iPgVqmu5I7XGgFK4iBv0L7UOEora65b4hRWeLxg5t7OCfUqrS9yxAk8FdjFb9sEfjopWViPRepB0dYPH8dVI.fb6-7XWqp0j6CR9Li0NI-Q",
        "claims": {
          "minTLSCertDuration": "1m0s",
          "defaultTLSCertDuration": "2m0s"
        },
        "options": {
          "x509": {
            "templateFile": "templates/certs/x509/default.tpl"
          },
          "ssh": {
            "templateFile": "templates/certs/ssh/default.tpl"
          }
        }
      },
      {
        "type": "OIDC",
        "name": "Google",
        "clientID": "1087160488420-8qt7bavg3qesdhs6it824mhnfgcfe8il.apps.googleusercontent.com",
        "clientSecret": "udTrOT3gzrO7W9fDPgZQLfYJ",
        "configurationEndpoint": "https://accounts.google.com/.well-known/openid-configuration",
        "admins": ["you@smallstep.com"],
        "domains": ["smallstep.com"],
        "listenAddress": ":10000",
        "claims": {
          "maxTLSCertDuration": "8h",
          "defaultTLSCertDuration": "2h",
          "enableSSHCA": true,
          "disableRenewal": true
        },
        "options": {
          "x509": {
            "templateFile": "templates/certs/x509/default.tpl"
          },
          "ssh": {
            "templateFile": "templates/certs/ssh/default.tpl"
          }
        }
      },
      {
        "type": "SSHPOP",
        "name": "sshpop-smallstep",
        "claims": {
          "enableSSHCA": true
        }
      },
      {
        "type": "ACME",
        "name": "my-acme-provisioner"
      }
    ]
  },
  "tls": {
    "cipherSuites": [
      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
    ],
    "minVersion": 1.2,
    "maxVersion": 1.3,
    "renegotiation": false
  },
  "password": "p@55w0rd"
}
```

--------------------------------

### Enable and Start Renewal Timers

Source: https://smallstep.com/docs/step-ca/renewal

Enable and start systemd timers for specific renewal services like postgresql and grafana-server.

```bash
systemctl enable --now cert-renewer@postgresql.timer
systemctl enable --now cert-renewer@grafana-server.timer
```

--------------------------------

### JWE Header Encoding Example

Source: https://smallstep.com/docs/step-cli/reference/crypto/jwe

This example shows how to base64url encode a JWE header with specified 'alg' and 'enc' members.

```bash
BASE64URL(UTF8({"alg":"RSA-OAEP","enc":"A256GCM"}))
=> eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ
```

--------------------------------

### Install Smallstep Certificate Authority via Helm

Source: https://smallstep.com/docs/step-ca/installation

Installs the step-certificates Helm chart, deploying the Smallstep CA to your Kubernetes cluster.

```bash
helm install step-certificates smallstep/step-certificates
```

--------------------------------

### Example SSH Certificate Template

Source: https://smallstep.com/docs/step-ca/templates

This is a basic example of an SSH certificate template. It demonstrates how to configure principals and extensions for SSH certificates.

```json
{
  "name": "default-ssh-template",
  "principals": ["{{ toJson .Principals }}"],
  "extensions": {
    "force-command": "{{ toJson .ForceCommand }}",
    "source-address": "{{ toJson .SourceAddress }}"
  }
}
```

--------------------------------

### Admin User Output Example

Source: https://smallstep.com/docs/step-ca/provisioners

The output of `step ca admin add` displays the subject, provisioner, and type of the newly created admin user.

```bash
SUBJECT    PROVISIONER        TYPE
carl       Admin JWK (JWK)    ADMIN
```

--------------------------------

### Install Smallstep Agent on Fedora

Source: https://smallstep.com/docs/platform/smallstep-agent

Install the Smallstep agent plugin on Fedora after adding the repository. This command also updates the package cache.

```bash
sudo dnf makecache && sudo dnf install -y step-agent-plugin
```

--------------------------------

### Step CLI Help Option

Source: https://smallstep.com/docs/step-cli/reference

Shows help information for the Step CLI. Use this to discover available commands and options.

```bash
--help , -h show help
```

--------------------------------

### Get SSH Certificate Fingerprint

Source: https://smallstep.com/docs/step-cli/basic-crypto-operations

Get the fingerprint of an SSH certificate or public key. This is useful for identifying and verifying SSH keys and certificates.

```bash
$ step ssh fingerprint < mycert.crt
256 SHA256:CQ6+r7ccb/wqoWK1ror10c44nNvvYXp2mgbPrsTmCbw c (ECDSA-CERT)
```

--------------------------------

### SCEP Provisioner Configuration in ca.json

Source: https://smallstep.com/docs/step-ca/provisioners

Example of a SCEP provisioner configuration within the step-ca JSON configuration file. This includes settings like challenge, minimum public key length, and encryption algorithm.

```json
{
    "type": "SCEP",
    "name": "my_scep_provisioner",
    "forceCN": true,
    "challenge": "secret1234",
    "minimumPublicKeyLength": 2048,
    "includeRoot": true,
    "encryptionAlgorithmIdentifier": 2
}
```

--------------------------------

### Example ACME Directory URL for 'ACME' Provisioner

Source: https://smallstep.com/docs/tutorials/acme-protocol-acme-clients

This specific example shows the ACME Directory URL for an ACME provisioner on the host 'ca.internal'.

```text
https://ca.internal/acme/ACME/directory
```