### Install step on Windows via Winget Source: https://smallstep.com/docs/step-cli/installation Use Winget to install the step binary on Windows. ```powershell winget install Smallstep.step ``` -------------------------------- ### Install step on Windows via Scoop Source: https://smallstep.com/docs/step-cli/installation Use Scoop to add the smallstep bucket and install the step binary. ```powershell scoop bucket add smallstep https://github.com/smallstep/scoop-bucket.git scoop install smallstep/step ``` -------------------------------- ### Install step on Wolfi Source: https://smallstep.com/docs/step-cli/installation Use apk to install the step package on Wolfi. ```bash apk add step ``` -------------------------------- ### Install step-cli on Debian/Ubuntu Source: https://smallstep.com/docs/step-cli/installation Add the Smallstep repository and install the step-cli package as root. ```bash apt-get update && apt-get install -y --no-install-recommends curl gpg ca-certificates curl -fsSL https://packages.smallstep.com/keys/apt/repo-signing-key.gpg -o /etc/apt/keyrings/smallstep.asc cat << EOF > /etc/apt/sources.list.d/smallstep.sources Types: deb URIs: https://packages.smallstep.com/stable/debian Suites: debs Components: main Signed-By: /etc/apt/keyrings/smallstep.asc EOF apt-get update && apt-get -y install step-cli ``` -------------------------------- ### Install step-cli on RHEL/Fedora Source: https://smallstep.com/docs/step-cli/installation Configure the Smallstep repository and install the step-cli and step-ca packages as root. ```bash cat < /etc/yum.repos.d/smallstep.repo [smallstep] name=Smallstep baseurl=https://packages.smallstep.com/stable/fedora/ enabled=1 repo_gpgcheck=0 gpgcheck=1 gpgkey=https://packages.smallstep.com/keys/smallstep-0x889B19391F774443.gpg EOT dnf makecache && dnf install -y step-cli step-ca ``` -------------------------------- ### Bootstrap and install root certificate Source: https://smallstep.com/docs/step-cli/reference/ca/bootstrap Bootstraps and installs the root certificate into the system's default trust store using the --install flag. ```bash $ step ca bootstrap --ca-url https://ca.example.com \ --fingerprint d9d0978692f1c7cc791f5c343ce98771900721405e834cd27b9502cc719f5097 \ --install ``` -------------------------------- ### Example: step crypto key inspect priv.pem Source: https://smallstep.com/docs/step-cli/reference/crypto/key/inspect Prints details of the given key file. The example uses `priv.pem` as the key file. ```bash $ step crypto key inspect priv.pem ``` -------------------------------- ### Example: step ca provisioner list Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/list Prints a JSON list with active provisioners. ```bash $ step ca provisioner list ``` -------------------------------- ### Usage: step certificate install Source: https://smallstep.com/docs/step-cli/reference/certificate/install Shows the command syntax for installing a root certificate. The `crt-file` argument is the root certificate to install. Options include `--prefix`, `--all`, `--java`, `--firefox`, and `--no-system`. ```bash step certificate install [--prefix=] [--all] [--java] [--firefox] [--no-system] ``` -------------------------------- ### KMS configuration examples Source: https://smallstep.com/docs/step-cli/reference/ca/sign Examples of URI formats for configuring various cloud KMS or HSM providers when using the --kms flag. ```text yubikey:pin-value=123456 pkcs11:module-path=/usr/lib/softhsm/libsofthsm2.so;token=smallstep?pin-value=pass tpmkms:name=my-key;device=/dev/tpmrm0 awskms:region=us-east-1 azurekms:client-id=fooo;client-secret=bar;tenant-id=9de53416-4431-4181-7a8b-23af3EXAMPLE ``` -------------------------------- ### Start an HTTP file server Source: https://smallstep.com/docs/step-cli/reference/fileserver Starts an HTTP file server on the specified address and port. ```bash $ step fileserver --address :8080 /path/to/web-root ``` -------------------------------- ### Install root certificate in Java and system trust stores Source: https://smallstep.com/docs/step-cli/reference/certificate/install Installs the root certificate in Java's key store and the system's default trust store using the `--java` flag. ```bash $ step certificate install --java root-ca.pem ``` -------------------------------- ### Start an HTTPS file server Source: https://smallstep.com/docs/step-cli/reference/fileserver Generates a certificate and starts an HTTPS file server on the specified address and port. ```bash $ step ca certificate 127.0.0.1 localhost.crt localhost.key ... $ step fileserver --address 127.0.0.1:8443 \ --cert localhost.crt --key localhost.key /path/to/web-root ``` -------------------------------- ### Install step on macOS via Homebrew Source: https://smallstep.com/docs/step-cli/installation Use Homebrew to install the step binary on macOS. ```bash brew install step ``` -------------------------------- ### Install step on Windows manually Source: https://smallstep.com/docs/step-cli/installation Download and extract the Windows binary using PowerShell. ```powershell curl.exe -LO https://dl.smallstep.com/cli/docs-cli-install/latest/step_windows_amd64.zip Expand-Archive -LiteralPath .\step_windows_amd64.zip -DestinationPath . step_windows_amd64\bin\step.exe version ``` -------------------------------- ### step context current example Source: https://smallstep.com/docs/step-cli/reference/context/current Example of running `step context current` without options, displaying the current context name. ```bash $ step context current test-ca ``` -------------------------------- ### Install step-cli on Alpine Linux Source: https://smallstep.com/docs/step-cli/installation Use apk to install the community-maintained step-cli package. ```bash apk add step-cli ``` -------------------------------- ### Start an HTTPS file server with client certificate requirements Source: https://smallstep.com/docs/step-cli/reference/fileserver Starts an HTTPS file server that requires client certificates for authentication, using the root CA certificate from the step path. ```bash $ step fileserver --cert localhost.crt --key localhost.key \ --roots $(step path)/certs/root_ca.crt /path/to/web-root ``` -------------------------------- ### Install root certificate in all supported trust stores Source: https://smallstep.com/docs/step-cli/reference/certificate/install Installs the root certificate in Firefox's, Java's, and the system's default trust store using the `--all` flag. ```bash $ step certificate install --all root-ca.pem ``` -------------------------------- ### Test Step CLI installation Source: https://smallstep.com/docs/step-cli/installation Use the step certificate inspect command to verify that the CLI is correctly installed and can communicate with a remote server. ```bash $ step certificate inspect https://smallstep.com Certificate: Data: Version: 3 (0x2) Serial Number: 326381749415081530968054238478851085504954 (0x3bf265673332db2d0c70e48a163fb7d11ba) Signature Algorithm: SHA256-RSA Issuer: C=US,O=Let's Encrypt,CN=Let's Encrypt Authority X3 Validity Not Before: Feb 8 13:07:44 2019 UTC Not After : May 9 13:07:44 2019 UTC Subject: CN=smallstep.com [...] ``` -------------------------------- ### Install step-cli on Arch Linux Source: https://smallstep.com/docs/step-cli/installation Install the community-maintained step-cli package and create a symlink for the step command. ```bash sudo pacman -S step-cli ``` ```bash sudo ln -s /usr/bin/step-cli /usr/local/bin/step ``` -------------------------------- ### step crypto nacl auth verify examples Source: https://smallstep.com/docs/step-cli/reference/crypto/nacl/auth Example of verifying a digest with the verify subcommand. First variant prompts for text; second pipes a file. Output is 'ok' when verification succeeds. ```bash $ step crypto nacl auth verify auth.key 33c54aeb54077808fcfccadcd2f01971b120e314dffa61516b0738b74fdc8ff1 Please enter text to verify: ok $ cat message.txt | step crypto nacl auth verify auth.key 33c54aeb54077808fcfccadcd2f01971b120e314dffa61516b0738b74fdc8ff1 ok ``` -------------------------------- ### step context current --json example Source: https://smallstep.com/docs/step-cli/reference/context/current Example of running `step context current --json`, returning stringified JSON with context attributes. ```bash $ step context current --json {"name":"test-ca","authority":"internal.ca.smallstep.com","profile":"test-ca"} ``` -------------------------------- ### YubiKey KMS URI example Source: https://smallstep.com/docs/step-cli/reference/ca/token An example of a YubiKey KMS URI configuration string used with the --kms flag. ```text yubikey:pin-value=123456 ``` -------------------------------- ### step fileserver Source: https://smallstep.com/docs/step-cli/reference/fileserver Starts an HTTP(S) server that serves the contents of a directory. This command is experimental and intended for test purposes. ```APIDOC ## step fileserver ### Description Starts an HTTP(S) server that serves the contents of a file system. If the server is running using certificates, sending the HUP signal will reload the certificates. This command is experimental and only intended for test purposes. ### Usage step fileserver [--address=
] [--cert=] [--key=] [--roots=] [--pidfile=] ### Positional Arguments - **dir** (string) - Required - The directory used as root for the HTTP file server. ### Options - **--address** (string) - Optional - The TCP address to listen on (e.g. ":8443"). - **--cert** (string) - Optional - The file containing the TLS certificate to use. - **--key** (string) - Optional - The file containing the key corresponding to the certificate. - **--roots** (string) - Optional - The file containing the root certificate(s) that will be used to verify the client certificates. - **--pidfile** (string) - Optional - The path to the file to write the process ID. ### Examples Start an HTTP file server on port 8080: ``` $ step fileserver --address :8080 /path/to/web-root ``` Start an HTTPS file server on 127.0.0.1:8443: ``` $ step ca certificate 127.0.0.1 localhost.crt localhost.key ... $ step fileserver --address 127.0.0.1:8443 \ --cert localhost.crt --key localhost.key /path/to/web-root ``` Start an HTTPS file server on a random port and require client certificates: ``` $ step fileserver --cert localhost.crt --key localhost.key \ --roots $(step path)/certs/root_ca.crt /path/to/web-root ``` ``` -------------------------------- ### step certificate install Source: https://smallstep.com/docs/step-cli/reference/certificate/install Installs a root certificate in the supported trust stores. Supports Java and Firefox trust stores via flags. ```APIDOC ## step certificate install ### Description Installs a root certificate in the supported trust stores. Java's and Firefox's trust stores are also supported via the respective flags. ### Usage step certificate install [--prefix=] [--all] [--java] [--firefox] [--no-system] ### Positional Arguments - **crt-file** (string) - Required - Root certificate to install in the specified trust stores. ### Options - **--prefix**= (string) - Optional - The prefix used to name the CA in the trust store. Defaults to the certificate common name. - **--java** (boolean) - Optional - Install on the Java key store. - **--firefox** (boolean) - Optional - Install on the Firefox NSS security database. - **--no-system** (boolean) - Optional - Disables the install on the system's default trust store. - **--all** (boolean) - Optional - Install in Firefox's, Java's, and the system's default trust store. ### Examples Install a root certificate in the system's default trust store: $ step certificate install root-ca.pem Install a root certificate in all the supported trust stores: $ step certificate install --all root-ca.pem Install a root certificate in Firefox's and the system's default trust store: $ step certificate install --firefox root-ca.pem Install a root certificate in Java's and the system's default trust store: $ step certificate install --java root-ca.pem Install a root certificate in Firefox's and Java's trust store, but not in the system's default trust store: $ step certificate install --firefox --java --no-system root-ca.pem ``` -------------------------------- ### step certificate fingerprint example Source: https://smallstep.com/docs/step-cli/reference/ca/init Example command to get the root certificate fingerprint, used with the --issuer-fingerprint flag. ```bash $ step certificate fingerprint root_ca.crt 4fe5f5ef09e95c803fdcb80b8cf511e2a885eb86f3ce74e3e90e62fa3faf1531 ``` -------------------------------- ### Get SSH Certificate Fingerprint Source: https://smallstep.com/docs/step-cli/basic-crypto-operations Use `step ssh fingerprint` to get the fingerprint of an SSH certificate or public key. The example shows the output for the same certificate, displaying the SHA256 fingerprint. ```bash $ step ssh fingerprint < mycert.crt 256 SHA256:CQ6+r7ccb/wqoWK1ror10c44nNvvYXp2mgbPrsTmCbw c (ECDSA-CERT) ``` -------------------------------- ### Allow all URI subdomains of example.com at provisioner level Source: https://smallstep.com/docs/step-cli/reference/ca/policy/acme/x509/deny/uri Command to allow all URI subdomains of "example.com" in X.509 certificates on provisioner level. ```bash $ step ca policy provisioner x509 allow uri "*example.com" --provisioner my_provisioner ``` -------------------------------- ### Get public key from a CSR and save to file Source: https://smallstep.com/docs/step-cli/reference/certificate/key Example command that extracts the public key from `certificate.csr` and writes it to `key.pem` using the `--out` option. ```bash $ step certificate key certificate.csr --out key.pem ``` -------------------------------- ### Get public key from a certificate Source: https://smallstep.com/docs/step-cli/reference/certificate/key Example command that prints the public key embedded in `certificate.crt` to standard output, followed by the resulting PEM-encoded public key. ```bash $ step certificate key certificate.crt -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEio9DLyuglMxakS3w00DUKdGbeXXB 2Mfg6tVofeXYan9RbvftZufiypIAVqGZqO7CR9EbkoyHb/7GcKQa5HZ9rA== -----END PUBLIC KEY----- ``` -------------------------------- ### Create a Certificate Authority with Let's Encrypt Source: https://smallstep.com/docs/step-cli/basic-crypto-operations Requests an SSL certificate from Let's Encrypt, starts a standalone HTTP server on port 80 to serve the http-01 challenge, and saves the certificate and private key to example.com.crt and example.com.key. Use --webroot to place the token file instead of running a server. For a dry run, use the staging server URL https://acme-staging-v02.api.letsencrypt.org/directory. ```shell step ca certificate example.com example.com.crt example.com.key ``` -------------------------------- ### Allow DNS subdomains on provisioner level Source: https://smallstep.com/docs/step-cli/reference/ca/policy/acme/x509/allow/dns Adds all DNS subdomains of "example.com" to the allowed DNS names in X.509 certificates for the specified provisioner. ```shell $ step ca policy provisioner x509 allow dns "*example.com" --provisioner my_provisioner ``` -------------------------------- ### Usage: step ca provisioner list Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/list Shows the command syntax with optional flags for CA URL, root certificate, and context. ```bash step ca provisioner list [--ca-url=] [--root=] [--context=] ``` -------------------------------- ### Create a JWK provisioner with existing keys Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/add Creates a JWK provisioner using pre-existing public and private key files. ```bash step ca provisioner add jane@doe.com --type JWK --public-key jwk.pub --private-key jwk.priv ``` -------------------------------- ### Install root certificate in Firefox and Java but not system Source: https://smallstep.com/docs/step-cli/reference/certificate/install Installs the root certificate in Firefox's and Java's trust stores, but disables installation in the system's default trust store using the `--no-system` flag. ```bash $ step certificate install --firefox --java --no-system root-ca.pem ``` -------------------------------- ### Package a certificate and private key Source: https://smallstep.com/docs/step-cli/reference/certificate/p12 Creates a .p12 file containing the specified certificate and private key. ```bash $ step certificate p12 foo.p12 foo.crt foo.key ``` -------------------------------- ### step ca init usage Source: https://smallstep.com/docs/step-cli/reference/ca/init Shows the command-line usage for step ca init, including all available flags and their placeholders. ```bash step ca init [--root=] [--key=] [--key-password-file=] [--pki] [--ssh] [--helm] [--deployment-type=] [--name=] [--dns=] [--address=
] [--provisioner=] [--admin-subject=] [--provisioner-password-file=] [--password-file=] [--ra=] [--kms=] [--with-ca-url=] [--no-db] [--remote-management] [--acme] [--context=] [--profile=] [--authority=] ``` -------------------------------- ### Example JWE compact serialization output Source: https://smallstep.com/docs/step-cli/reference/crypto/jwe An example of a JWE in compact serialization, with line breaks for display purposes. ```text eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ. OKOawDo13gRp2ojaHV7LFpZcgV7T6DVZKTyKOMTYUmKoTCVJRgckCL9kiMT03JGe ipsEdY3mx_etLbbWSrFr05kLzcSr4qKAq7YN7e9jwQRb23nfa6c9d-StnImGyFDb Sv04uVuxIp5Zms1gNxKKK2Da14B8S4rzVRltdYwam_lDp5XnZAYpQdb76FdIKLaV mqgfwX7XWRxv2322i-vDxRfqNzo_tETKzpVLzfiwQyeyPGLBIO56YJ7eObdv0je8 1860ppamavo35UgoRdbYaBcoh9QcfylQr66oc6vFWXRcZ_ZT2LawVCWTIy3brGPi 6UklfCpIMfIjf7iGdXKHzg. 48V1_ALb6US04U3b. 5eym8TW_c8SuK0ltJ3rpYIzOeDQz7TALvtu6UG9oMo4vpzs9tX_EFShS8iB7j6ji SdiwkIr3ajwQzaBtQD_A. XFBoMYUZodetZdvTiFvSkQ ``` -------------------------------- ### Allow all email addresses for example.com domain in X.509 certificates on provisioner level Source: https://smallstep.com/docs/step-cli/reference/ca/policy/authority/ssh/host/deny/email Adds the domain @example.com to the allow policy for X.509 certificates at the provisioner level, specifying the provisioner name. ```shell $ step ca policy provisioner x509 allow email @example.com --provisioner my_provisioner ``` -------------------------------- ### Create an X5C provisioner Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/add Creates an X5C provisioner using the specified root certificate file. ```bash step ca provisioner add x5c --type X5C --x5c-roots x5c_ca.crt ``` -------------------------------- ### Configure CA URL and root in the environment Source: https://smallstep.com/docs/step-cli/reference/ca Bootstraps the environment by configuring the CA URL and fingerprint, then shows the resulting defaults.json file. The root path in the output will reflect your user's home directory. ```shell $ step ca bootstrap \ --ca-url https://ca.smallstep.com \ --fingerprint 0d7d3834cf187726cf331c40a31aa7ef6b29ba4df601416c9788f6ee01058cf3 $ cat $STEPPATH/config/defaults.json { "ca-url": "https://ca.smallstep.com", "fingerprint": "0d7d3834cf187726cf331c40a31aa7ef6b29ba4df601416c9788f6ee01058cf3", "root": "/home/user/.step/certs/root_ca.crt" } ``` -------------------------------- ### Install root certificate in system trust store Source: https://smallstep.com/docs/step-cli/reference/certificate/install Installs the root certificate in the system's default trust store. This is the default behavior when no trust store flags are specified. ```bash $ step certificate install root-ca.pem ``` -------------------------------- ### Retrieve encrypted private JWK example Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/jwe-key An example command showing how to retrieve the encrypted private JWK for a specific key-id using a specified CA URL and root certificate. ```bash $ step ca provisioner jwe-key 1234 --ca-url https://127.0.0.1 --root ./root.crt ``` -------------------------------- ### step ca root - get root fingerprint Source: https://smallstep.com/docs/step-cli/reference/ca/root Gets the root fingerprint from a root certificate file. The output shows the SHA-256 fingerprint that is later used with the --fingerprint flag. ```shell $ step certificate fingerprint /path/to/root_ca.crt 0d7d3834cf187726cf331c40a31aa7ef6b29ba4df601416c9788f6ee01058cf3 ``` -------------------------------- ### Create an ACME provisioner for device attestation Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/add Creates an ACME provisioner configured for device attestation using the device-attest-01 challenge. ```bash step ca provisioner add attestation --type ACME --challenge device-attest-01 ``` -------------------------------- ### Add regular admin Source: https://smallstep.com/docs/step-cli/reference/ca/admin/add Adds an admin with the subject 'max@smallstep.com' using the 'google' provisioner. ```bash $ step ca admin add max@smallstep.com google ``` -------------------------------- ### Install root certificate in Firefox and system trust stores Source: https://smallstep.com/docs/step-cli/reference/certificate/install Installs the root certificate in Firefox's NSS security database and the system's default trust store using the `--firefox` flag. ```bash $ step certificate install --firefox root-ca.pem ``` -------------------------------- ### Create an ACME provisioner Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/add Creates a basic ACME provisioner. ```bash step ca provisioner add acme --type ACME ``` -------------------------------- ### step crypto nacl auth digest examples Source: https://smallstep.com/docs/step-cli/reference/crypto/nacl/auth Example of generating a 32-byte digest (HMAC-SHA-512-256) with the digest subcommand. First variant prompts for text; second pipes a file. Output is a 64-character hex digest. ```bash $ step crypto nacl auth digest auth.key Please enter text to authenticate: 33c54aeb54077808fcfccadcd2f01971b120e314dffa61516b0738b74fdc8ff1 $ cat message.txt | step crypto nacl auth digest auth.key 33c54aeb54077808fcfccadcd2f01971b120e314dffa61516b0738b74fdc8ff1 ``` -------------------------------- ### Bootstrap using CA URL and fingerprint Source: https://smallstep.com/docs/step-cli/reference/ca/bootstrap Bootstraps the environment by specifying the CA URL and root certificate fingerprint. ```bash $ step ca bootstrap --ca-url https://ca.example.com \ --fingerprint d9d0978692f1c7cc791f5c343ce98771900721405e834cd27b9502cc719f5097 ``` -------------------------------- ### Create a new certificate using a token Source: https://smallstep.com/docs/step-cli/reference/ca Creates a new certificate for internal.example.com by generating a token first)Skip; the certificate and key are written to internal.crt and internal.key. ```shell $ TOKEN=$(step ca token internal.example.com) $ step ca certificate internal.example.com internal.crt internal.key \ --token $TOKEN --ca-url https://ca.smallstep.com --root root_ca.crt ``` -------------------------------- ### Step crl inspect command and examples Source: https://smallstep.com/docs/step-cli/reference/crl/inspect The general usage of the step crl inspect command, followed by examples for inspecting a CRL, validating with a CA file, formatting output as JSON, and extracting CRL from a URL. ```bash step crl inspect ``` ```bash $ step crl inspect --insecure http://ca.example.com/crls/exampleca.crl ``` ```bash $ step crl inspect --ca ca.crt exampleca.crl ``` ```bash $ step crl inspect --insecure --format json exampleca.crl ``` ```bash $ step crl inspect --from https://www.google.com ``` -------------------------------- ### Create a JWK provisioner with custom config path Source: https://smallstep.com/docs/step-cli/reference/ca/provisioner/add Creates a JWK provisioner and explicitly selects the configuration file to update. ```bash step ca provisioner add cicd --type JWK --create --ca-config /path/to/ca.json ``` -------------------------------- ### KMS URI examples Source: https://smallstep.com/docs/step-cli/reference/ca/certificate Examples of KMS URIs for YubiKey, PKCS #11, TPM 2.0, AWS KMS, and Azure Key Vault. These URIs are used with the --kms flag to configure a KMS or HSM. ```text yubikey:pin-value=123456 pkcs11:module-path=/usr/lib/softhsm/libsofthsm2.so;token=smallstep?pin-value=pass tpmkms:name=my-key;device=/dev/tpmrm0 awskms:region=us-east-1 azurekms:client-id=fooo;client-secret=bar;tenant-id=9de53416-4431-4181-7a8b-23af3EXAMPLE ``` -------------------------------- ### step oauth --bare Source: https://smallstep.com/docs/step-cli/reference/oauth Get just the access token. ```shell $ step oauth --bare ``` -------------------------------- ### step oauth --oidc --bare Source: https://smallstep.com/docs/step-cli/reference/oauth Get just the OIDC token. ```shell $ step oauth --oidc --bare ``` -------------------------------- ### Apply configuration templates on host Source: https://smallstep.com/docs/step-cli/reference/ssh/config Applies configuration templates for a host system. ```bash $ step ssh config --host ``` -------------------------------- ### Inspect a CRL Source: https://smallstep.com/docs/step-cli/reference/crl Example command to inspect a certificate revocation list from a specified URL. ```bash $ step crl inspect http://ca.example.com/crls/exampleca.crl ``` -------------------------------- ### Get a new token using simple offline mode Source: https://smallstep.com/docs/step-cli/reference/ca/token Requires configuration files, certificates, and keys created with step ca init. ```shell $ step ca token internal.example.com --offline ``` -------------------------------- ### Allow all local parts for example.com domain in SSH user certificates on provisioner level Source: https://smallstep.com/docs/step-cli/reference/ca/policy/authority/ssh/host/deny/email Adds the domain @example.com to the allow policy for SSH user certificates at the provisioner level, specifying the provisioner name. ```shell $ step ca policy provisioner ssh user allow email @example.com --provisioner my_provisioner ```