\n\n\n {`In this documentation, we will explore basic certificate operations using the `}{`step`}{` command-line tool.\n`}{`step`}{` acts as a front-end interface to certificate manager and is used for many common crypto and X.509 operations.\nThis tutorial covers:`}
\n \n - {`Creating a certificate`}
\n - {`Inspecting a certificate`}
\n - {`Renewing a certificate`}
\n - {`Revoking a certificate`}
\n
\n \n \n \n {`Before you begin`}
\n {`This tutorial assumes you have created a Smallstep Team and a Certificate Manager Authority using the steps in `}{`Getting Started`}{`.`}
\n {`step 1 - Create a test certificate`}
\n {`With an Authority created and your local client configured,\nyou can create a test certificate by running the `}{`step ca certificate`}{` command.\nHere is an example:`}
\n \n {`$ step ca certificate myservice myservice.crt myservice.key --san myservice.internal.mycompany.net --not-after 24h`}\n \n {`In this command, we are asking the CA to create a certificate with the following properties`}
\n \n - {`myservice`}{` - The certificate's subject`}
\n - {`myservice.crt`}{` - Save the certificate in a file with this name`}
\n - {`myservice.key`}{` - Save the key in a file with this name`}
\n - {`--san myservice.internal.mycompany.net`}{` - Add an additional SAN to the certificate, with the specified value`}
\n - {`--not-after 24h`}{` - Set the certificate to expire after 24 hours`}
\n
\n {`When you run this command, it will envoke the `}{`authority-admin`}{` provisioner and start a single sign-on flow via the smallstep dashboard.\nAfter a successful sign-in, the authority will issue the certificate. `}
\n {`Step 2 - Inspect a test certificate`}
\n {`You can inspect your certificate by running:`}
\n \n {`$ step certificate inspect --short myservice.crt`}\n \n {`It should look similar to this.`}
\n {`X.509v3 TLS Certificate (ECDSA P-256) [Serial: 2441...2018]\n Subject: myservice\n admin@yourco.com\n https://auth.smallstep.com#98496ed4-7f27-4367-b7a2-ef828e0a4eda\n Issuer: Dev Intermediate CA\n Provisioner: authority-admin [ID: 909d...8521]\n Valid from: 2021-10-04T21:30:12Z\n to: 2021-10-05T21:31:12Z\n`}
\n {`step 3 - renew a certificate`}
\n {`Certificates expire.\nCertificate Manager makes renewing a certificate ahead of expiration easy.\nRenewals are authenticated using your existing certificate and produce an identical certificate with a new serial number and extended lifetime.\nThe private key is unchanged.`}
\n {`In its most primitive form, renewal is a simple single-command operation:`}
\n \n {`$ step ca renew myservice.crt myservice.key`}\n \n {`More than a dozen `}{`command-line flags`}{` make `}{`step ca renew`}{` flexible and easy to integrate into almost any operational environment.`}
\n {`Inspect your certificate again, and you will see it has an extended lifetime. `}
\n \n {`$ step certificate inspect --short myservice.crt\nX.509v3 TLS Certificate (ECDSA P-256) [Serial: 2441...2018]\n Subject: myservice\n admin@yourco.com\n https://auth.smallstep.com#98496ed4-7f27-4367-b7a2-ef828e0a4eda\n Issuer: Dev Intermediate CA\n Provisioner: authority-admin [ID: 909d...8521]\n Valid from: 2021-10-04T21:32:34Z\n to: 2021-10-05T21:33:34Z`}\n \n {`step 4 - revoke a certificate`}
\n {`Certificate Manager uses passive revocation by default.\nTo passively revoke a certificate means to block its renewal at the CA.\nThis eliminates the additional network request that occurs when using active revocation because the certificate expires by itself.\nWith passive revocation, certificates cannot be immediately revoked.\nTherefore, certificates should have a shorter life to reduce the value of a key that has been exfiltrated.\nTo revoke a certificate, run the following operation.`}
\n \n {`$ step ca revoke --cert=myservice.crt --key=myservice.key\n ✔ CA: https://your.authority.ca.smallstep.com\nCertificate with Serial Number 215963883671773554731824269659406308792 has been revoked.`}\n \n {`Upon expiry, this certificate will no longer be valid.\nIf you try to renew the certificate, it will fail.`}
\n \n {`$ step ca renew myservice.crt myservice.key\n error renewing certificate: The request lacked necessary authorization to be completed. Please see the certificate authority logs for more info.`}\n \n {`Passive revocation doesn't use Certificate Revocation List (CRL) and Online Certificate Signing Protocol (OCSP) like Web PKI.\nCertificate Manager support for CRL and OCSP is coming soon.`}
\n \n \n Need help with Certificate Operations?
Contact our Customer Success team.\n
{`Next Steps`}
\n \n - {`You've now mastered the art of basic certificate operations. It's time to explore `}{`customizing certificates`}{`.`}
\n - {`Ready to dive into a specific technology? Check out our `}{`practical zero trust project`}{`. It provides step-by-step instructions for configuring TLS for popular technologies in Linux, Docker, and Kubernetes. `}
\n
\n\n ;\n}\n;\nMDXContent.isMDXComponent = true;\n "],"names":["_frontmatter","makeShortcode","name","props","console","warn","Alert","CodeBlock","layoutProps","MDXLayout","DefaultLayout","MDXContent","components","mdxType","parentName","severity","href","language","copyText","isMDXComponent"],"sourceRoot":""}