Menu
Products
Open Source
- Configure popular ACME clients to use a private CA
- Use Kubernetes cert-manager with
step-ca - Issue X.509 host certificates to cloud VMs
- Issue X.509 user certificates via your identity provider
- Create a CA that uses RSA keys
- Import an existing root or intermediate CA into
step-ca - Use Keycloak to issue SSH certificates with step-ca
- Run an SSH CA and connect to VMs using SSH certificates
- Use AWS to deploy a certificate authority and secure microservices
- Run
step-cain a Docker container - Federate multiple autonomous certificate authorities
Products
Open Source
- Configure popular ACME clients to use a private CA
- Use Kubernetes cert-manager with
step-ca - Issue X.509 host certificates to cloud VMs
- Issue X.509 user certificates via your identity provider
- Create a CA that uses RSA keys
- Import an existing root or intermediate CA into
step-ca - Use Keycloak to issue SSH certificates with step-ca
- Run an SSH CA and connect to VMs using SSH certificates
- Use AWS to deploy a certificate authority and secure microservices
- Run
step-cain a Docker container - Federate multiple autonomous certificate authorities
Smallstep Certificate Manager Getting Started
Smallstep Certificate Manager is a commercial product that delivers a managed certificate authority (CA) capable of issuing private x.509 TLS certificates.
Certificate Manager builds on two open-source projects, maintained by smallstep:
step-ca: a private online certificate authority for secure automated certificate management.step: a general-purpose cryptography toolkit and the client-side counterpart tostep-ca. With Certificate Manager, you can create your own private CA to manage certificates on internal services, websites, infrastructure, people, or devices.
Getting started with Certificate Manager
- Create a Team and Team Admin
- Create an Authority
- Install
stepon your client - Configure your client for your Authority
Before you begin
This tutorial assumes you are setting up Certificate Manager.
If you need SSH certificates instead, see our documentation for Smallstep SSH.
Have questions? Contact Customer Success.
step 1 - Create a Smallstep Team
Creating a team gives you access to Smallstep's products. Click here to create a team. You will be asked to provide:
Team Name- Usually, this is your company name.Team URL- This is where you will access the smallstep dashboard and will also be the base domain for the CA URL for any Authorities you create.First & Last Name- Smallstep Team administrator's name.E-mail- Smallstep Team administrator's e-mail address.password- This password is used to login into the Smallstep dashboard
Smallstep team admins can subscribe to and manage Smallstep products.
step 2 - Create an Authority
A Certificate Manager Authority is an online CA that authenticates and authorizes certificate requests. It can issue, renew, and revoke your x.509 TLS certificates. To create an Authority:
- Log into the smallstep dashboard, select the Certificate Manager tab, and click the "Add Authority" button.
- Choose "Create a new hosted Authority".
- Give your Authority a name and subdomain value (the URL path you wish to use for your online CA).
- Choose "Create" Behind the scenes, Certificate Manager creates a new root and an online intermediate CA, storing the private keys into Google's Cloud KMS.
On the Authority detail page, you will see the CA URL and Fingerprint used to interact with your CA.
Certificate Manager also creates a default provisioner called authority-admin,
connected to your smallstep login.
You can use this provisioner to administer the Authority and to get certificates.
See basic certificate operations for examples.
An authority super admin account is also created, using your e-mail address as the admin name/subject. The super admin can manage other authority admins.
Step 3 - Install step
stepTo interact with Certificate Manager, you will need our step CLI command on your local machine.
step acts as a front-end interface to Certificate Manager and is used for many common crypto and X.509 operations.
It's trivial to install the step binary on your local machine.
The instructions are here.
Step 4 - Configure your client
Certificate Manager authorities are administered using the step CLI command.
To connect your local client with the hosted Authority, you need to bootstrap into the PKI.
Run the following command, substituting the values from your Authority's properties:
$ step ca bootstrap --ca-url [YOUR CA URL] --fingerprint [YOUR AUTHORITY FINGERPRINT]
(You can always find this command on the Quick Actions section on your authority page.)
This command will download the CA Root certificate and configure your local step client to interact with the Authority.
If desired, you can also use the step CLI to install the CA Root certificate to your system's truststore.
Next Steps
- With your initial configuration complete, it's time to explore basic certificate operations.
- Need help getting started? Contact our Customer Success team.
Subscribe to updates
Unsubscribe anytime. See our privacy policy.
© 2023 Smallstep Labs, Inc. All rights reserved.