step ca policy authority x509 allow email

Name

step ca policy authority x509 allow email -- add or remove email addresses

Usage

step ca policy authority x509 allow email <email> [--remove] [--provisioner=<name>]
[--admin-cert=<file>] [--admin-key=<file>] [--admin-subject=<subject>]
[--admin-provisioner=<name>] [--admin-password-file=<file>]
[--ca-url=<uri>] [--root=<file>] [--context=<name>]

Description

step ca policy authority x509 allow email command manages email addresses and domains in policies

Options

--provisioner=name The provisioner name

--remove removes the provided emails from the policy instead of adding them

--admin-cert=chain Admin certificate (chain) in PEM format to store in the 'x5c' header of a JWT.

--admin-key=file Private key file, used to sign a JWT, corresponding to the admin certificate that will be stored in the 'x5c' header.

--admin-subject=subject, --admin-name=subject The admin subject to use for generating admin credentials.

--admin-provisioner=name, --admin-issuer=name The provisioner name to use for generating admin credentials.

--admin-password-file=file, --password-file=file The path to the file containing the password to decrypt the one-time token generating key.

--ca-url=URI URI of the targeted Step Certificate Authority.

--root=file The path to the PEM file used as the root certificate authority.

--context=name The context name to apply for the given command.

Examples

Allow all email addresses for the example.com domain in X.509 certificates on authority level

Remove the email addresses for the example.com domain in X.509 certificates on authority level

Deny badmail@example.com in X.509 certificates on authority level

Allow all email addresses for the example.com domain in X.509 certificates on provisioner level

Allow all local parts for the example.com domain in SSH user certificates on provisioner level

Deny root@example.com domain in SSH user certificates on provisioner level