step ca policy provisioner x509 deny ip

Name

step ca policy provisioner x509 deny ip -- add or remove ip addresses

Usage

step ca policy provisioner x509 deny ip <ip address> [--remove]
[--provisioner=<name>] [--eab-key-id=<eab-key-id>] [--eab-key-reference=<eab-key-reference>]
[--admin-cert=<file>] [--admin-key=<file>] [--admin-subject=<subject>]
[--admin-provisioner=<name>] [--admin-password-file=<file>]
[--ca-url=<uri>] [--root=<file>] [--context=<name>]

Description

step ca policy provisioner x509 deny ip command manages IP addresses and ranges in policies

Options

--provisioner=name The provisioner name

--eab-key-id=value An ACME EAB Key ID.

--eab-key-reference=value An ACME EAB Key Reference.

--remove removes the provided IPs from the policy instead of adding them

--admin-cert=chain Admin certificate (chain) in PEM format to store in the 'x5c' header of a JWT.

--admin-key=file Private key file, used to sign a JWT, corresponding to the admin certificate that will be stored in the 'x5c' header.

--admin-subject=subject, --admin-name=subject The admin subject to use for generating admin credentials.

--admin-provisioner=name, --admin-issuer=name The provisioner name to use for generating admin credentials.

--admin-password-file=file, --password-file=file The path to the file containing the password to decrypt the one-time token generating key.

--ca-url=URI URI of the targeted Step Certificate Authority.

--root=file The path to the PEM file used as the root certificate authority.

--context=name The context name to apply for the given command.

Examples

Allow IP address 127.0.0.1 in X.509 certificates on authority level

Allow IP address range 10.0.0.0/24 in X.509 certificates on authority level

Deny IP address 10.0.0.30 in X.509 certificates on authority level

Remove IP address range 10.0.0.0/24 from being allowed in X.509 certificates on authority level

Allow IP address range 10.10.0.0/24 in X.509 certificates on provisioner level

Deny IP address 10.10.0.50 in X.509 certificates on provisioner level

Remove IP address 10.10.0.50 from being denied in X.509 certificates on provisioner level

Allow IP address range 10.20.0.0/24 in X.509 certificates on ACME account level by EAB key reference

Deny IP address 10.20.0.70 in X.509 certificates on ACME account level by EAB key reference

Remove IP address 10.20.0.70 from being denied in X.509 certificates on ACME account level by EAB key reference

Allow IP address range 192.168.0.0/24 in SSH host certificates on authority level

Deny IP address 192.168.0.40 in SSH host certificates on authority level