step ca provisioner

Name

step ca provisioner -- create and manage the certificate authority provisioners

Usage

step ca provisioner <subcommand> [arguments] [global-flags] [subcommand-flags]

Description

step ca provisioner command group provides facilities for managing the certificate authority provisioners.

A provisioner is an entity that controls provisioning credentials, which are used to generate provisioning tokens.

Provisioning credentials are simple JWK key pairs using public-key cryptography. The public key is used to verify a provisioning token while the private key is used to sign the provisioning token.

Provisioning tokens are JWT tokens signed by the JWK private key. These JWT tokens are used to get a valid TLS certificate from the certificate authority. Each provisioner is able to manage a different set of rules that can be used to configure the bounds of the certificate.

In the certificate authority, a provisioner is configured with a JSON object with the following properties:

Examples

List the active provisioners:

Retrieve the encrypted private jwk for the given kid:

Add a single provisioner:

Remove the provisioner matching a given issuer and kid:

Commands