Menu
Products
Open Source
- Configure popular ACME clients to use a private CA
- Use Kubernetes cert-manager with
step-ca - Issue X.509 host certificates to cloud VMs
- Issue X.509 user certificates via your identity provider
- Create a CA that uses RSA keys
- Import an existing root or intermediate CA into
step-ca - Use Keycloak to issue SSH certificates with step-ca
- Run an SSH CA and connect to VMs using SSH certificates
- Use AWS to deploy a certificate authority and secure microservices
- Run
step-cain a Docker container - Federate multiple autonomous certificate authorities
Products
Open Source
- Configure popular ACME clients to use a private CA
- Use Kubernetes cert-manager with
step-ca - Issue X.509 host certificates to cloud VMs
- Issue X.509 user certificates via your identity provider
- Create a CA that uses RSA keys
- Import an existing root or intermediate CA into
step-ca - Use Keycloak to issue SSH certificates with step-ca
- Run an SSH CA and connect to VMs using SSH certificates
- Use AWS to deploy a certificate authority and secure microservices
- Run
step-cain a Docker container - Federate multiple autonomous certificate authorities
step certificate verify
Name
step certificate verify -- verify a certificate
Usage
step certificate verify <crt-file> [--host=<host>]
[--roots=<root-bundle>] [--servername=<servername>]
Description
step certificate verify executes the certificate path validation algorithm for x.509 certificates defined in RFC 5280. If the certificate is valid this command will return '0'. If validation fails, or if an error occurs, this command will produce a non-zero return value.
Positional arguments
crt-file
The path to a certificate to validate.
Options
--host=value
Check whether the certificate is for the specified host.
--roots=roots
Root certificate(s) that will be used to verify the
authenticity of the remote server.
roots is a case-sensitive string and may be one of:
file: Relative or full path to a file. All certificates in the file will be used for path validation.
list of files: Comma-separated list of relative or full file paths. Every PEM encoded certificate from each file will be used for path validation.
directory: Relative or full path to a directory. Every PEM encoded certificate from each file in the directory will be used for path validation.
--servername=value
TLS Server Name Indication that should be sent to request a specific certificate from the server.
Exit codes
This command returns 0 on success and >0 if any error occurs.
Examples
Verify a certificate using your operating system's default root certificate bundle:
$ step certificate verify ./certificate.crt
Verify a remote certificate using your operating system's default root certificate bundle:
$ step certificate verify https://smallstep.com
Verify a certificate using a custom root certificate for path validation:
$ step certificate verify ./certificate.crt --roots ./root-certificate.crt
Verify a certificate using a custom list of root certificates for path validation:
$ step certificate verify ./certificate.crt \
--roots "./root-certificate.crt,./root-certificate2.crt,/root-certificate3.crt"
Verify a certificate using a custom directory of root certificates for path validation:
$ step certificate verify ./certificate.crt --roots ./root-certificates/
Subscribe to updates
Unsubscribe anytime. See our privacy policy.
© 2023 Smallstep Labs, Inc. All rights reserved.