Step CLI: PKI Management Command-Line Tool

Understanding the Step CLI

Step CLI is Smallstep's open-source command-line client for X.509 certificates, SSH certificates, and JOSE/OAuth tokens, distributed as a single Go binary under the Apache-2.0 license. Commands are grouped by domain — certificate, ca, crypto, oauth, and ssh — so a local key pair, an online step-ca server, or an ACME CA like Let's Encrypt all go through the same tool. It issues, inspects, and verifies; it isn't a general security scanner.

Key Capabilities and Command Groups

• ✓step certificate: create, revoke, validate, lint, and bundle X.509 certificates; generate RSA, ECDSA, or EdDSA key pairs and CSRs; install or remove certificates from the system and browser trust stores; create RFC5280 and CA/Browser Forum-compliant certs for TLS/HTTPS.
• ✓step ca: an X.509 and/or SSH CA can be initialized in one command; authenticate and obtain certificates through any enrollment mechanism step-ca supports; renew and revoke certificates it issued; work with any ACMEv2 (RFC8555) CA, including the http-01 challenge type.
• ✓step crypto: sign, verify, and inspect JWTs (RFC7519), JWS, and JWE; create and manage JWKs and key sets; generate and verify TOTP tokens for MFA; apply KDFs (scrypt, bcrypt, argon2) and verify passwords; generate and check file hashes.
• ✓Through 'step oauth', an OAuth 2.0 single sign-on flow can be added to any CLI application. It supports authorization code, out-of-band, and JWT bearer flows, in addition to refresh token flows. It also obtains OAuth access tokens, along with OIDC identity tokens, from any provider.
• ✓The `step ssh` utility is for generating and overseeing SSH certificates, connecting to a `step-ca` instance whether it is online or offline; It also produces key pairs for SSH users and hosts, along with short-lived certificates; Operations include placing and taking out certificates within the SSH agent; Finally, it facilitates single sign-on for SSH login.
• ✓Plugin system: an executable named step-<name>-plugin placed in $PATH or $STEPPATH/plugins ($HOME/.step/plugins by default) runs automatically when you call step <name>; step-kms-plugin, which handles keys and certificates in HSMs, TPMs, YubiKeys, the macOS Keychain, and cloud KMS providers, ships integrated directly into step.

Installing the Step CLI

The README doesn't inline install commands — it points to Smallstep's dedicated installation docs at smallstep.com/docs/step-cli/installation for the actual steps, so exact package-manager commands aren't part of the facts available here. What is confirmed: Step CLI ships as a single Go binary, so there's no separate runtime to manage once it's on your machine. If you're scripting a setup, check that documentation page rather than guessing at a package name.

Example: OAuth and JWT Verification

The README's own worked example combines two command groups: step oauth to get a Google OAuth OIDC identity token, then step crypto's JWT verify command to check that token's signature. That pairing is the point of step oauth existing at all — it hands off a token that another step command, or your own code, can immediately validate. The README text available here doesn't include the actual command flags for that example, so treat this as the shape of the workflow rather than a copy-pasteable snippet, and check Smallstep's linked documentation for exact syntax.

Practical Applications for Security Workflows

• •Standing up an internal CA with step ca and issuing short-lived TLS certificates to internal services instead of relying on long-lived certs from a public CA.
• •Getting a browser-trusted HTTPS setup on a local dev server by creating a CA and installing its root certificate into the system trust store with step certificate.
• •Adding single sign-on to a custom CLI tool through step oauth's OAuth 2.0 flows, then checking the resulting OIDC token with step crypto.
• •Issuing short-lived SSH certificates instead of static SSH keys for hosts and users behind a step-ca instance, via step ssh.
• •Generating and checking TOTP codes for MFA testing or enrollment with step crypto, without a phone-based authenticator app.
• •Running ACME issuance against a Let's Encrypt-compatible CA through step ca, since the CLI supports RFC8555 ACMEv2 including the http-01 challenge.

Other PKI and Cryptography Tools

Frequently Asked Questions

The problem it solves

Teams doing PKI work usually end up gluing together separate tools: openssl for X.509 operations, a language-specific library for JWT signing, an ACME client for Let's Encrypt certificates, and ssh-keygen for SSH certs, each with its own flags and failure modes. Step CLI's README frames the tool around collapsing that spread into one command surface, grouped by domain (certificate, ca, crypto, oauth, ssh) but sharing a single binary, one config directory, and one plugin mechanism for KMS-backed keys.

Who should try it — and who should skip

Try Step CLI if you're already running, or planning to run, step-ca and want one client for issuing and renewing certificates, or if you just want a single CLI for ad hoc X.509, SSH, JWT, OAuth, and TOTP work instead of juggling openssl, ssh-keygen, and a JWT library separately. Skip it if you only need one ACME certificate for one server — a dedicated ACME client is less to learn — or if there's no CA or step-ca in your setup at all, since several of Step CLI's most useful commands assume one is running behind them.

Related repositories