onding public key valid for verifying and signing messages. This command uses an implementation of NaCl's crypto_sign_keypair function. For examples, see **step help crypto nacl sign**.**step ssh inspect** command prints ssh certificate details in human readable format. ## POSITIONAL ARGUMENTS : The path to an ssh certificate. ## EXAMPLES Prints the contents of id_ecdsa-cert.pub: ''' $ step ssh inspect id_ecdsa-cert.pub ''' UNION ALL -- this query will only match type names which include the schema prefix SELECT pg_class.oid, pg_class.reltype FROM pg_class INNER JOIN pg_namespace ON (pg_class.relnamespace = pg_namespace.oid) WHERE nspname || '.' || relname **step certificate verify** [**--host**=] [**--roots**=] [**--servername**=] [**--issuing-ca**=] [**--verbose**] [**--verify-ocsp**]] [**--ocsp-endpoint**]=url [**--verify-crl**] [**--crl-endpoint**]=urlThe step queries to retrieve initial team configuration. Only used with the **--team** option. If the url contains <\<\>> placeholders, they are replaced with the team ID. Replacing the authority-id section of the url is not supported with placeholders.Specify a to use as a 'web root' for validation in the ACME protocol. Webroot is a mode in which the step process will write a challenge file to a location being served by an existing fileserver in order to respond to ACME challenge validation requests.The JWK Set containing the recipient's private key. The argument should be the name of a file. The file contents should be a JWK Set or a JWE with a JWK Set payload. The **--jwks** flag requires the use of the **--kid** flag to specify which key to use.**step crypto jwe decrypt** verifies a JWE read from STDIN and decrypts the ciphertext printing it to STDOUT. If verification fails a non-zero failure code is returned. If verification succeeds the command returns 0. For examples, see **step help crypto jwe**.**step crypto jwk keyset add** reads a JWK from STDIN and adds it to the JWK Set in . Modifications to are in-place. The file is 'flock'd while it's being read and modified. ## POSITIONAL ARGUMENTS : File containing a JWK SetThe JWK Set containing the key to use to sign the JWS. The argument should be the name of a file. The file contents should be a JWK Set or a JWE with a JWK Set payload. The **--jwks** flag requires the use of the **--kid** flag to specify which key to use.The JWK Set containing the key to use to sign the JWT. The argument should be the name of a file. The file contents should be a JWK Set or a JWE with a JWK Set payload. The **--jwks** flag requires the use of the **--kid** flag to specify which key to use.**step crypto jws inspect** reads a JWS data structure from STDIN, decodes it, and outputs the payload on STDERR. Since this command does not verify the JWS you must pass **--insecure** as a misuse prevention mechanism. For examples, see **step help crypto jws**.Estimated total CPU time spent running user Go code. This may also include some small amount of time spent in the Go runtime. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.**step ca policy acme** command group provides facilities for managing certificate issuance policies for ACME accounts. Please note that certificate issuance policies for ACME accounts are currently only supported in Certificate Manager: https://u.step.sm/cm. { "subject": {{ toJson .Subject }}, "sans": {{ toJson .SANs }}, {{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }} "keyUsage": ["keyEncipherment", "digitalSignature"], {{- else }} "keyUsage": ["digitalSignature"], {{- end }} "extKeyUsage": ["clientAuth"] }The maximum to grant a certificate in AWS and GCP provisioners. A is sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".Estimated total CPU time goroutines spent performing GC tasks to assist the GC and prevent it from falling behind the application. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.**step ca acme eab remove** [**--admin-cert**=] [**--admin-key**=] [**--admin-subject**=] [**--admin-provisioner**=] [**--admin-password-file**=] [**--ca-url**=] [**--root**=] [**--context**=]The identity of the principal running this command. The specified must match one of the values in the **"aud"** claim, indicating the intended recipient(s) of the JWT. is a case-sensitive string. Required unless disabled with the **--subtle** flag.Run the rekey command as a daemon, rekeying and overwriting the certificate periodically. By default the daemon will rekey a certificate before 2/3 of the time to expiration has elapsed. The period can be configured using the **--rekey-period** or **--expires-in** flags.Run the renew command as a daemon, renewing and overwriting the certificate periodically. By default the daemon will renew a certificate before 2/3 of the time to expiration has elapsed. The period can be configured using the **--renew-period** or **--expires-in** flags.**%s** [**--remove**] [**--provisioner**=] [**--admin-cert**=] [**--admin-key**=] [**--admin-subject**=] [**--admin-provisioner**=] [**--admin-password-file**=] [**--ca-url**=] [**--root**=] [**--context**=]The minimum for an x509 certificate generated by this provisioner. Value must be a sequence of decimal numbers, each with optional fraction, and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".The maximum for an x509 certificate generated by this provisioner. Value must be a sequence of decimal numbers, each with optional fraction, and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".The default for an x509 certificate generated by this provisioner. Value must be a sequence of decimal numbers, each with optional fraction, and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".Estimated total CPU time spent returning unused memory to the underlying platform in response eagerly in response to memory pressure. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.**step ca admin add** [**--super**] [**--admin-cert**=] [**--admin-key**=] [**--admin-subject**=] [**--admin-provisioner**=] [**--admin-password-file**=] [**--ca-url**=] [**--root**=] [**--context**=]The containing the key with which to sign the JWS. JWSs can be signed using a private JWK (or a JWK encrypted as a JWE payload) or a PEM encoded private key (or a private key encrypted using the modes described on RFC 1423 or with PBES2+PBKDF2 described in RFC 2898).The containing the key with which to sign the JWT. JWTs can be signed using a private JWK (or a JWK encrypted as a JWE payload) or a PEM encoded private key (or a private key encrypted using the modes described on RFC 1423 or with PBES2+PBKDF2 described in RFC 2898).**step crypto nacl auth verify** checks that the digest is a valid authenticator of the message is read from STDIN under the given secret key file. This command uses an implementation of NaCl's crypto_auth_verify function. For examples, see **step help crypto nacl auth**.**step crypto jwt inspect** reads a JWT data structure from STDIN, decodes it, and outputs the header and payload on STDERR. Since this command does not verify the JWT you must pass **--insecure** as a misuse prevention mechanism. For examples, see **step help crypto jwt**.**step ca acme eab add** [] [**--admin-cert**=] [**--admin-key**=] [**--admin-subject**=] [**--admin-provisioner**=] [**--admin-password-file**=] [**--ca-url**=] [**--root**=] [**--context**=]**%s** [**--remove**] [**--provisioner**=] [**--admin-cert**=] [**--admin-key**=] [**--admin-subject**=] [**--admin-provisioner**=] [**--admin-password-file**=] [**--ca-url**=] [**--root**=] [**--context**=]**step ca admin remove** [**--provisioner**=] [**--admin-cert**=] [**--admin-key**=] [**--admin-subject**=] [**--admin-provisioner**=] [**--admin-password-file**=] [**--ca-url**=] [**--root**=] [**--context**=]The minimum for an ssh user certificate generated by this provisioner. Value must be a sequence of decimal numbers, each with optional fraction, and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".The maximum for an ssh user certificate generated by this provisioner. Value must be a sequence of decimal numbers, each with optional fraction, and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".The minimum for an ssh host certificate generated by this provisioner. Value must be a sequence of decimal numbers, each with optional fraction, and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".The maximum for an ssh host certificate generated by this provisioner. Value must be a sequence of decimal numbers, each with optional fraction, and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".The ID of the recipient's private key. is a case-sensitive string. When used with **--key** the value must match the **"kid"** member of the JWK. When used with **--jwks** (a JWK Set) the KID value must match the **"kid"** member of one of the JWKs in the JWK Set.**%s** [**--remove**] [**--provisioner**=] [**--admin-cert**=] [**--admin-key**=] [**--admin-subject**=] [**--admin-provisioner**=] [**--admin-password-file**=] [**--ca-url**=] [**--root**=] [**--context**=]**step context current** returns the name of the current context. ## EXAMPLES List all certificate authority contexts: ''' $ step context current test-ca ''' ''' $ step context current --json {"name":"test-ca","authority":"internal.ca.smallstep.com","profile":"test-ca"} '''**step ca provisioner remove** [**--admin-cert**=] [**--admin-key**=] [**--admin-subject**=] [**--admin-provisioner**=] [**--admin-password-file**=] [**--ca-url**=] [**--root**=] [**--context**=] [**--ca-config**=]The ID of the recipient's public key. is a case-sensitive string. When used with **--key** the value must match the **"kid"** member of the JWK. When used with **--jwks** (a JWK Set) the value must match the **"kid"** member of one of the JWKs in the JWK Set.**step ca policy provisioner** command group provides facilities for managing certificate issuance policies for provisioners. Please note that certificate issuance policies on the provisioner level are currently only supported in Certificate Manager: https://u.step.sm/cm. Get a certificate using the ACME protocol and standalone mode for validation. Standalone is a mode in which the step process will run a server that will will respond to ACME challenge validation requests. Standalone is the default mode for serving challenge validation requests.

**step ca admin list** [**--super**] [**--provisioner**=] [**--admin-cert**=] [**--admin-key**=] [**--admin-subject**=] [**--admin-provisioner**=] [**--admin-password-file**=] [**--ca-url**=] [**--root**=] [**--context**=]{ "subject": {{ toJson .Subject }}, "sans": {{ toJson .SANs }}, {{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }} "keyUsage": ["keyEncipherment", "digitalSignature"], {{- else }} "keyUsage": ["digitalSignature"], {{- end }} "extKeyUsage": ["serverAuth", "clientAuth"] }{ "type": {{ toJson .Insecure.CR.Type }}, "keyId": {{ toJson .Insecure.CR.KeyID }}, "principals": {{ toJson .Insecure.CR.Principals }} {{- if eq .Insecure.CR.Type "user" }} , "extensions": {{ toJson .Extensions }}, "criticalOptions": {{ toJson .CriticalOptions }} {{- end }} }**step crypto winpe** command group provides facilities to extract certificates and verify Windows Portable Executable files. ## EXAMPLES Extract all certificates and output in JSON format: ''' step crypto winpe extract my.exe | step certificate inspect --format json --bundle '''The registration authority credentials to use. : If CloudCAS is used, this flag should be the path to a service account key. It can also be set using the 'GOOGLE_APPLICATION_CREDENTIALS=path' environment variable or the default service account in an instance in Google Cloud.The output format for printing the introspection details. : is a string and must be one of: **text** : Print output in unstructured text suitable for a human to read. **json** : Print output in JSON format. **pem** : Print output in PEM format.**step crypto jwk keyset remove** removes the JWK with a key ID matching from the JWK Set stored in . Modifications to are in-place. The file is 'flock'd while it's being read and modified. ## POSITIONAL ARGUMENTS : File containing a JWK SetEstimated total CPU time spent performing tasks that return unused memory to the underlying platform. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics. Sum of all metrics in /cpu/classes/scavenge.Count of small allocations that are packed together into blocks. These allocations are counted separately from other allocations because each individual allocation is not tracked by the runtime, only their block. Each block is already accounted for in allocs-by-size and frees-by-size.The containing the key to use to verify the JWT. The contents of the file can be a public or private JWK (or a JWK encrypted as a JWE payload) or a public or private PEM (or a private key encrypted using the modes described on RFC 1423 or with PBES2+PBKDF2 described in RFC 2898).Approximate cumulative time goroutines have spent blocked on a sync.Mutex, sync.RWMutex, or runtime-internal lock. This metric is useful for identifying global changes in lock contention. Collect a mutex or block profile using the runtime/pprof package for more detailed contention data. Authentication Failed

Authentication failed. You can return to the application. Feel free to close this browser tab.

Error details: error %s error_description: %s

**step ca admin update** [**--super**] [**--provisioner**=] [**--admin-cert**=] [**--admin-key**=] [**--admin-subject**=] [**--admin-provisioner**=] [**--admin-password-file**=] [**--ca-url**=] [**--root**=] [**--context**=]The ID of the key used to sign the JWS. The argument is a case-sensitive string. When used with '--jwk' the value must match the **"kid"** member of the JWK. When used with **--jwks** (a JWK Set) the value must match the **"kid"** member of one of the JWKs in the JWK Set.The ID of the key used to sign the JWT. The argument is a case-sensitive string. When used with '--jwk' the value must match the **"kid"** member of the JWK. When used with **--jwks** (a JWK Set) the value must match the **"kid"** member of one of the JWKs in the JWK Set.The containing the key with which to verify the JWS. The contents of the file can be a public or private JWK (or a JWK encrypted as a JWE payload) or a public or private PEM (or a private key encrypted using the modes described on RFC 1423 or with PBES2+PBKDF2 described in RFC 2898).The subject of this JWT. The "claims" are normally interpreted as statements about this subject. The subject must either be locally unique in the context of the issuer or globally unique. The processing of this claim is generally application specific. : is a case-sensitive string.**step crypto hash compare** verifies that the expected hash value matches the computed hash value for a file or directory. For examples, see **step help crypto hash**. ## POSITIONAL ARGUMENTS : The expected hash digest : The path to a file or directory to hash.**step crypto jws sign** generates a signed JSON Web Signature (JWS) by computing a digital signature or message authentication code for an arbitrary payload. By default, the payload to sign is read from STDIN and the JWS will be written to STDOUT. For examples, see **step help crypto jws**.**step ca bootstrap** [**--ca-url**=] [**--fingerprint**=] [**--install**] [**--team**=] [**--authority**=] [**--team-url**=] [**--redirect-url**=] [**--context**=] [**--profile**=] [**--authority**=] [**--team-authority**=]The to build the certificate upon. If unset, default is EC. : is a case-sensitive string and must be one of: **EC** : Create an **elliptic curve** keypair **OKP** : Create an octet key pair (for **"Ed25519"** curve) **RSA** : Create an **RSA** keypairPrint all certificates in the order in which they appear in the bundle. If the output format is 'json' then output a list of certificates, even if the bundle only contains one certificate. This flag will result in an error if the input bundle includes any PEM that does not have type CERTIFICATE.Estimated total available CPU time not spent executing any Go or Go runtime code. In other words, the part of /cpu/classes/total:cpu-seconds that was unused. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.**step ca provisioner webhook remove** removes a webhook from a provisioner. ## POSITIONAL ARGUMENTS : The name of the provisioner. : The name of the webhook. ## EXAMPLES Remove a webhook: ''' step ca provisioner webhook remove my_provisioner my_webhook '''{ "rawSubject": {{ toJson .Insecure.CR.RawSubject }}, "sans": {{ toJson .SANs }}, {{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }} "keyUsage": ["keyEncipherment", "digitalSignature"], {{- else }} "keyUsage": ["digitalSignature"], {{- end }} "extKeyUsage": ["serverAuth", "clientAuth"] }**step ca acme eab list** [] [**--limit**=] [**--admin-cert**=] [**--admin-key**=] [**--admin-subject**=] [**--admin-provisioner**=] [**--admin-password-file**=] [**--ca-url**=] [**--root**=] [**--context**=]Memory allocated from the heap that is reserved for stack space, whether or not it is currently in-use. Currently, this represents all stack memory for goroutines. It also includes all OS thread stacks in non-cgo programs. Note that stacks may be allocated differently in the future, and this may change.**step ca provisioner remove** removes a provisioner from the CA configuration. ## EXAMPLES Remove provisioner by name: ''' $ step ca provisioner remove acme ''' Remove provisioner from a ca.json that is not in the default location: ''' $ step ca provisioner remove acme --ca-config /path/to/ca.json '''The (key ID) for this JWK. Corresponds to the "kid" JWK parameter. Used to identify an individual key in a JWK Set, for example. is a case-sensitive string. If unset, the JWK Thumbprint [RFC7638] is used as . See **step help crypto jwk thumbprint** for more information on JWK Thumbprints.The period with which to schedule rekeying of the certificate in daemon mode. Requires the **--daemon** flag. The is a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "1.5h", or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".The period with which to schedule renewals of the certificate in daemon mode. Requires the **--daemon** flag. The is a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "1.5h", or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".The alternative OAuth to use for input constrained devices. : is a case-insensitive string and must be one of: **device** : Use the Device Authorization Grant (https://datatracker.ietf.org/doc/html/rfc8628#section-3.2) flow **oob** : Use the Out of Band (OOB) flow /debug/pprof/ /debug/pprof/

Set debug=1 as a query parameter to export in legacy text format


Types of profiles available: **step ssh revoke** command revokes an SSH Certificate using [step certificates](https://github.com/smallstep/certificates). ## POSITIONAL ARGUMENTS : The serial number of the SSH certificate to revoke. ## EXAMPLES revoke an ssh certificate: ''' $ step ssh revoke 3997477584487736496 '''Distribution of individual non-GC-related stop-the-world pause latencies. This is the time from deciding to stop the world until the world is started again. Some of this time is spent getting all threads to stop (measured directly in /sched/pauses/stopping/other:seconds). Bucket counts increase monotonically.**step ca provisioner webhook remove** [**--admin-cert**=] [**--admin-key**=] [**--admin-subject**=] [**--admin-provisioner**=] [**--admin-password-file**=] [**--ca-url**=] [**--root**=] [**--context**=] [**--ca-config**=]**step certificate sign** [**--profile**=] [**--template**=] [**--set**=] [**--set-file**=] [**--omit-cn-san**] [**--password-file**=] [**--path-len**=] [**--not-before**=] [**--not-after**=] [**--bundle**]The output format for printing the introspection details. : is a string and must be one of: **text** : Print output in unstructured text suitable for a human to read. This is the default format. **json** : Print output in JSON format. **pem** : Print output in PEM format.Do not add CSR Common Name as SAN extension in resulting certificate. By default, the CSR Common Name will be added as a SAN extension only if the CSR does not contain any SANs. Note that if the Common Name is already captured as a SAN extension in the CSR then it will still appear as a SAN extension in the certificate.**step crypto jws sign** [- | ] [**--alg**=] [**--jku**=] [**--jwk**] [**--typ**=] [**--cty**=] [**--key**=] [**--jwks**=] [**--kid**=] [**--password-file**=] [**--x5c-cert**=] [**--x5c-key**=] [**--x5t-cert**=] [**--x5t-key**=]**%s** [**--provisioner**=] [**--eab-key-id**=] [**--eab-key-reference**=] [**--admin-cert**=] [**--admin-key**=] [**--admin-subject**=] [**--admin-provisioner**=] [**--admin-password-file**=] [**--ca-url**=] [**--root**=] [**--context**=]**%s** [**--provisioner**=] [**--eab-key-id**=] [**--eab-key-reference**=] [**--admin-cert**=] [**--admin-key**=] [**--admin-subject**=] [**--admin-provisioner**=] [**--admin-password-file**=] [**--ca-url**=] [**--root**=] [**--context**=]The when the certificate validity period ends. If a
CountProfile
{{range .Method}} {{end}}
MethodCalls
{{.Name}}({{.Type.ArgType}}, {{.Type.ReplyType}}) error {{.Type.NumCalls}}
{{end}} Check if the certificate expires within the given time window using . If using , the input must be followed by a "%" character. If using , the input must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".{ "type": {{ toJson .Insecure.CR.Type }}, "keyId": {{ toJson .Insecure.CR.KeyID }}, "principals": {{ toJson .Insecure.CR.Principals }} {{- if eq .Insecure.CR.Type "user" }} , "extensions": { "permit-X11-forwarding": "", "permit-agent-forwarding": "", "permit-port-forwarding": "", "permit-pty": "", "permit-user-rc": "" } {{- end }} }Estimated total available CPU time for user Go code or the Go runtime, as defined by GOMAXPROCS. In other words, GOMAXPROCS integrated over the wall-clock duration this process has been executing for. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics. Sum of all metrics in /cpu/classes. The **step** utility is not instrumented for usage statistics. It does not phone home. But your feedback is extremely valuable. Any information you can provide regarding how you’re using **step** helps. Please send us a sentence or two, good or bad: **feedback@smallstep.com** or ask in [GitHub Discussions](https://github.com/smallstep/certificates/discussions). {{end}} Add the specified principal (username) to the certificate request. This flag can be used multiple times. However, it cannot be used in conjunction with '--token' when requesting certificates from OIDC, JWK, and X5C provisioners, or from any provisioner with 'disableCustomSANs' set to 'true'. These provisioners will use the contents of the token to determine the principals.The when the certificate validity period ends. If a