ny promises regarding "truncated unforgeability." NaCl crypto_auth is currently an implementation of HMAC-SHA-512-256, i.e., the first 256 bits of HMAC-SHA-512. HMAC-SHA-512-256 is conjectured to meet the standard notion of unforgeability. These commands are interoperable with NaCl: https://nacl.cr.yp.to/auth.html ## EXAMPLES Authenticate a message using a 256-bit key, a new nacl box private key can be used as the secret: ''' $ step crypto nacl auth digest auth.key Please enter text to authenticate: ******** 33c54aeb54077808fcfccadcd2f01971b120e314dffa61516b0738b74fdc8ff1 $ cat message.txt | step crypto nacl auth digest auth.key 33c54aeb54077808fcfccadcd2f01971b120e314dffa61516b0738b74fdc8ff1 ''' Verify the message with the hash: ''' $ step crypto nacl auth verify auth.key 33c54aeb54077808fcfccadcd2f01971b120e314dffa61516b0738b74fdc8ff1 Please enter text to verify: ******** ok $ cat message.txt | step crypto nacl auth verify auth.key 33c54aeb54077808fcfccadcd2f01971b120e314dffa61516b0738b74fdc8ff1 ok '''The specifies the reason for revocation - chose from a list of common revocation reasons. If unset, the default is Unspecified. : can be a number from 0-9 or a case insensitive string matching one of the following options: **Unspecified** : No reason given (Default -- reasonCode=0). **KeyCompromise** : The key is believed to have been compromised (reasonCode=1). **CACompromise** : The issuing Certificate Authority itself has been compromised (reasonCode=2). **AffiliationChanged** : The certificate contained affiliation information, for example, it may have been an EV certificate and the associated business is no longer owned by the same entity (reasonCode=3). **Superseded** : The certificate is being replaced (reasonCode=4). **CessationOfOperation** : If a CA is decommissioned, no longer to be used, the CA's certificate should be revoked with this reason code. Do not revoke the CA's certificate if the CA no longer issues new certificates, yet still publishes CRLs for the currently issued certificates (reasonCode=5). **CertificateHold** : A temporary revocation that indicates that a CA will not vouch for a certificate at a specific point in time. Once a certificate is revoked with a CertificateHold reason code, the certificate can then be revoked with another Reason Code, or unrevoked and returned to use (reasonCode=6). **RemoveFromCRL** : If a certificate is revoked with the CertificateHold reason code, it is possible to "unrevoke" a certificate. The unrevoking process still lists the certificate in the CRL, but with the reason code set to RemoveFromCRL. Note: This is specific to the CertificateHold reason and is only used in DeltaCRLs (reasonCode=8). **PrivilegeWithdrawn** : The right to represent the given entity was revoked for some reason (reasonCode=9). **AACompromise** : It is known or suspected that aspects of the AA validated in the attribute certificate have been compromised (reasonCode=10). events

/debug/events

{{if $n}}{{end}} [{{$n}} {{$bucket.String}}] {{if $n}}{{end}}

Family: {{$.Family}}

{{if $.Expanded}}{{end}} [Summary]{{if $.Expanded}}{{end}} {{if not $.Expanded}}{{end}} [Expanded]{{if not $.Expanded}}{{end}} {{range $el := $.EventLogs}} {{if $.Expanded}} {{range $el.Events}} {{end}} {{end}} {{end}}

When	Elapsed
{{$el.When}}	{{$el.ElapsedTime}}	{{$el.Title}}
		{{$el.Stack\|trimSpace}}
{{.WhenString}}	{{elapsed .Elapsed}}	.{{if .IsErr}}E{{else}}.{{end}}. {{.What}}

{{end}} **%s** command manages IP addresses and ranges in policies ## EXAMPLES Allow IP address 127.0.0.1 in X.509 certificates on authority level ''' $ step ca policy authority x509 allow ip 127.0.0.1 ''' Allow IP address range 10.0.0.0/24 in X.509 certificates on authority level ''' $ step ca policy authority x509 allow ip 10.0.0.0/24 ''' Deny IP address 10.0.0.30 in X.509 certificates on authority level ''' $ step ca policy authority x509 deny ip 10.0.0.30 ''' Remove IP address range 10.0.0.0/24 from being allowed in X.509 certificates on authority level ''' $ step ca policy authority x509 allow ip 10.0.0.0/24 --remove ''' Allow IP address range 10.10.0.0/24 in X.509 certificates on provisioner level ''' $ step ca policy provisioner x509 allow ip 10.10.0.0/24 --provisioner my_provisioner ''' Deny IP address 10.10.0.50 in X.509 certificates on provisioner level ''' $ step ca policy provisioner x509 deny ip 10.10.0.50 --provisioner my_provisioner ''' Remove IP address 10.10.0.50 from being denied in X.509 certificates on provisioner level ''' $ step ca policy provisioner x509 deny ip 10.10.0.50 --provisioner my_provisioner --remove ''' Allow IP address range 10.20.0.0/24 in X.509 certificates on ACME account level by EAB key reference ''' $ step ca policy provisioner x509 allow ip 10.10.0.0/24 --provisioner my_acme_provisioner --eab-key-reference my_ref ''' Deny IP address 10.20.0.70 in X.509 certificates on ACME account level by EAB key reference ''' $ step ca policy provisioner x509 deny ip 10.20.0.70 --provisioner my_acme_provisioner --eab-key-reference my_ref ''' Remove IP address 10.20.0.70 from being denied in X.509 certificates on ACME account level by EAB key reference ''' $ step ca policy provisioner x509 deny ip 10.20.0.70 --provisioner my_acme_provisioner --eab-key-reference my_ref --remove ''' Allow IP address range 192.168.0.0/24 in SSH host certificates on authority level ''' $ step ca policy authority ssh host allow ip 192.168.0.0/24 ''' Deny IP address 192.168.0.40 in SSH host certificates on authority level ''' $ step ca policy authority ssh host deny ip 192.168.0.40 '''**step crypto key format** prints or writes the key in a different format. By default PEM formatted keys will be converted to DER with the following rules: * ECDSA, RSA, AND Ed25519 public keys will use the DER-encoded PKIX format. * ECDSA, AND RSA private keys will use the ASN.1, DER format. * Ed25519 private keys will use the DER-encoded PKCS8 encoded form. And DER encoded keys will be converted to PEM with the following rules: * ECDSA, RSA, AND Ed25519 public keys will use the PEM-encoded PKIX format. * ECDSA private keys will use the PEM-encoded format defined in RFC 5915 and SEC1. * RSA private keys will use the PEM-encoded PKCS#1 format. * Ed25519 private keys will use the PEM-encoded PKCS#8 format. The flags **--pkcs8**, **--pem**, **--der**, **--ssh**, and **--jwk** can be use to change the previous defaults. For example we can use **--pkcs8** to save a PKCS#1 RSA key to the PKCS#8 form. Or we can combine **--pem** and **--pkcs8** to convert to PKCS#8 a PEM file. ## POSITIONAL ARGUMENTS : Path to a file with a public or private key, or the public key of an X.509 certificate. ## EXIT CODES This command returns 0 on success and \>0 if any error occurs. ## EXAMPLES Convert a PEM file to DER: ''' $ step crypto key format key.pem ''' Convert DER file to PEM: ''' $ step crypto key format key.der ''' Convert a PEM file to OpenSSH: ''' $ step crypto key format --ssh key.pem ''' Convert a PEM file to JWK: ''' $ step crypto key format --jwk key.pem ''' Convert PEM file to DER and write to disk: ''' $ step crypto key format key.pem --out key.der ''' Convert a PKCS#1 RSA private key to PKCS#8 using the PEM format: ''' $ step crypto key format --pem --pkcs8 rsa.pem --out rsa-pkcs8.pem ''' Convert PKCS#8 RSA private key to the PKCS#1 format: ''' $ step crypto key format --pem rsa-pkcs8.pem --out rsa.pem ''' Convert an ASN.1 DER format to the PEM-encoded PKCS#8 format: ''' $ step crypto key format --pkcs8 key.der --out key-pkcs8.der ''' Convert an ASN.1 DER format to the DER-encoded PKCS#8 format: ''' $ step crypto key format --der --pkcs8 key.der --out key-pkcs8.der '''**step ca provisioner** command group provides facilities for managing the certificate authority provisioners. A provisioner is an entity that controls provisioning credentials, which are used to generate provisioning tokens. Provisioning credentials are simple JWK key pairs using public-key cryptography. The public key is used to verify a provisioning token while the private key is used to sign the provisioning token. Provisioning tokens are JWT tokens signed by the JWK private key. These JWT tokens are used to get a valid TLS certificate from the certificate authority. Each provisioner is able to manage a different set of rules that can be used to configure the bounds of the certificate. In the certificate authority, a provisioner is configured with a JSON object with the following properties: * **name**: the provisioner name, it will become the JWT issuer and a good practice is to use an email address for this. * **type**: the provisioner type, currently only "jwk" is supported. * **key**: the JWK public key used to verify the provisioning tokens. * **encryptedKey** (optional): the JWE compact serialization of the private key used to sign the provisioning tokens. * **claims** (optional): an object with custom options for each provisioner. Options supported are: * **minTLSCertDuration**: minimum duration of a certificate, set to 5m by default. * **maxTLSCertDuration**: maximum duration of a certificate, set to 24h by default. * **defaultTLSCertDuration**: default duration of the certificate, set to 24h by default. * **disableRenewal**: whether or not to disable certificate renewal, set to false by default. ## EXAMPLES List the active provisioners: ''' $ step ca provisioner list ''' Retrieve the encrypted private jwk for the given kid: ''' $ step ca provisioner jwe-key 1234 --ca-url https://127.0.0.1 --root ./root.crt ''' Add a single provisioner: ''' $ step ca provisioner add max@smallstep.com max-laptop.jwk --ca-config ca.json ''' Remove the provisioner matching a given issuer and kid: ''' $ step ca provisioner remove max@smallstep.com --kid 1234 --ca-config ca.json '''**step rand** generates random strings that can be used for multiple purposes. The command supports printing stings with different formats. It defaults to use the printable characters of the ASCII table; also supports generating a memorable password using words from a provided dictionary. The length of the random string will default to 32 characters or 6 words separated by a dash (-) if a dictionary is used. The list of supported formats is the following: * ascii: generates a random string using the 94 printable characters of the ASCII table. * alphanumeric: uses the 62 alphanumeric characters in the POSIX/C locale (a-z+A-Z+0-9). * alphabet: uses the 52 alphabetic characters in the POSIX/C locale (a-z+A-Z). * hex: uses the 16 hexadecimal characters in lowercase (0-9+a-f). * dec: uses the 10 decimal characters (0-9). * lower: uses the 26 lowercase alphabetic characters in the POSIX/C locale (a-z). * upper: uses the 26 uppercase alphabetic characters in the POSIX/C locale (A-Z). * emoji: uses a curated list of 256 emojis that are not entirely similar. * raw: uses random bytes. The following special formats are also supported: * die: generates a random number between 1 and 6 (by default) or 1 and the provided argument. * prime: generates number of the given bit length that is prime with high probability. * uuid: generates a UUIDv4. ## POSITIONAL ARGUMENTS : The length of the random string in characters or words. If the die format is used, the length is the maximum number of the die. ## EXAMPLES Generate a random string using the default format (ascii) and length (32): ''' $ step crypto rand Ijghm(Y?pfZiTPkHv0Z=1@MC 0 ), -- Now construct a recursive query which includes a 'depth' element. -- This is used to ensure that the "youngest" children are registered before -- their parents. relationships(parent, child, depth) AS ( SELECT DISTINCT 0::OID, selected_types.oid, 0 FROM selected_types UNION ALL SELECT pg_type.oid AS parent, pg_attribute.atttypid AS child, 1 FROM selected_classes c inner join pg_type ON (c.reltype = pg_type.oid) inner join pg_attribute on (c.oid = pg_attribute.attrelid) UNION ALL SELECT pc.parent, pc.child, relationships.depth + 1 FROM pc INNER JOIN relationships ON (pc.parent = relationships.child) ), -- composite fields need to be encapsulated as a couple of arrays to provide the required information for registration composite AS ( SELECT pg_type.oid, ARRAY_AGG(attname ORDER BY attnum) AS attnames, ARRAY_AGG(atttypid ORDER BY ATTNUM) AS atttypids FROM pg_attribute INNER JOIN pg_class ON (pg_class.oid = pg_attribute.attrelid) INNER JOIN pg_type ON (pg_type.oid = pg_class.reltype) WHERE NOT attisdropped AND attnum > 0 GROUP BY pg_type.oid ) -- Bring together this information, showing all the information which might possibly be required -- to complete the registration, applying filters to only show the items which relate to the selected -- types/classes. SELECT typname, pg_namespace.nspname, typtype, typbasetype, typelem, pg_type.oid,**step oauth** command implements the OAuth 2.0 authorization flow. OAuth is an open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites but without giving them the passwords. This mechanism is used by companies such as Amazon, Google, Facebook, Microsoft and Twitter to permit the users to share information about their accounts with third party applications or websites. Learn more at https://en.wikipedia.org/wiki/OAuth. This command by default performs the authorization flow with a preconfigured Google application, but a custom one can be set combining the flags **--client-id**, **--client-secret**, and **--provider**. The provider value must be set to the OIDC discovery document (.well-known/openid-configuration) endpoint. If Google is used this flag is not necessary, but the appropriate value would be be https://accounts.google.com or https://accounts.google.com/.well-known/openid-configuration ## EXAMPLES Do the OAuth 2.0 flow using the default client: ''' $ step oauth ''' Redirect to localhost instead of 127.0.0.1: ''' $ step oauth --listen localhost:0 ''' Redirect to a fixed port instead of random one: ''' $ step oauth --listen :10000 ''' Redirect to a fixed url but listen on all the interfaces: ''' $ step oauth --listen 0.0.0.0:10000 --listen-url http://127.0.0.1:10000 ''' Get just the access token: ''' $ step oauth --bare ''' Get just the OIDC token: ''' $ step oauth --oidc --bare ''' Use a custom OAuth2.0 server: ''' $ step oauth --client-id my-client-id --client-secret my-client-secret \ --provider https://example.org ''' Use the Device Authorization Grant flow for input constrained clients: ''' $ step oauth --client-id my-client-id --client-secret my-client-secret --console-flow device ''' Use the Out Of Band flow for input constrained clients: ''' $ step oauth --client-id my-client-id --client-secret my-client-secret --console-flow oob ''' Use the default OAuth flow for input constrained clients: ''' $ step oauth --client-id my-client-id --client-secret my-client-secret --console ''' Use additional authentication parameters: ''' $ step oauth --client-id my-client-id --client-secret my-client-secret \ --provider https://example.org --auth-param "access_type=offline" '''**step crypto kdf** command group creates and verifies passwords using key derivation functions. ## EXAMPLES Derive a password using **scrypt**: ''' $ step crypto kdf hash Enter password to hash: ******** $scrypt$ln=15,r=8,p=1$3TCG+xs8HWSIHonnqTp6Xg$UI8CYfz6koUaRMjDWEFgujIxM63fYnAcc0HhpUryFn8 $ step crypto kdf hash --insecure password $scrypt$ln=15,r=8,p=1$U8Fl1sO6LWkFeXs5GQS0vA$Rj8nPeaBFQUzbU21N+hhm3I/s1WTxao7Dje4G6ZvO9Q ''' Derive a password using **bcrypt**: ''' $ step crypto kdf hash --alg bcrypt Enter password to hash: ******** $2a$10$EgTYeokp/EhvlMpaDYX56O67M/Ve4JyTl9DHwailYYFOBT3COSTuy $ step crypto kdf hash --alg bcrypt --insecure password $2a$10$kgYs5dEKs2C6Y5PXnU7eTuPzHMeSoCnkvtTL7ghsPDdSSmw5ec/sS ''' Derive a password using **argon2i**: ''' $ step crypto kdf hash --alg argon2i Enter password to hash: ******** $argon2i$v=19$m=32768,t=3,p=4$H0IxAhFFO7fOu5K2RYTxxA$ULEz/79vh3BtCcm7W/zRfJSpiEGULirrZ+PnHfspWKA ''' Derive a password using **argon2id**: ''' $ step crypto kdf hash --alg argon2id Enter password to hash: ******** $argon2id$v=19$m=65536,t=1,p=4$HDi5gI15NwJrKveh2AAa9Q$30haKRwwUe5I4WfkPZPGmhJKTRTO+98x+sVnHhOHdK8 ''' Validate a hash: ''' $ step crypto kdf compare '$scrypt$ln=15,r=8,p=1$3TCG+xs8HWSIHonnqTp6Xg$UI8CYfz6koUaRMjDWEFgujIxM63fYnAcc0HhpUryFn8' Enter password to compare: ******** ok $ step crypto kdf compare --insecure '$scrypt$ln=15,r=8,p=1$3TCG+xs8HWSIHonnqTp6Xg$UI8CYfz6koUaRMjDWEFgujIxM63fYnAcc0HhpUryFn8' password ok $ step crypto kdf compare '$2a$10$EgTYeokp/EhvlMpaDYX56O67M/Ve4JyTl9DHwailYYFOBT3COSTuy' Enter password to compare: ******** ok $ step crypto kdf compare --insecure '$2a$10$EgTYeokp/EhvlMpaDYX56O67M/Ve4JyTl9DHwailYYFOBT3COSTuy' password ok $ step crypto kdf compare '$argon2i$v=19$m=32768,t=3,p=4$H0IxAhFFO7fOu5K2RYTxxA$ULEz/79vh3BtCcm7W/zRfJSpiEGULirrZ+PnHfspWKA' Enter password to compare: ******** ok $ step crypto kdf compare --insecure '$argon2i$v=19$m=32768,t=3,p=4$H0IxAhFFO7fOu5K2RYTxxA$ULEz/79vh3BtCcm7W/zRfJSpiEGULirrZ+PnHfspWKA' password ok $ step crypto kdf compare --insecure '$argon2id$v=19$m=65536,t=1,p=4$HDi5gI15NwJrKveh2AAa9Q$30haKRwwUe5I4WfkPZPGmhJKTRTO+98x+sVnHhOHdK8' Enter password to compare: ******** ok $ step crypto kdf compare --insecure '$argon2id$v=19$m=65536,t=1,p=4$HDi5gI15NwJrKveh2AAa9Q$30haKRwwUe5I4WfkPZPGmhJKTRTO+98x+sVnHhOHdK8' password ok '''JSON Web Signature (JWS) represents content secured with digital signatures or Message Authentication Codes (MACs) using JSON-based data structures. ## EXAMPLES Create a signed JWS of a message using an Ed25519 private JWK (with line breaks for display purposes only): ''' $ echo -n message | step crypto jws sign --key ed25519.priv.json eyJhbGciOiJFZERTQSIsImtpZCI6IjlxaVFZUFU3SHJTOXBYdXpYYzc1WGctMXc5c0JGM2lXVld2cDhieE5oc28ifQ . bWVzc2FnZQ . ZlJvznC3iE4zhwmnCL74UtHXEUs6pb62vf38GFBLbFMKnIFiOGpAFcNv3es-WvPHYfyIIClAjwCfe505gxz5BQ ''' Verify and display the message using the public key: ''' $ echo $TOKEN | step crypto jws verify --key ed25519.pub.json message ''' Verify and display a JSON representation of the token, the message is base64 encoded in the payload: ''' $ echo $TOKEN | step crypto jws verify --key ed25519.pub.json --json { "header": { "alg": "EdDSA", "kid": "9qiQYPU7HrS9pXuzXc75Xg-1w9sBF3iWVWvp8bxNhso" }, "payload": "bWVzc2FnZQ", "signature": "ZlJvznC3iE4zhwmnCL74UtHXEUs6pb62vf38GFBLbFMKnIFiOGpAFcNv3es-WvPHYfyIIClAjwCfe505gxz5BQ" } ''' Inspect the content of the JWS without verifying it: ''' $ echo $TOKEN | step crypto jws inspect --insecure message $ echo $TOKEN | step crypto jws inspect --insecure --json { "header": { "alg": "EdDSA", "kid": "9qiQYPU7HrS9pXuzXc75Xg-1w9sBF3iWVWvp8bxNhso" }, "payload": "bWVzc2FnZQ", "signature": "ZlJvznC3iE4zhwmnCL74UtHXEUs6pb62vf38GFBLbFMKnIFiOGpAFcNv3es-WvPHYfyIIClAjwCfe505gxz5BQ" } ''' Using a JSON message using an P-256 curve and adding the content type json: ''' $ echo -n {"dns":"https://dns.example.com"} | step crypto jws sign --key p256.priv.json --cty json eyJhbGciOiJFUzI1NiIsImN0eSI6Impzb24iLCJraWQiOiJWOTNBLVloN0JodzFXMkUwaWdGY2l2aUp6WDRQWFBzd29WZ3JpZWhtOUNvIn0 . eyJkbnMiOiJodHRwczovL2Rucy5leGFtcGxlLmNvbSJ9 . ZI8q75r3PCXeu-Tubw7bHiDGxloPpAHV2hNfEp9N4WM2r3Wsk5uFhAkBTVIqryPtxmAgfRHGnE3hj-3Dp9nZmA $ echo $TOKEN | step crypto jws verify --key p256.pub.json {"dns":"https://dns.example.com"} $ echo $TOKEN | step crypto jws verify --key p256.pub.json --json { "header": { "alg": "ES256", "cty": "json", "kid": "V93A-Yh7Bhw1W2E0igFciviJzX4PXPswoVgriehm9Co" }, "payload": "eyJkbnMiOiJodHRwczovL2Rucy5leGFtcGxlLmNvbSJ9", "signature": "ZI8q75r3PCXeu-Tubw7bHiDGxloPpAHV2hNfEp9N4WM2r3Wsk5uFhAkBTVIqryPtxmAgfRHGnE3hj-3Dp9nZmA" } '''The **step crypto jwk** command group provides facilities for creating JWKs (JSON Web Keys) as defined in RFC7517. It also includes command line utilities for managing Key Sets and working with encrypted keys. A JWK is a JSON data structure that represents a cryptographic key. The members of this data structure represent properties of the key, including its value. A JWK Set is a simple data structure for representing a set of JWKs. A JWK Set is a JSON object with a "keys" member whose value is an array of JWKs. Cryptographic algorithms and identifiers for used by JWKs are defined by the JSON Web Algorithms (JWA) specification in RFC7518. This tool also supports extensions defined in standards track RFC8037 defining curve and algorithm identifiers for Edwards-curve Digital Signatures. JWKs and JWK Sets are used in the JSON Web Signature (JWS; RFC7515) and JSON Web Encryption (JWE; RFC7516) specifications for signing and encrypting JSON data, respectively. ## EXAMPLES Create a JWK using the default parameters (NIST P-256 curve): ''' $ step crypto jwk create pub.json priv.json ''' Add the previous public keys to a JWK Set (JWKS): ''' $ cat pub.json | step crypto jwk keyset add ks.json ''' List the keys in a JWKS: ''' $ step crypto jwk keyset list ks.json ZI9Ku2jJQL84ewxVn8C_67iDaTN_DFTXE9Gypo6-3YE L38TOXsig8h6FeBOos03nFy6iXmwusFcIBBB0ZilahY ''' Remove a JWK from a JWKS: ''' $ step crypto jwk keyset remove ks.json --kid ZI9Ku2jJQL84ewxVn8C_67iDaTN_DFTXE9Gypo6-3YE $ step crypto jwk keyset list ks.json L38TOXsig8h6FeBOos03nFy6iXmwusFcIBBB0ZilahY ''' Extract a JWK from a JWKS: ''' $ step crypto jwk keyset find ks.json --kid L38TOXsig8h6FeBOos03nFy6iXmwusFcIBBB0ZilahY { "use": "sig", "kty": "EC", "kid": "L38TOXsig8h6FeBOos03nFy6iXmwusFcIBBB0ZilahY", "crv": "P-256", "alg": "ES256", "x": "n_vvepi2bAby8LhsmY396msumgs4EQGoNNzar6wtyAc", "y": "hDRyGFO3M0-4_4MReiwbwXvh6XL3PMh4BAPu0qnTItM" } ''' See the public version of a private JWK: ''' $ cat priv.json | step crypto jwk public { "use": "sig", "kty": "EC", "kid": "L38TOXsig8h6FeBOos03nFy6iXmwusFcIBBB0ZilahY", "crv": "P-256", "alg": "ES256", "x": "n_vvepi2bAby8LhsmY396msumgs4EQGoNNzar6wtyAc", "y": "hDRyGFO3M0-4_4MReiwbwXvh6XL3PMh4BAPu0qnTItM" } ''' Create a JWK Thumbprint for a JWK: ''' $ cat priv.json | step crypto jwk thumbprint L38TOXsig8h6FeBOos03nFy6iXmwusFcIBBB0ZilahY '''**step ca provisioner update** updates a provisioner in the CA configuration. ## POSITIONAL ARGUMENTS : The name of the provisioner. ## EXAMPLES Update a JWK provisioner with newly generated keys and a template for x509 certificates: ''' step ca provisioner update cicd --create --x509-template ./templates/example.tpl ''' Update a JWK provisioner by removing a previously set template: ''' step ca provisioner update cicd --x509-template "" ''' Update a JWK provisioner with duration claims: ''' step ca provisioner update cicd --x509-min-dur 20m --x509-default-dur 48h --ssh-user-min-dur 17m --ssh-host-default-dur 16h ''' Update a JWK provisioner with existing keys: ''' step ca provisioner update jane@doe.com --public-key jwk.pub --private-key jwk.priv ''' Update a JWK provisioner to disable ssh provisioning: ''' step ca provisioner update cicd --ssh=false ''' Update a JWK provisioner by removing a previously cached private key: ''' step ca provisioner update cicd --private-key="" ''' Update a JWK provisioner and explicitly select the ca.json to modify: ''' step ca provisioner update cicd --ssh=false --ca-config /path/to/ca.json ''' Update an OIDC provisioner: ''' step ca provisioner update Google \ --configuration-endpoint https://accounts.google.com/.well-known/openid-configuration ''' Update an X5C provisioner: ''' step ca provisioner update x5c --x5c-roots x5c_ca.crt ''' Update an ACME provisioner: ''' step ca provisioner update acme --force-cn --require-eab ''' Update an K8SSA provisioner: ''' step ca provisioner update kube --public-key key.pub --x509-min-duration 30m ''' Update an Azure provisioner: ''' $ step ca provisioner update Azure \ --azure-resource-group identity --azure-resource-group accounting ''' Update a GCP provisioner: ''' $ step ca provisioner update Google \ --disable-custom-sans --gcp-project internal --remove-gcp-project public ''' Remove the GCP project and use an organization id: ''' $ step ca provisioner update Google \ --gpc-organization 123456789 --remove-gcp-project internal ''' Remove the GCP organization and use a project: ''' $ step ca provisioner update Google \ --gpc-organization="" --gcp-project internal ''' Update an AWS provisioner: ''' $ step ca provisioner update Amazon --disable-custom-sans --disable-trust-on-first-use ''' Update a SCEP provisioner: ''' step ca provisioner update my_scep_provisioner --force-cn '''