step CLI

No entries match these filters. Clear filters

1. v0.28.4 Mar 5, 2025 · release notes

   Adds STEP_OPEN_BROWSER env var support and custom user claim to ca token

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.28.4 https://github.com/smallstep/cli.git
   # already have the repo? check out this version:
   $ git checkout v0.28.4

   └──▷ TRY IT
   Run step cli in headless CI environments without opening a browser window
   copy

   $ STEP_OPEN_BROWSER=false step ca token

   Issue a certificate with a specific user identity in the JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. payload
   copy

   $ step ca token --user my-service <sub-claim> <path-to-csr>

   • STEP_OPEN_BROWSER=false skips launching the default browser during authentication flows
   • step ca token now supports a custom user claim via --user flag

   2 details in Everything

2. v0.28.3 Feb 20, 2025 · release notes

   step CLI v0.28.3 adds KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. support to ca renew and ca rekey commands

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.28.3 https://github.com/smallstep/cli.git
   # already have the repo? check out this version:
   $ git checkout v0.28.3

   └──▷ USE IT
   Renew a certificate using a KMS-backed key instead of local files.
   shell copy

   step ca renew cert.pem cert.key --kms <kms-id>

   Rekey a certificate using a KMS-backed key for cryptographic agility.
   shell copy

   step ca rekey cert.pem cert.key --kms <kms-id>

   • Adds --kms flag support in the ca renew command
   • Adds --kms flag support in the ca rekey command

   2 details in Everything

3. v0.28.0 Oct 30, 2024 · release notes

   v0.28.0 adds disableSSHCAUser and disableSSHCAHost attributes to GCP provisioner; fixes --context bug.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.28.0 https://github.com/smallstep/cli.git
   # already have the repo? check out this version:
   $ git checkout v0.28.0

4. v0.27.5 Oct 17, 2024 · release notes

   Adds --remove-scope flag to strip scope from certificates

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.27.5 https://github.com/smallstep/cli.git
   # already have the repo? check out this version:
   $ git checkout v0.27.5

   └──▷ TRY IT
   Issue a certificate without any scope restrictions attached to it.
   copy

   $ step ca issue example.com example.crt example.key --remove-scope

5. v0.27.4 Sep 13, 2024 · release notes

   Adds stdin input for step certificate fingerprint in v0.27.4

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.27.4 https://github.com/smallstep/cli.git
   # already have the repo? check out this version:
   $ git checkout v0.27.4

   └──▷ USE IT
   Get the fingerprint of a certificate from standard input without creating a temp file.
   shell copy

   cat cert.pem | step certificate fingerprint -

   • step certificate fingerprint now allows piped or redirected input
   • Parse crlEntryExtensions field in CRLs

   2 details in Everything

6. v0.27.2 Jul 18, 2024 · release notes

   Adds --console flag to step ssh commands

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.27.2 https://github.com/smallstep/cli.git
   # already have the repo? check out this version:
   $ git checkout v0.27.2

   └──▷ USE IT
   Connect to a remote host with interactive console mode enabled.
   shell copy

   step ssh --console <user>@<host>

7. v0.26.2 Jun 13, 2024 · release notes

   step v0.26.2 adds template flags to provisioner commands, OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists./CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. verify support, SSH key type and comment options, and stdin for needs-renewal.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.26.2 https://github.com/smallstep/cli.git
   # already have the repo? check out this version:
   $ git checkout v0.26.2

   • Adds --template, --template-file, and --json flags to step ca provisioner add to customize certificate generation templates when creating a new provisioner
   • Adds --template, --template-file, and --json flags to step ca provisioner update to modify the certificate template of an existing provisioner
   • Enables OCSP and CRL checking in step certificate verify by parsing the relevant extensions from the certificate chain
   • Adds --comment flag to step ssh agent for setting a custom comment on SSH keys generated by the agent
   • Supports configuring SSH key types (e.g., ed25519, rsa) via step ssh agent options

   +1 more show less

   • Allows passing a certificate directly via stdin to step ca needs-renewal using - as the file argument

   6 details in Everything

8. v0.25.1 Nov 29, 2023 · release notes

   step CLI v0.25.1 adds step rand command and --password-file for JWE decrypt

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.25.1 https://github.com/smallstep/cli.git
   # already have the repo? check out this version:
   $ git checkout v0.25.1

   └──▷ TRY IT
   Generate 16 random bytes directly from the CLI for use in scripts or tests.
   copy

   $ step rand 16

   Decrypt a JWE payload using a password stored in a file, avoiding shell history exposure.
   copy

   $ step crypto jwe decrypt --password-file /run/secrets/jwe_password encrypted.jwt

   • Adds the step rand subcommand for generating random numbers
   • Adds --password-file flag to step crypto jwe decrypt to specify a file containing the decryption password

   2 details in Everything

9. v0.22.0 Aug 25, 2022 · release notes

   step CLI v0.22.0 adds template vars and KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. support to cert commands, plus plugin execution

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.22.0 https://github.com/smallstep/cli.git
   # already have the repo? check out this version:
   $ git checkout v0.22.0

   └──▷ TRY IT
   Inject environment-specific values into a certificate CSRCSRA Certificate Signing Request is a block of encoded data submitted to a certificate authority, containing a public key and identity details, so the CA can issue a signed TLS certificate without ever seeing the private key. using template variables.
   copy

   $ step certificate create example.com out.crt out.key --set "env=prod" --set-file vars.json

   Sign a certificate using a KMS provider via the plugin system.
   copy

   $ step certificate sign ca.crt ca.key out.crt --kms <kms-type>

   Use a custom Go template for certificate SANs when creating a new certificate.
   copy

   $ step certificate create example.com out.crt out.key --template '{{ .SANs }}'

   • Adds --set and --set-file flags to step certificate create and step certificate sign for injecting template variables.
   • Adds --template flag to step certificate create and step certificate sign to use custom Go templates.
   • Adds KMS support to step certificate create and step certificate sign via the new KMS signer plugin architecture.
   • Adds initial support for executing command plugins in step.
   • Adds --timeout flag (default 15 minutes) to control plugin execution timeout.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The token flow on step ca renew now uses the default token mechanism instead of requiring an explicit token flag, which has been removed.
10. v0.21.0 Jul 6, 2022 · release notes

    step CLI v0.21.0 adds --password-file for offline signing, --console-flow for OAuth, and restores --domain flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.21.0 https://github.com/smallstep/cli.git
    # already have the repo? check out this version:
    $ git checkout v0.21.0

    • Adds --password-file flag to step ca sign to allow password input via file for offline mode
    • Adds --console-flow flag to step oauth to select alternative OAuth flows

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --device flag is removed from step oauth; flow selection is now automatic based on provider
11. v0.20.0 May 26, 2022 · release notes

    step CLI v0.20.0 adds policy management subcommands, wildcard name support, and SSH certificate inspection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.20.0 https://github.com/smallstep/cli.git
    # already have the repo? check out this version:
    $ git checkout v0.20.0

    └──▷ TRY IT
    List current CA policies to audit permission scopes before deploying new services
    copy

    $ step ca policy list

    Inspect an SSH host certificate to verify its principals and expiry without specifying type
    copy

    $ step cert inspect ssh_host_cert.pub

    • Adds step ca policy commands for managing CA policies
    • Adds step cert inspect to inspect SSH certificates without requiring a type argument

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !provisioner beta commands are removed; use the combined provisioner subcommand instead
12. v0.19.0 Apr 19, 2022 · release notes

    Adds SHA1 fingerprint support in step certificate inspect, renewal-after-expiry flags for CA tokens and provisioners, and Azure MSI token auth updates.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.19.0 https://github.com/smallstep/cli.git
    # already have the repo? check out this version:
    $ git checkout v0.19.0

    • Adds optional SHA1 fingerprint output to step certificate inspect via the new --sha1 flag
    • Allows generating renewal tokens with step ca token that are valid after expiry using the new --allow-renew-after-expiry flag
    • Adds --allow-renew-after-expiry flag when adding provisioners to enable renewal logic for expired certificates
    • Adds support for the --x5c-insecure flag in step ca token to generate tokens with the x5cInsecure header set
    • Enables generating Azure tokens from managed identities not associated with a specific VM

    +1 more show less

    • Adds options for specifying Azure subscription and object IDs when configuring the Azure provisioner

    6 details in Everything

13. v0.18.2 Mar 1, 2022 · release notes

    step v0.18.2 adds --provisioner-password-file flag and improves ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction./IP handling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.2 https://github.com/smallstep/cli.git
    # already have the repo? check out this version:
    $ git checkout v0.18.2

    • Adds --provisioner-password-file argument to the proxycommand subcommand for supplying provisioner passwords via file instead of stdin or prompt.
    • Increases the displayed column width for the ACME Account ID in CLI output.

    2 details in Everything

14. v0.18.0 Nov 17, 2021 · release notes

    step CLI v0.18.0 adds context management, SSH user data V2 support, and ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. challenge timing tweaks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.0 https://github.com/smallstep/cli.git
    # already have the repo? check out this version:
    $ git checkout v0.18.0

    • Adds context set, context select, context remove, and ca bootstrap helper commands to manage named profiles and authorities.
    • Adds the --team flag to step ssh config to enable multi-context SSH configuration generation for teams with subdomain separation.
    • Introduces Version:v2 in the SSH config user data map, updating the default template attributes for generated OpenSSH configs.

    3 details in Everything

15. v0.17.6 Oct 1, 2021 · release notes

    step CLI v0.17.6 adds flags for fixed redirect_uri, custom OAuth listen address, and combined --team/--set usage.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.17.6 https://github.com/smallstep/cli.git
    # already have the repo? check out this version:
    $ git checkout v0.17.6

    └──▷ USE IT
    Force a specific redirect URI when running the OAuth flow.
    shell copy

    step oauth --redirect-uri 'http://localhost:8080/callback'

    Customize the network interface and port for the OAuth listener.
    shell copy

    step oauth --listen 127.0.0.1:9443

    • Adds --redirect-uri flag to step oauth to specify a fixed redirect URI
    • Adds --listen flag to step oauth to override the default listen address
    • Allows combining --team and --set flags together in step oauth

    3 details in Everything

16. v0.16.0 Jul 9, 2021 · release notes

    Admin CLI v1 and certificate validation flags for step CLI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.0 https://github.com/smallstep/cli.git
    # already have the repo? check out this version:
    $ git checkout v0.16.0

    └──▷ TRY IT
    Validate a certificate and ensure it hasn't expired before processing.
    copy

    $ step cert inspect <path-to-cert> --check-expiration

    • step admin is now version 1 of the admin workflow CLI
    • Adds --check-expiration flag to verify certificate expiry during validation
    • Adds new Go function to check a certificate's public key

    3 details in Everything

17. v0.15.15 Apr 15, 2021 · release notes

    Adds --quiet flag to step ssh check-host and forces proxy usage in custom transports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.15 https://github.com/smallstep/cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.15

    └──▷ TRY IT
    Run check-host in CI pipelines where you only care about the exit code, not stdout/stderr details.
    copy

    $ step ssh check-host --quiet <hostname>

    • Adds --quiet option to step ssh check-host to suppress verbose output

    1 detail in Everything

18. v0.15.8 Mar 9, 2021 · release notes

    v0.15.8 drops output file requirement for step ca root and related commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.8 https://github.com/smallstep/cli.git
    # already have the repo? check out this version:
    $ git checkout v0.15.8

    • step ca root no longer requires the user to provide an output file path; it writes to stdout by default.
    • step ca intermediate create and other related certificate-authority subcommands inherit this behavior, dropping the mandatory output-file flag.

    2 details in Everything

19. v0.8.3 Jan 15, 2019 · release notes

    Adds step ca roots, step ca federation commands for retrieving root and federated certificates.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.3 https://github.com/smallstep/cli.git
    # already have the repo? check out this version:
    $ git checkout v0.8.3

    └──▷ TRY IT
    Retrieve all trusted root certificates for the CA.
    copy

    $ step ca roots

    Retrieving the list of federated certificate authorities.
    copy

    $ step ca federation

    • step crypto key format now supports PKCS#8 output
    • Adds step ca roots command to retrieve root certificates
    • Adds step ca federation command to retrieve federated certificates

    3 details in Everything