Smallstep Certificate Manager Basic Certificate Operations

In this documentation, we will explore basic certificate operations using the step command-line tool. step acts as a front-end interface to certificate manager and is used for many common crypto and X.509 operations. This tutorial covers:

This tutorial assumes you have created a Smallstep Team and a Certificate Manager Authority using the steps in Getting Started.

With an Authority created and your local client configured, you can create a test certificate by running the step ca certificate command. Here is an example:

In this command, we are asking the CA to create a certificate with the following properties

When you run this command, it will envoke the authority-admin provisioner and start a single sign-on flow via the smallstep dashboard. After a successful sign-in, the authority will issue the certificate.

You can inspect your certificate by running:

It should look similar to this.

Certificates expire. Certificate Manager makes renewing a certificate ahead of expiration easy. Renewals are authenticated using your existing certificate and produce an identical certificate with a new serial number and extended lifetime. The private key is unchanged.

In its most primitive form, renewal is a simple single-command operation:

More than a dozen command-line flags make step ca renew flexible and easy to integrate into almost any operational environment.

Inspect your certificate again, and you will see it has an extended lifetime.

Certificate Manager DevOps Authorities use passive revocation and short-lived certificates by default. To passively revoke a certificate means to block its renewal at the CA.

Passive revocation eliminates the complexity, network overhead, and client latency of running Certificate Revocation List (CRL) and Online Certificate Signing Protocol (OCSP), which are required for active revocation. The tradeoff is, certificates issued with passive revocation cannot be immediately revoked.

Passive revocation is a good fit for many internal PKIs. With this model, certificates should have short lifetimes to limit the value of a key that has been exfiltrated. And short-lived certificates encourage certificate automation and on-demand workflows.

If your security model demands active revocation, Certificate Manager Advanced Authorities support CRL and OCSP. Advanced Authorities use a pull model to implement OCSP and CRL: A revocation service periodically queries the CA for revoked certificates and builds a CRL, which is signed and shipped to a cloud bucket. OCSP responses are built, signed, and served on-demand.

Whether you're using passive or active revocation, the process for revoking a certificate is the same.

To revoke a certificate, run the following operation.

Upon expiry, this certificate will no longer be valid. If you try to renew the certificate, it will fail.