smallstep_full_white

Install step-ca

Learn how to to install the step-ca binary on your local machine.

Select your operating system or infrastructure:

macOS

To install step and step-ca together via Homebrew, run:

brew install step

Windows

Winget package

We publish a Winget package for Smallstep.step-ca.

To install both step-ca.exe and step.exe, run:

winget install Smallstep.step-ca

After installing, you may need to restart your terminal for step-ca to appear in your path.

To uninstall, run winget uninstall, then remove the configuration directory $HOME/.step.

Scoop package

We also publish a Scoop package:

scoop bucket add smallstep https://github.com/smallstep/scoop-bucket.git
scoop install smallstep/step
scoop install smallstep/step-ca

To uninstall, run scoop uninstall, then remove the configuration directory $HOME/.step.

Linux Packages (amd64)

Debian/Ubuntu

To install step, download and install the Debian package for your platform from our latest release:

wget https://dl.smallstep.com/cli/docs-ca-install/latest/step-cli_amd64.deb
sudo dpkg -i step-cli_amd64.deb

To install step-ca, download and install the Debian package for your platform from our latest release:

wget https://dl.smallstep.com/certificates/docs-ca-install/latest/step-ca_amd64.deb
sudo dpkg -i step-ca_amd64.deb

To configure step-ca as a daemon, see our systemd configuration guide.

To uninstall, run dpkg -r step-cli step-ca, then remove the configuration directory $HOME/.step.

Arch Linux

These packages are maintained by trusted Arch Linux community members.

To install with pacman, run:

pacman -S step-cli step-ca

The binary tarballs can be found here:

To uninstall, run pacman -R step-ca step-cli, then remove the configuration directory $HOME/.step.

Big shout out to the maintainers of these packages! We appreciate you.

RedHat

To install step, download and install the RPM package for your platform from our latest release:

wget https://dl.smallstep.com/cli/docs-ca-install/latest/step-cli_amd64.rpm
sudo rpm -i step-cli_amd64.rpm

To install step-ca, download and install the RPM package for your platform from our latest release:

wget https://dl.smallstep.com/certificates/docs-ca-install/latest/step-ca_amd64.rpm
sudo rpm -i step-ca_amd64.rpm

To configure step-ca as a daemon, see our systemd configuration guide.

To uninstall, run dnf remove step-cli step-ca, then remove the configuration directory $HOME/.step.

Alpine Linux

There are community-maintained Alpine Linux Packages for step and step-ca.

To install step with apk, run:

apk add step-cli step-certificates

The binary tarballs can be found here:

To uninstall, run apk del step-cli step-certificates, then remove the configuration directory $HOME/.step .

Big shout out to the maintainers of these packages! We appreciate you.

NixOS

There are community-maintained packages for NixOS:

FreeBSD

There are community-maintained packages for FreeBSD:

To install both packages in a FreeBSD jail, follow the steps in this installation transcript.

Big shout out to the maintainers of these packages! We appreciate you.

Linux Binaries

We distribute pre-compiled binaries for amd64, arm64, armv6, armv7, mips, mips64, ppc64le, and 386.

For more, see our latest release page.

We use cosign to sign and verify release artifacts. For more: Binary Signatures.

To download and install the step and step-ca binaries on an amd64 machine:

  1. Install step.

    Download and install the Linux tarball from our latest release:

    curl -LO https://dl.smallstep.com/cli/docs-ca-install/latest/step_linux_amd64.tar.gz
tar -xf step_linux_amd64.tar.gz
sudo cp step_linux_amd64/bin/step /usr/bin

  2. Install step-ca.

    Download and install the Linux tarball from our latest release:

    curl -L https://dl.smallstep.com/certificates/docs-ca-install/latest/step-ca_linux_amd64.tar.gz
tar -xf step-ca_linux_amd64.tar.gz
sudo cp step-ca_linux_amd64/step-ca /usr/bin

To configure step-ca as a daemon, see our systemd configuration guide.

Binary Signature Verification

We use cosign to sign and verify release artifacts.

To verify the signature of the step-ca binary:

  1. Install cosign.

  2. Download the binary signature (.sig) and certificate (.pem) files from the Assets section of our GitHub Releases page.

  3. Run:

    cosign verify-blob \
  --certificate step-ca_linux_amd64.tar.gz.pem \
  --signature step-ca_linux_amd64.tar.gz.sig \
  --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  step-ca_linux_amd64.tar.gz

Kubernetes

We publish Helm charts for easy installation on Kubernetes:

helm repo add smallstep https://smallstep.github.io/helm-charts/
helm repo update
helm install step-certificates smallstep/step-certificates

You can see all the configuration options at https://hub.helm.sh/charts/smallstep/step-certificates.

Docker

We publish docker images for easy container installation.

Test your installation

$ step version
Smallstep CLI/0.10.0 (darwin/amd64)
Release Date: 2019-04-30 19:01 UTC

$ step-ca version
Smallstep CA/0.10.0 (darwin/amd64)
Release Date: 2019-04-30 19:02 UTC

Next Steps

  • Learn about the core concepts and design principles behind step-ca.
  • Read the Getting Started guide to set up a CA and get your first certificate.