step ca init

Name

step ca init -- initialize the CA PKI

Usage

step ca init
[--root=<file>] [--key=<file>] [--pki] [--ssh]
[--helm] [--deployment-type=<name>] [--name=<name>]
[--dns=<dns>] [--address=<address>] [--provisioner=<name>]
[--provisioner-password-file=<file>] [--password-file=<file>]
[--ra=<type>] [--kms=<type>] [--with-ca-url=<url>] [--no-db]
[--context=<name>] [--profile=<name>] [--authority=<name>]

Description

step ca init command initializes a public key infrastructure (PKI) to be used by the Certificate Authority.

Options

--root=file The path of an existing PEM file to be used as the root certificate authority.

--key=file The path of an existing key file of the root certificate authority.

--pki Generate only the PKI without the CA configuration.

--ssh Create keys to sign SSH certificates.

--helm Generates a Helm values YAML to be used with step-certificates chart.

--deployment-type=name The name of the deployment type to use. Options are:

More information and pricing at: https://u.step.sm/cm

--name=name The name of the new PKI.

--dns=name The DNS name or IP address of the new CA. Use the '--dns' flag multiple times to configure multiple DNS names.

--address=address The address that the new CA will listen at.

--provisioner=name The name of the first provisioner.

--password-file=file The path to the file containing the password to encrypt the keys.

--provisioner-password-file=file The path to the file containing the password to encrypt the provisioner key.

--with-ca-url=URI URI of the Step Certificate Authority to write in defaults.json

--ra=type The registration authority type to use. Currently "StepCAS" and "CloudCAS" are supported.

--kms=type The key manager service type to use to manage keys. Options are:

--issuer=url The registration authority issuer url to use.

If StepCAS is used, this flag should be the URL of the CA to connect to, e.g https://ca.smallstep.com:9000

If CloudCAS is used, this flag should be the resource name of the intermediate certificate to use. This has the format 'projects/*/locations/*/caPools/*/certificateAuthorities/*'.

--issuer-fingerprint=fingerprint The root certificate fingerprint of the issuer CA. This flag is supported in "StepCAS", and it should be the result of running:

--issuer-provisioner=name The name of an existing provisioner in the issuer CA. This flag is supported in "StepCAS".

--credentials-file=file The registration authority credentials file to use.

If CloudCAS is used, this flag should be the path to a service account key. It can also be set using the 'GOOGLE_APPLICATION_CREDENTIALS=path' environment variable or the default service account in an instance in Google Cloud.

--no-db Generate a CA configuration without the DB stanza. No persistence layer.

--context=name The name of the context for the new authority.

--profile=name The name that will serve as the profile name for the context.

--authority=name The name that will serve as the authority name for the context.