smallstep_full_white

step certificate verify

Name

step certificate verify -- verify a certificate

Usage

step certificate verify <crt-file> [--host=<host>]
[--roots=<root-bundle>] [--servername=<servername>]
[--issuing-ca=<ca-cert-file>] [--verbose]
[--verify-ocsp]] [--ocsp-endpoint]=url
[--verify-crl] [--crl-endpoint]=url

Description

step certificate verify executes the certificate path validation algorithm for x.509 certificates defined in RFC 5280. If the certificate is valid this command will return '0'. If validation fails, or if an error occurs, this command will produce a non-zero return value.

Positional arguments

crt-file The path to a certificate to validate.

Options

--host=value Check whether the certificate is for the specified host.

--roots=roots Root certificate(s) that will be used to verify the authenticity of the remote server.

roots is a case-sensitive string and may be one of:

  • file: Relative or full path to a file. All certificates in the file will be used for path validation.

  • list of files: Comma-separated list of relative or full file paths. Every PEM encoded certificate from each file will be used for path validation.

  • directory: Relative or full path to a directory. Every PEM encoded certificate from each file in the directory will be used for path validation.

--issuing-ca=file The certificate issuer CA file needed to communicate with OCSP and verify a CRL. By default the issuing CA will be taken from the cert Issuing Certificate URL extension.

--verify-ocsp Verify the certificate against it's OCSP.

--ocsp-endpoint=value The OCSP endpoint to use. If not provided step will attempt to check it against the certificate's OCSPServer AIA extension endpoints.

--verify-crl Verify the certificate against it's CRL.

--crl-endpoint=value The CRL endpoint to use. If not provided step will attempt to check it against the certificate's CRLDistributionPoints extension endpoints.

--verbose, -v Print result of certificate verification to stdout on success

--servername=value TLS Server Name Indication that should be sent to request a specific certificate from the server.

--insecure

Exit codes

This command returns 0 on success and >0 if any error occurs.

Examples

Verify a certificate using your operating system's default root certificate bundle:

$ step certificate verify ./certificate.crt

Verify a remote certificate using your operating system's default root certificate bundle:

$ step certificate verify https://smallstep.com

Verify a certificate using a custom root certificate for path validation:

$ step certificate verify ./certificate.crt --roots ./root-certificate.crt

Verify a certificate using a custom list of root certificates for path validation:

$ step certificate verify ./certificate.crt \
--roots "./root-certificate.crt,./root-certificate2.crt,/root-certificate3.crt"

Verify a certificate using a custom directory of root certificates for path validation:

$ step certificate verify ./certificate.crt --roots ./root-certificates/

Verify a certificate including OCSP and CRL using CRL and OCSP defined in the certificate

$ step certificate verify ./certificate.crt --verify-crl --verify-ocsp

Verify a certificate including OCSP and specifying an OCSP server

$ step certificate verify ./certificate.crt --verify-ocsp --ocsp-endpoint http://acme.com/ocsp

Verify a certificate including CRL and specificing a CRL server and providing the issuing CA certificate

$ step certificate verify ./certificate.crt --issuing-ca ./issuing_ca.pem  --verify-crl --crl-endpoint http://acme.com/crl