/usr/bin/step-ca

NAME
      step-ca -- an online certificate authority for secure automated
      certificate management

USAGE
      step-ca [config] [--context=name] [--password-file=file]
      [--ssh-host-password-file=file]
      [--ssh-user-password-file=file] [--issuer-password-file=file]
      [--resolver=addr] [--help] [--version]

DESCRIPTION
      step-ca runs the Step Online Certificate Authority (Step CA) using the
      given configuration. See the README.md for more detailed configuration
      documentation.

POSITIONAL ARGUMENTS
      config
          File that configures the operation of the Step CA; this file is
          generated when you initialize the Step CA using 'step ca init'

OPTIONS
      --password-file=file
          path to the file containing the password to decrypt the
          intermediate private key.

      --ssh-host-password-file=file
          path to the file containing the password to decrypt the private
          key used to sign SSH host certificates. If the flag is not passed it
          will default to --password-file.

      --ssh-user-password-file=file
          path to the file containing the password to decrypt the private
          key used to sign SSH user certificates. If the flag is not passed it
          will default to --password-file.

      --issuer-password-file=file
          path to the file containing the password to decrypt the
          certificate issuer private key used in the RA mode.

      --resolver=value
          address of a DNS resolver to be used instead of the default.

      --token=value
          token used to enable the linked ca.

      --quiet
          disable startup information

      --context=name
          the name of the authority's context.

      --acme-http-port=port
          the port used on http-01 challenges. It can be changed for testing
          purposes. Requires --insecure flag.

      --acme-tls-port=port
          the port used on tls-alpn-01 challenges. It can be changed for
          testing purposes. Requires --insecure flag.

      --acme-strict-fqdn
          enable strict DNS resolution using a fully qualified domain name.

      --pidfile=file
          the path to the file to write the process ID.

      --insecure
          enable insecure flags.

      --help, -h
          show help

      --version, -v
          print the version

EXIT CODES
      This command will run indefinitely on success and return >0 if any error
      occurs.

EXAMPLES
      These examples assume that you have already initialized your PKI by
      running 'step ca init'. If you have not completed this step please see the
      'Getting Started' section of the README.

      Run the Step CA and prompt for password:

          $ step-ca $STEPPATH/config/ca.json

      Run the Step CA and read the password from a file - this is useful for
      automating deployment:

          $ step-ca $STEPPATH/config/ca.json --password-file ./password.txt

      Run the Step CA for the context selected with step and a custom password
      file:

          $ step context select ssh
          $ step-ca --password-file ./password.txt

      Run the Step CA for the context named mybiz and prompt for password:

          $ step-ca --context=mybiz

      Run the Step CA for the context named mybiz and an alternate ca.json
      file:

          $ step-ca --context=mybiz other-ca.json

      Run the Step CA for the context named mybiz and read the password from
      a file - this is useful for automating deployment:

          $ step-ca --context=mybiz --password-file ./password.txt

COMMANDS
      help, h  display help for the specified command or command group
      version  display the current version of the cli
      export   export the current configuration of step-ca
      onboard  configure and run step-ca from the onboarding guide

ONLINE
      This documentation is available online at
      https://smallstep.com/docs/certificates

VERSION
      Smallstep CA/0.30.2 (linux/amd64)

COPYRIGHT
      (c) 2018-2026 Smallstep Labs, Inc.

FEEDBACK 😍 🍻
      The step-ca utility is not instrumented for usage statistics. It does
      not phone home. But your feedback is extremely valuable. Any information
      you can provide regarding how you’re using step-ca helps. Please send
      us a sentence or two, good or bad: feedback@smallstep.com or
      https://github.com/smallstep/certificates/discussions.