Install step-ca and the step CLI - Futurex Documentation

Install three Smallstep components on the host: the step CLI, the step-ca package, and the step-kms-plugin. Then pull the container image that serves the CA.

The step-ca package you install here provides the host toolchain. It cannot serve the CA in this integration because official builds are compiled without PKCS #11 support. The smallstep/step-ca:hsm image at the end of this page is what runs the CA.

Install the step CLI and step-ca

Download the current Debian packages:

Shell

cd /tmp
wget https://dl.smallstep.com/cli/docs-ca-install/latest/step-cli_amd64.deb
wget https://dl.smallstep.com/certificates/docs-ca-install/latest/step-ca_amd64.deb

These URLs fetch the current releases rather than a pinned version. The validated versions for this guide are in the table on Before you start.

Install both packages:

Shell

sudo dpkg -i step-cli_amd64.deb
sudo dpkg -i step-ca_amd64.deb

Verify the installation:

Shell

step version
step-ca version

Each command prints its version and platform. The validated run reported the following:

Shell

Smallstep CLI/0.30.6 (linux/amd64)
Smallstep CA/0.30.2 (linux/amd64)

Install the step-kms-plugin

The step-kms-plugin adds the step kms subcommand, which the step CLI uses to address keys held in an external key management system, including PKCS #11 tokens.

Download and install the plugin package:

Shell

cd /tmp
wget https://github.com/smallstep/step-kms-plugin/releases/download/v0.15.1/step-kms-plugin_0.15.1-1_amd64.deb
sudo dpkg -i step-kms-plugin_0.15.1-1_amd64.deb

This command pins step-kms-plugin 0.15.1, the validated version. If you install a later release, adjust both the URL and the file name to match the release you downloaded.

Verify the plugin registered with the step CLI:

Shell

step kms --help

The step CLI prints the step kms usage text with its subcommands, including create, key, and sign. If the CLI reports an unknown command, the plugin did not install.

Pull the PKCS #11-capable container image

Pull the :hsm image:

Shell

sudo docker pull smallstep/step-ca:hsm

:hsm is a moving tag. Pulling it again later can retrieve a newer step-ca build. The validated run used step-ca 0.30.2 from this image.

Verify the image runs and reports a version:

Shell

sudo docker run --rm --entrypoint step-ca smallstep/step-ca:hsm version

The container prints the step-ca version from the image, for example Smallstep CA/0.30.2 (linux/amd64).

The --entrypoint step-ca flag is required every time you run a step-ca command in this image. The image’s default entrypoint is a startup script that expects a full CA bootstrap environment, so it does not pass your arguments through to the step-ca binary. The same flag appears in the run command on Start step-ca.

​Install the step CLI and step-ca

​Install the step-kms-plugin

​Pull the PKCS #11-capable container image

Install the step CLI and step-ca

Install the step-kms-plugin

Pull the PKCS #11-capable container image