> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install step-ca and the step CLI

> Install the step CLI, step-ca, and the step-kms-plugin on the Linux host, then pull the PKCS

Install three Smallstep components on the host: the step CLI, the `step-ca` package, and the step-kms-plugin. Then pull the container image that serves the CA.

<Note>
  The `step-ca` package you install here provides the host toolchain. It cannot serve the CA in this integration because official builds are compiled without PKCS #11 support. The `smallstep/step-ca:hsm` image at the end of this page is what runs the CA.
</Note>

## Install the step CLI and step-ca

<Steps>
  <Step>
    Download the current Debian packages:

    ```shell expandable lines wrap title="Shell" theme={null}
    cd /tmp
    wget https://dl.smallstep.com/cli/docs-ca-install/latest/step-cli_amd64.deb
    wget https://dl.smallstep.com/certificates/docs-ca-install/latest/step-ca_amd64.deb
    ```

    <Note>
      These URLs fetch the current releases rather than a pinned version. The validated versions for this guide are in the table on [Before you start](/Integrations/CryptoHub/Certificate_Authority/Smallstep_step-ca/Before_you_start).
    </Note>
  </Step>

  <Step>
    Install both packages:

    ```shell expandable lines wrap title="Shell" theme={null}
    sudo dpkg -i step-cli_amd64.deb
    sudo dpkg -i step-ca_amd64.deb
    ```
  </Step>

  <Step>
    Verify the installation:

    ```shell expandable lines wrap title="Shell" theme={null}
    step version
    step-ca version
    ```

    <Check>
      Each command prints its version and platform. The validated run reported the following:

      ```shell expandable lines wrap title="Shell" theme={null}
      Smallstep CLI/0.30.6 (linux/amd64)
      Smallstep CA/0.30.2 (linux/amd64)
      ```
    </Check>
  </Step>
</Steps>

## Install the step-kms-plugin

The step-kms-plugin adds the `step kms` subcommand, which the step CLI uses to address keys held in an external key management system, including PKCS #11 tokens.

<Steps>
  <Step>
    Download and install the plugin package:

    ```shell expandable lines wrap title="Shell" theme={null}
    cd /tmp
    wget https://github.com/smallstep/step-kms-plugin/releases/download/v0.15.1/step-kms-plugin_0.15.1-1_amd64.deb
    sudo dpkg -i step-kms-plugin_0.15.1-1_amd64.deb
    ```

    <Note>
      This command pins step-kms-plugin `0.15.1`, the validated version. If you install a later release, adjust both the URL and the file name to match the release you downloaded.
    </Note>
  </Step>

  <Step>
    Verify the plugin registered with the step CLI:

    ```shell expandable lines wrap title="Shell" theme={null}
    step kms --help
    ```

    <Check>
      The step CLI prints the `step kms` usage text with its subcommands, including `create`, `key`, and `sign`. If the CLI reports an unknown command, the plugin did not install.
    </Check>
  </Step>
</Steps>

## Pull the PKCS #11-capable container image

<Steps>
  <Step>
    Pull the `:hsm` image:

    ```shell expandable lines wrap title="Shell" theme={null}
    sudo docker pull smallstep/step-ca:hsm
    ```

    <Note>
      `:hsm` is a moving tag. Pulling it again later can retrieve a newer step-ca build. The validated run used step-ca `0.30.2` from this image.
    </Note>
  </Step>

  <Step>
    Verify the image runs and reports a version:

    ```shell expandable lines wrap title="Shell" theme={null}
    sudo docker run --rm --entrypoint step-ca smallstep/step-ca:hsm version
    ```

    <Check>
      The container prints the step-ca version from the image, for example `Smallstep CA/0.30.2 (linux/amd64)`.
    </Check>
  </Step>
</Steps>

<Note>
  The `--entrypoint step-ca` flag is required every time you run a `step-ca` command in this image. The image's default entrypoint is a startup script that expects a full CA bootstrap environment, so it does not pass your arguments through to the `step-ca` binary. The same flag appears in the run command on [Start step-ca](/Integrations/CryptoHub/Certificate_Authority/Smallstep_step-ca/Start_step-ca).
</Note>