Certificate Manager
Does Smallstep store private keys generated from the Dashboard?
The short answer is no. Smallstep never stores your private keys, and we consider it a sensitive credential that's not stored in our database. In fact...
Specifying RSA key length or size
RSA keys require a minimum key size of 2048 bits. If unset, the default is 2048 bits for RSA keys and 128 bits for oct keys . Read more about using ...
What's the difference between step-ca and Smallstep Certificate Manager?
Smallstep Certificate Manager is a commercial product built on step-ca . An important distinction is that with Smallstep Certificate Manager you hav...
What if I need tokens that last more than one hour?
Tokens are designed to be short-lived, and in Smallstep the longest life for a token is one hour. The idea with the X5C provisioner is that you would...
Migrate From Microsoft AD CS
Check out our blog on how to migrate from Microsoft AD CS to Smallstep.
Create a new Certificate Authority or an intermediate CA from your existing PKI (BYOR)
🔎 Looking for the open-source step-ca version? This tutorial is designed specifically for Smallstep's online Certificate Manager. If you are lookin...
OKTA Redirect Error using OIDC Provisioner
If you're generating certificates using an OKTA OIDC Provisioner in Smallstep, you might get the following error from OKTA on the browser side after...
Open Source Resources
On-Premises (On-Prem)
Security and Compliance
Device Identity
I don’t use Smallstep to issue server certificates for my RADIUS server.
That’s totally fine! Let’s get your Smallstep Wi-Fi account configured to use your external RADIUS server Root CA bundle. Typically, a server certific...
Does the ACME DA setup with SimpleMDM automatically handle renewals on the device?
As of May 2024, SimpleMDM doesn't provide an option to enable automatic renewal, only than with a custom profile. Some additional scripting and/or MDM...
Why can I enroll other devices with the same mobileconfig file?
You may be using a SCEP deployment , particularly "Static SCEP". In this case, a single shared secret allows all devices to use the same mobileconfi...
Official Documentation
Logging into the Smallstep Dashboard using OKTA
The following steps will allow certain OKTA users to log into the Smallstep Dashboard using their OKTA credentials. Leave all other settings as defaul...
Official Documentation
This is your central resource for everything related to Smallstep's platform, tools, and integrations. Whether you're an IT administrator, security en...
SSH Professional
Do I edit the ca.json directly?
Explore all supported configuration options here .
How to completely uninstall `step` from a user's computer.
Because the step CLI runs on multiple operating systems, some with or without package managers, our installation page describes each platform's in...
How to debug Step CLI commands in Windows PowerShell
# Set an environment variable for STEPDEBUG equal to 1 (for true).$env:STEPDEBUG = "1"# Run a step command (the following fails and will show debuggin...
client_input_hostkeys: received duplicated [xxx] host key
# Reconfigure client config, includes, and authorities & overwrite without askingstep ssh config --team <team-name> --force For more information on s...
Can't SSH to registered host VM in GCP
When you register a Google Cloud Platform (GCP) Virtual Machine (VM) with Smallstep, you're effectively removing the use of the access keys that are a...
step-ssh-metadata service logging level
You may notice the following types of service messages in your SSH host's logs from the step-ssh-metadata service. The synchronization ensures that ...
Recovering the SSH Host Enrollment Token
If you've misplaced your enrollment token, please contact support for a new one. At this time, for security reasons, you cannot be provided with you...
Can I use SSH on a port other than the default port 22?
On your server add or edit the following line to your /etc/ssh/sshd_config with the port number: Port 22 Whenever SSH to registered hosts they pas...
Accessing SSH Hosts using SecureCRT
SecureCRT has support for using X.509 certificates. ( read ) SecureCRT users have reported having trouble getting SSH certificates to work on Windows ...
Assign a default provisioner when logging into Smallstep SSH
Suppose users plan to log into SSH with the same authentication method (e.g., OIDC via OKTA, Google, Azure AD). In that case, they can bypass the Prov...
Accessing SSH Hosts using SecureCRT
SecureCRT has support for using X.509 certificates. ( read ) SecureCRT users have reported having trouble getting SSH certificates to work on Windows ...
Configure Default Shell on SSH Hosts (OKTA)
Edit Smallstep User Profile in OKTA From the OKTA admin, go to Directory --> Profile Editor Click to open the Smallstep User profile to add a new ...
Configure Default Home Directory on SSH Hosts (OKTA)
Edit Smallstep User Profile in OKTA From the OKTA admin, go to Directory --> Profile Editor Click to open the Smallstep User profile to add a new ...
Configure Default Home Directory on SSH Hosts (OKTA)
Edit Smallstep User Profile in OKTA From the OKTA admin, go to Directory --> Profile Editor Click to open the Smallstep User profile to add a new ...
401 Unauthorized Error when using SSO to log into the Dashboard
Try the following known resolution steps In the IdPs Smallstep App settings (Azure, Google Workspace, OKTA), check the user's information for simple e...
How to upgrade the step-ssh utilities on an existing host
Step 1: SSH to your host as a user with root access. (Keep the hostname handy, you will need it later) ssh <hostname> Step 2: Run all steps as the r...
Can I use Mobaxterm with Step SSH?
The default Mobaxterm has not been reported as compatible with Smallstep SSH on the client side. Customers on Windows have opted for Windows System fo...
SSH Professional Troubleshooting
Resources to assist in the resolution of problems encountered during SSH Professional Setup. Smallstep SSH Professional Documentation SSH Host Quicks...