smallstep/cli

Features

• Certificate Lifecycle Management - Provides a comprehensive suite for the issuance, rotation, and revocation of digital certificates.
• X.509 Management Utilities - Provides comprehensive X.509 certificate management including generation, signing, and revocation.
• Public Key Infrastructure - Provides comprehensive management of public key infrastructure, including certificate authorities and issuance policies.
• ACME Certificate Provisioners - Obtains TLS certificates from ACME servers using HTTP servers or webroot validation.
• ACME Clients - Implements the ACME protocol as a command-line tool for automated certificate lifecycle management.
• Asymmetric Key Generators - Creates public and private keypairs in PEM or JSON formats for encryption and signing.
• Certificate Authorities - Sets up the initial configuration and public key infrastructure needed to start a certificate authority.
• Certificate Automation Protocols - Bootstraps and manages servers to issue, renew, and revoke certificates using automated protocols.
• Certificate Renewal Managers - Automates the periodic renewal of expiring certificates based on defined thresholds.
• Certificate Revocations - Invalidates certificates by serial number to prevent further use of compromised credentials.
• Certificate Signing Request Generation - Creates certificates or signing requests using profiles and templates for identity purposes.
• Certificate Signing - Signs certificate requests using a private key to issue valid identities.
• Cryptographic Primitives - Provides a suite of identity operations based on industry-standard X.509, JOSE, and OAuth2 specifications.
• Certificate Authority Management - Manages provisioners and administrators to control access to certificate request capabilities.
• Hardware Identity Attestations - Binds credentials to hardware and provides cryptographic proofs for device identity attestation.
• Trust Store Managers - Automates the installation and removal of root certificates within the operating system trust store.
• Hardware Key Binding - Binds cryptographic credentials to TPMs and HSMs to prevent key exfiltration and ensure hardware-backed identity.
• Hardware Security Module Integrations - Manages keys and certificates stored in HSMs, TPMs, and cloud-based key management systems.
• General Certificate Integrity Validations - Inspects certificate contents and verifies digital signatures against root anchors to ensure trust.
• JSON Web Tokens - Provides comprehensive tools for generating and signing JSON Web Tokens and Keys.
• Hardware-Backed Key Storage - Binds cryptographic credentials to TPMs and HSMs to prevent key exfiltration and ensure authenticity.
• Machine Identity - Secures non-human workloads using mTLS, hardware attestation, and short-lived SSH certificates.
• OAuth and OpenID Connect Libraries - Provides a unified client for implementing OAuth and OpenID Connect authorization flows.
• OAuth Flow Implementations - Implements full OAuth 2.0 authorization flows including authorization code and refresh token flows.
• OAuth Token Management - Manages the lifecycle of OAuth tokens and processes API authorization workflows.
• PKI Management - Bootstraps and manages certificate authorities, trust stores, and issuance policies to maintain a root of trust.
• Certificate Chain Validation - Implements recursive validation of certificate chains to establish a verifiable path to a trusted root authority.
• Root Certificate Generators - Creates self-signed root certificates and leaf certificates with associated private keys.
• JWT Payload Inspection - Decodes JSON Web Signature structures to display payloads without requiring cryptographic verification.
• Context Switching - Configures and switches between different certificate authority environments to organize deployments.
• Signed JWT Generation - Generates compact signed JSON Web Tokens (JWS) using secret or private keys.
• Certificate Issuance Policies - Defines and enforces the rules and administrative controls under which certificates are issued.
• Cryptographic Hash Generation - Produces and verifies cryptographic hashes for files and directories to ensure integrity.
• Data Encryption - Signs and encrypts raw data using high-speed cryptographic primitives.
• JSON Web Encryption - Encrypts data using the JWE standard to create secure, structured data objects.
• Certificate Inspection Tools - Parses certificates or requests to display attributes in human-readable or structured formats.
• SSH Certificate Inspection - Analyzes the properties and metadata of SSH certificates to verify access permissions.
• Revocation List Management - Maintains lists of revoked certificates to prevent compromised keys from being trusted.
• JOSE Specifications - Implements the full JOSE suite for creating and verifying JSON Web Tokens, Keys, and encrypted payloads.
• Toolkits - Provides a complete JOSE toolkit for managing JSON Web Tokens, Keys, Signatures, and Encryption.
• JSON Web Signatures - Implements the JWS standard to create digitally signed payloads for secure data exchange.
• JWT Decoders - Provides utilities to extract and inspect JWT headers and payloads without signature verification.
• Signature Verification - Validates the authenticity of JWS tokens by verifying signatures against expected keys and algorithms.
• JSON Web - Generates and manages cryptographic keys following the JSON Web Key (JWK) standard.
• MFA Token Generators - Produces time-based one-time password secrets and QR codes for multi-factor authentication.
• JSON Web Encryption Decryptions - Decodes and decrypts JWE compact strings back into their original plaintext format.
• One-Time Passwords - Creates and verifies time-based or counter-based one-time passwords.
• Key Derivation Functions - Implements key derivation functions to securely transform passwords into cryptographic keys.
• PKI Profile Management - Switches between different authority configurations and client profiles to support multiple toolchains.
• Non-Human Identity Management - Implements cryptographic identities and mTLS for authenticating AI agents and internal workloads.
• Certificate Trust Managers - Adds root certificates to system or browser trust stores to establish a trusted chain.
• Chain Bundling - Combines end-entity certificates with intermediate certificates to enable full path validation.
• SSH Certificate Management - Generates short-lived SSH user and host certificates and integrates them with the SSH agent.
• System Trust Stores - Adds or removes certificates from the operating system trust store to manage trusted roots.
• JWT Signing and Verification - Validates a JWT's signature, expiration, and issuer to ensure token integrity and authenticity.
• Cryptographic Encoding Conversions - Provides utilities to transform cryptographic data between DER, PEM, and JSON formats for system interoperability.

Istoric stele