How to Install and Use Step CLI on Linux to Manage Certificates, Keys, and Private PKI

Managing Public Key Infrastructure (PKI), TLS certificates, and SSH keys in modern development and operations environments can quickly become intricate. Traditional OpenSSL commands require cryptic command-line flags and complex configuration files that often lead to configuration mistakes. step (often known as Step CLI by Smallstep) is an open-source, purpose-built command-line tool that simplifies working with X.509 certificates, SSH user/host certificates, JSON Web Tokens (JWTs), and internal private Certificate Authorities (CAs) on Linux.

Installing Step CLI Across Linux Distributions

Smallstep provides pre-compiled standalone binaries and native package repository archives for all major Linux environments.

On Debian, Ubuntu, and Linux Mint systems:

wget https://dl.smallstep.com/cli/docs-cli-install/latest/step-cli_amd64.deb
sudo dpkg -i step-cli_amd64.deb

On Arch Linux, install directly from the extra repositories:

sudo pacman -S step-cli

On Fedora, CentOS, or RHEL-based distributions, install the RPM package:

sudo dnf install https://dl.smallstep.com/cli/docs-cli-install/latest/step-cli_amd64.rpm

For standalone manual installation on any POSIX system:

curl -sLO https://dl.smallstep.com/cli/docs-cli-install/latest/step_linux_amd64.tar.gz
tar -xzf step_linux_amd64.tar.gz
sudo mv step_*/bin/step /usr/local/bin/

Verify that the binary operates correctly by checking its version:

step version

Creating a Standalone Private Certificate Authority

For development teams testing mTLS (mutual TLS), microservice authentication, or internal intranet hostnames, step can construct a fully functional private CA in seconds:

step certificate create --profile root-ca "Internal Lab Root CA" root_ca.crt root_ca.key

During generation, step prompts you to enter a secure password to encrypt the root private key (root_ca.key). Next, generate an intermediate CA certificate derived from that root:

step certificate create --profile intermediate-ca "Internal Lab Intermediate CA" intermediate_ca.crt intermediate_ca.key \
    --ca root_ca.crt --ca-key root_ca.key

Generating Leaf TLS Certificates with Custom SANs

Once you possess a signing CA, issuing TLS leaf certificates with Subject Alternative Names (SANs) for local servers, Docker containers, or Kubernetes ingresses is straightforward:

step certificate create internal.app.local server.crt server.key \
    --ca intermediate_ca.crt --ca-key intermediate_ca.key \
    --san internal.app.local --san 192.168.1.100 --san localhost \
    --not-after 2160h

This single command generates a 2048-bit or ECC private key, establishes the Subject Alternative Names for both domain and IP, signs the payload with your intermediate CA, and sets an expiration lifetime of 90 days (2,160 hours).

Inspecting and Debugging Remote and Local Certificates

Inspecting certificate expiry dates, SANs, and issuer chains using standard OpenSSL commands is notoriously verbose. step provides clean, human-readable terminal output:

To inspect a local certificate file:

step certificate inspect server.crt

To inspect and audit a live, remote TLS server over the network:

step certificate inspect https://github.com

step connects to the remote host, executes the TLS handshake, displays the complete certificate hierarchy, verifies trust chains against Mozilla root certificates, and flags impending certificate expiration dates cleanly.

Generating and Verifying JSON Web Tokens (JWTs)

Beyond traditional X.509 cryptography, step provides first-class support for inspecting, signing, and verifying JSON Web Tokens (JWTs) used in modern OAuth2 and API authentication workflows:

To create a signed JWT with custom claims:

step crypto jwt sign --key server.key --iss "auth.service.local" --sub "user_1024" --aud "api.enterprise.org"

To inspect and decode an existing JWT token string directly in your terminal:

echo "eyJhbGciOi..." | step crypto jwt inspect

The command parses header and payload blocks into formatted, syntax-highlighted JSON, displaying subject, issuer, issue date, and expiration timestamps without needing insecure third-party web decoders.

Formatting and Converting Cryptographic Keys

Converting between PEM, DER, and PKCS#12 bundles often creates friction when configuring different web servers. step includes dedicated format conversion utilities:

# Convert a PEM certificate to binary DER format
step certificate format server.crt --out server.der

# Bundle certificate and private key into a PKCS#12 (.p12) container
step certificate bundle server.crt server.key bundle.p12

This versatility makes step a modern, reliable replacement for disparate cryptographic utilities across any Linux administration workflow.