Smallstep Step-CA

Smallstep Step-CA Integration

Integrate Smallstep Step-CA with SSL-CLM to:

• Issue certificates
• Revoke certificates
• Sync certificate inventory
• Use secure JWK-based authentication
• Enable internal private PKI automation

Step-CA integrates directly using its REST API.
No Windows Agent is required.

---

Architecture Overview

SSL-CLM Platform
│
│  (HTTPS + JWK signed tokens)
▼
Smallstep Step-CA
│
▼
Internal Certificate Authority

SSL-CLM authenticates using a JWK Provisioner Private Key.

---

Step 1 — Install Step CLI

Install Smallstep CLI on your CA server:

https://smallstep.com/docs/step-cli/installation

Verify:

step version

---

Step 2 — Initialize Step-CA

Create a password file:

step-ca-password.txt

Example:

123

Initialize CA:

step ca init ^
  --name "QCecuring Internal CA" ^
  --dns step-ca-local.qcecuring.com ^
  --address :9000 ^
  --provisioner clm@qcecuring.com ^
  --password-file step-ca-password.txt

This creates:

• Root certificate
• Intermediate certificate
• Default provisioner
• CA configuration
• PKI directory

Start Step-CA:

step-ca $(step path)/config/ca.json

Default API:

https://step-ca-local.qcecuring.com:9000

---

Step 3 — Create Provisioners

We separate provisioners for security.

Provisioner 1 — Admin (CLI usage)

Used for manual certificate issuance.

Remove default:

step ca provisioner remove admin@qcecuring.com

Recreate as JWK:

step ca provisioner add admin@qcecuring.com --type JWK --create

Test:

step ca certificate google.com google.pem google.key \
  --provisioner admin@qcecuring.com

---

Provisioner 2 — CLM (Platform Integration)

Used by SSL-CLM.

Remove existing:

step ca provisioner remove clm@qcecuring.com

Create JWK keypair:

step crypto jwk create clm-pub.json clm-priv.json \
  --kty EC \
  --crv P-256 \
  --no-password \
  --insecure

Add provisioner:

step ca provisioner add clm@qcecuring.com ^
  --type JWK ^
  --public-key clm-pub.json

Verify:

step ca provisioner list

---

Step 4 — Extract Private Key for SSL-CLM

The platform requires the JWK private key.

type clm-priv.json

This JSON will be used inside SSL-CLM connector configuration.

⚠️ Store securely.

---

Step 5 — Create Connector Config in SSL-CLM

Navigate:

Configuration → Connector Configs → New Connector

Select:

• Vendor: Smallstep (Local CA)
• Type: API CA

Configuration JSON:

{
  "provisionerName": "clm@qcecuring.com",
  "baseUrl": "https://step-ca-local.qcecuring.com:9000",
  "provisionerKeyId": "<kid-from-jwk>",
  "provisionerJwk": {
    "kty": "EC",
    "crv": "P-256",
    "kid": "<kid>",
    "x": "<x>",
    "y": "<y>",
    "d": "<d>"
  }
}

Secrets are stored securely in backend vault.

Save connector.

---

Step 6 — Create Certificate Authority Instance

Navigate:

Discovery → Certificate Authorities → New Certificate Authority

Select:

• Type: Smallstep CA
• Connector Config: Smallstep CA Config Local 1
• Refresh Interval: 24 hours

Save.

---

Step 7 — Load Templates

Click:

Load Templates

SSL-CLM will:

• Call Step-CA API
• Retrieve provisioners
• Sync certificate capabilities

---

Step 8 — Issue Certificate

Navigate:

Enrollment → Guided CSR

Select:

• Certificate Authority
• Subject details
• SAN entries

Submit.

Flow:

1. CSR stored in SSL-CLM
2. API call made to Step-CA
3. JWK token signed
4. Certificate issued
5. Stored in platform

Status becomes:

Issued

---

Step 9 — Revoke Certificate

When revocation requested:

• Platform calls Step-CA revoke API
• Status updated in SSL-CLM
• Next refresh sync confirms revocation

---

Security Model

Authentication

• JWK signed tokens
• No password-based auth
• Key-based API access

Recommended

• Enable HTTPS with trusted certificate
• Restrict CA port exposure
• Store JWK private key in vault
• Rotate provisioner keys periodically

---

Troubleshooting

Error: Unauthorized

• Check provisioner name
• Verify kid matches public key
• Confirm private key is correct

Error: Connection Refused

• Confirm Step-CA running
• Verify port 9000 open
• Check DNS resolution

Provisioner Not Found

Run:

step ca provisioner list

Ensure clm@qcecuring.com exists.

---

Operational Best Practices

• Separate admin and automation provisioners
• Use EC P-256 keys
• Restrict JWK usage scope
• Enable scheduled inventory refresh
• Backup PKI directory