Get certificates from a Step CA

1. Point the key at the CA

1. On a key’s page, open Step CA and choose Get certificates from a Step CA….
2. Fill in the CA address, its Root fingerprint (as step ca bootstrap takes it), the Provisioner and the Principals to ask for.

2. Get a certificate

Choose Get a certificate. For a JWK provisioner, type the Provisioner password, which is used once and never saved. For an OIDC provisioner, your browser opens your identity provider’s sign-in.

Sternway trusts only the root with your fingerprint and speaks only HTTPS (plain HTTP only to this computer). It keeps a certificate only if it’s for exactly the key it sent and the principals you asked for, and valid now.

For a key in a vault others can change, Sternway asks before first using the Step CA settings, and again after anyone changes them, naming the CA’s host and the sign-in host.