Skip to content
Toolsera Infrastructure

step_ca_client

Install and configure Smallstep step-ca client on Ubuntu/Debian systems.

Description

Section titled “Description”

This role:

  1. Installs step CLI from the official Smallstep APT repository
  2. Bootstraps trust with your Step CA server
  3. Installs the root CA certificate system-wide

Requirements

Section titled “Requirements”
  • Ubuntu/Debian-based system
  • Step CA server accessible on the network
  • CA fingerprint from your Step CA server

Role Variables

Section titled “Role Variables”

Required Variables

Section titled “Required Variables”
  • step_ca_fingerprint: The fingerprint of your Step CA root certificate (no default)

Optional Variables

Section titled “Optional Variables”
  • step_ca_url: URL of your Step CA server (default: https://stepca.toolsera.lan)
  • step_ca_install_cli: Install step CLI (default: true)
  • step_ca_bootstrap: Bootstrap CA trust (default: true)
  • step_ca_install_system_cert: Install certificate system-wide (default: true)

See defaults/main.yml for all available variables.

Dependencies

Section titled “Dependencies”

None.

Example Playbook

Section titled “Example Playbook”

Complete Setup

Section titled “Complete Setup”
---
- hosts: all
  roles:
    - role: step_ca_client
      step_ca_fingerprint: '702a094e239c9eec6f0dcd0a5f65e595bf7ed6614012825c5fe3d1ae1b2fd6ee'

Install CLI Only

Section titled “Install CLI Only”
---
- hosts: all
  roles:
    - role: step_ca_client
      step_ca_install_cli: true
      step_ca_bootstrap: false
      step_ca_install_system_cert: false

Bootstrap Only (CLI Already Installed)

Section titled “Bootstrap Only (CLI Already Installed)”
---
- hosts: all
  roles:
    - role: step_ca_client
      step_ca_install_cli: false
      step_ca_bootstrap: true
      step_ca_install_system_cert: true
      step_ca_fingerprint: 'YOUR_FINGERPRINT'

Custom CA URL

Section titled “Custom CA URL”
---
- hosts: all
  roles:
    - role: step_ca_client
      step_ca_url: 'https://ca.example.com:8443'
      step_ca_fingerprint: 'YOUR_FINGERPRINT'

Getting the CA Fingerprint

Section titled “Getting the CA Fingerprint”

On your Step CA server, run:

Terminal window
step certificate fingerprint $(step path)/certs/root_ca.crt

Post-Installation

Section titled “Post-Installation”

After the role completes, clients can:

Terminal window
# Check CA health
step ca health


# Request a certificate
step ca certificate yourservice.example.com cert.crt key.key


# View provisioners
step ca provisioner list

License

Section titled “License”

MIT

Author Information

Section titled “Author Information”

Created for ubuntu-server-config repository.