{"id":20238506,"url":"https://github.com/smallstep/step-kms-plugin","last_synced_at":"2026-04-02T00:12:51.679Z","repository":{"id":39668511,"uuid":"505571834","full_name":"smallstep/step-kms-plugin","owner":"smallstep","description":"🔐 step plugin to manage keys and certificates on a cloud KMSs and HSMs","archived":false,"fork":false,"pushed_at":"2024-04-08T08:55:34.000Z","size":574,"stargazers_count":38,"open_issues_count":4,"forks_count":4,"subscribers_count":9,"default_branch":"main","last_synced_at":"2024-04-09T08:57:39.216Z","etag":null,"topics":["awskms","azure-keyvault","cloudkms","hsm","kms","pkcs11","yubihsm2","yubikey"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/smallstep.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2022-06-20T19:26:33.000Z","updated_at":"2024-04-15T15:18:30.825Z","dependencies_parsed_at":"2023-10-16T19:15:44.100Z","dependency_job_id":"cd923a88-77ec-46f5-a4b7-ba5460490b7f","html_url":"https://github.com/smallstep/step-kms-plugin","commit_stats":{"total_commits":138,"total_committers":5,"mean_commits":27.6,"dds":0.2028985507246377,"last_synced_commit":"7a1f7942674d6671e693c1cbf8b550a24f559dbc"},"previous_names":[],"tags_count":56,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smallstep%2Fstep-kms-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smallstep%2Fstep-kms-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smallstep%2Fstep-kms-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smallstep%2Fstep-kms-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/smallstep","download_url":"https://codeload.github.com/smallstep/step-kms-plugin/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248281423,"owners_count":21077423,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["awskms","azure-keyvault","cloudkms","hsm","kms","pkcs11","yubihsm2","yubikey"],"created_at":"2024-11-14T08:34:32.745Z","updated_at":"2026-04-02T00:12:51.664Z","avatar_url":"https://github.com/smallstep.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# step-kms-plugin\n\nThis is a tool that helps manage keys and certificates on a cloud KMSs and HSMs.\nIt can be used independently, or as a plugin for [`step`](https://github.com/smallstep/cli).\n\n\u003e ⚠️ This tool is currently in beta mode and its usage of might change without\n\u003e announcements.\n\n## Installation\n\nThere's two installation options:\n\n- The most generic way to install `step-kms-plugin` is to use `go install` to\ncompile it and install it in your `$GOBIN`, which defaults to `$(go env GOPATH)/bin`.\n\n  ```console\n  go install github.com/smallstep/step-kms-plugin@latest\n  ```\n\n- Alternatively, download the [latest release binary for your platform](https://github.com/smallstep/step-kms-plugin/releases).\n\nTo use `step-kms-plugin` as a plugin for `step` (eg. `step kms create ...`),\nadd it to your `$PATH` or to `$(step path --base)/plugins`.\n\n## Supported KMSs\n\nThe following Key Management Systems (KMSs) are supported, but not all of\nthem provide the full functionality:\n\n* PKCS #11 modules\n* [TPM 2.0](https://trustedcomputinggroup.org/resource/tpm-library-specification/)\n* [Amazon AWS KMS](https://aws.amazon.com/kms/)\n* [Google Cloud Key Management](https://cloud.google.com/security-key-management)\n* [Microsoft Azure Key Vault](https://azure.microsoft.com/en-us/services/key-vault/)\n* [YubiKey PIV](https://developers.yubico.com/PIV/)\n* ssh-agent\n\n## Setting up `step-ca`?\n\nIf you're setting up a `step-ca` PKI on one of the supported KMSs, check out our [detailed tutorials in our Cryptographic Protection docs](https://smallstep.com/docs/step-ca/cryptographic-protection/).\n\n## Authenticating to a Cloud KMS provider\n\nIf you use `step-kms-plugin` with a cloud provider, you will need to authenticate to the cloud provider.\nHere are the required API permissions and authentication methods for each provider.\n\n### AWS KMS\n\n`step-kms-plugin` authenticates to AWS using the same approach as any AWS Go SDK program.\nSee the [AWS Go SDK documentation](https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/#specifying-credentials) for details.\n\nThe following IAM role Actions may be required by `step-kms-plugin`:\n\n```\nkms:GetPublicKey\nkms:CreateKey\nkms:CreateAlias\nkms:Sign\n```\n\nNotes:\n* [AWS Docs: IAM Policies relating to KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/cmks-in-iam-policies.html)\n\n### Azure Key Vault\n\nAuthentication to Azure is handled via environment variables; we recommend using either [file-based authentication](https://docs.microsoft.com/en-us/azure/developer/go/azure-sdk-authorization#use-file-based-authentication) via the `AZURE_AUTH_LOCATION` environment variable, or using a managed identity and setting the `AZURE_TENANT_ID` and `AZURE_CLIENT_ID` variables when running `step-kms-plugin`\n\nAlternatively, you can create a [service principal](https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli) and set the `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, and `AZURE_CLIENT_SECRET` variables. See Option 1 under [Authentication Methods for Azure SDK for Go](https://docs.microsoft.com/en-us/azure/developer/go/azure-sdk-authentication?tabs=bash#-option-1-define-environment-variables) for examples of authentication methods and environment variables.\n\nFor local development and testing, Azure CLI credentials are used if no authentication environment variables are set.\n\nThese are the Azure RBAC role actions used by `step-kms-plugin`:\n\n```\nKey Vault Crypto Officer\nKey Vault Secrets Officer\nKey Vault Certificates Officer\n```\n\nNotes:\n* It is recommended to restrict permissions to the vaults that you will use `step-kms-plugin` with.\n* Azure has several built-in [RBAC roles for Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli#azure-built-in-roles-for-key-vault-data-plane-operations).\n\n### Google Cloud KMS\n\nTo authenticate, be sure you have installed [the `gcloud` CLI](https://cloud.google.com/sdk/docs/install) and have [configured Google Cloud application default credentials](https://developers.google.com/accounts/docs/application-default-credentials) in your local environment, eg. by running `gcloud auth application-default login`.\n\nThe following Cloud KMS permissions may be required for `step-kms-plugin`:\n\n```\ncloudkms.cryptoKey.create\ncloudkms.cryptoKeyVersions.create\ncloudkms.cryptoKeyVersions.get\ncloudkms.cryptoKeyVersions.useToDecrypt\ncloudkms.cryptoKeyVersions.useToSign\ncloudkms.cryptoKeyVersions.useToVerify\ncloudkms.cryptoKeyVersions.viewPublicKey\ncloudkms.keyRings.get\ncloudkms.keyRings.create\ncloudkms.locations.get\nresourcemanager.projects.get\n```\n\nNotes:\n* It is recommended that you scope the IAM role permissions to specific key rings\n* When creating a key, if the key ring does not exist, `step-kms-plugin` will attempt to create it first.\n\n## General Usage\n\n`step-kms-plugin` can be used as a standalone application or in conjunction with\n`step`.\n\nThe commands under `step kms` will directly call `step-kms-plugin` with the\ngiven arguments. For example, these two commands are equivalent:\n\n```console\nstep kms create --kty EC --crv P384 'pkcs11:token=smallstep;id=1000;object=mykey?pin-source=/dev/shm/pass.txt'\nstep-kms-plugin create --kty EC --crv P384 'pkcs11:token=smallstep;id=1000;object=mykey?pin-source=/dev/shm/pass.txt'\n```\n\nFor the rest of the examples, we are going to use the plugin usage, `step kms`,\nusing the PKCS #11 KMS with [SoftHSM 2](https://github.com/opendnssec/SoftHSMv2).\nTo initialize the SoftHSM 2 we will run:\n\n```console\n$ softhsm2-util --init-token --free --token smallstep \\\n  --label smallstep --so-pin password --pin password\nSlot 0 has a free/uninitialized token.\nThe token has been initialized and is reassigned to slot 715175552\n```\n\nYou can later delete it running:\n\n```console\nsofthsm2-util --delete-token --token smallstep\n```\n\n### p11-kit integration\n\nWhen `step-kms-plugin` is used with PKCS #11, it needs the filename of the PKCS\n#11 module to load. The module can be directly passed using the `module-path`\nparameter. But if it is not defined, it will use the\n[p11-kit-proxy](https://p11-glue.github.io/p11-glue/p11-kit/manual/sharing.html)\nmodule provided by the\n[p11-kit](https://p11-glue.github.io/p11-glue/p11-kit.html) project.\n\np11-kit provides a standard configuration setup for installing PKCS #11 modules\nso they're discoverable. p11-kit uses a configuration file\n[pkcs11.conf](https://p11-glue.github.io/p11-glue/p11-kit/manual/pkcs11-conf.html)\nthat allows you to define the module to use. By default, it also allows you to\nadd configurations in the user's home directory. We will use this last option to\ndefine the SoftHSM 2 module.\n\nWith a simple file like following in `~/.config/pkcs11/modules/softhsm2`,\np11-kit-proxy will know which module to load:\n\n```\nmodule: /usr/local/lib/softhsm/libsofthsm2.so\n```\n\nThis configuration will make these commands equivalent:\n\n```console\nstep-kms-plugin create --kty EC --crv P384 'pkcs11:token=smallstep;id=1000;object=mykey?pin-value=password'\nstep-kms-plugin create --kty EC --crv P384 'pkcs11:module-path=/usr/local/lib/softhsm/libsofthsm2.so;token=smallstep;id=1000;object=mykey?pin-value=password'\n```\n\nIn the following sections, we will skip the `module-path` and assume that\np11-kit is properly configured with SoftHSM 2.\n\n### Creating a new key\n\nOur PKCS #11 implementation requires always an object id (`id=1000`) and label\n(`object=my-key`) to create the key. We will add those as part of the URI that\ndefines the module to use.\n\nBy default, the create command creates an EC P-256 key:\n\n```console\n$ step kms create 'pkcs11:token=smallstep;id=1000;object=my-p256?pin-value=password'\n-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjg5Zs/fSuvfodhZQcxcu07deKsdX\nsQf46/JPxQ39kPIkhD+onVVxCl462yMGVTQeLDCN3fwImoOdqZ3eKhoQOA==\n-----END PUBLIC KEY-----\n```\n\nWe can use `--kty`, `--crv`, and `--size` to create other types of keys. On\nother KMS implementations you can also use the `--pss` and `--alg` flags to\ndefine precisely the key to generate. Here we are creating a P-384 and a\n3072-bit RSA key:\n\n```console\n$ step kms create --kty EC --crv P384 'pkcs11:token=smallstep;id=1001;object=my-p384?pin-value=password'\n-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEBDdy2wnC6r8n2qZTa3kefjo3CEkaWXz6\nrWTbDNEYrzc9LXEoA7zI1j+liSGR9wLmu91keOBnweQOIR06QV12InEKFX2l3lRx\nnDPvq7P3MeRo9UqzKlZT+D+dhYQjB54K\n-----END PUBLIC KEY-----\n$ step kms create --kty RSA --size 3072 'pkcs11:token=smallstep;id=1002;object=my-rsa?pin-value=password'\n-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAzAtriAh4ABfboPff15CD\nSkzxghaeb5SqcCwvZYdlZDRlZHlcbweY80bHjFvcU+ytSZOoMgBw+XooUnTmeVo3\nhOy039wlZwkfv/MEL4HP1AUVNA2iS19tmybAUTK0Myl/Ui+1iGllYA3e1ChCEZwV\n3B5KPfpG5KiPurhKfv5q3edIVcMKL8qj8Y9HYrzFBebQil23vkWrFylb1r/54W/O\n5kT2emYEGaJ8lJqzvJaIsvQpk8EqkJ7FHuAMeZyb3BK8cGjIP/GI22mL6NO3LpFc\nPK3Zjo7mZS5tQlFR9CULEbCuM+jiOs7FRJdyhUhdkygDxuWk1hfrCMYcG59P8pQX\nmPaCwE78GB3Bsi50Bp4+UI9KBcp+JARdPKocd6RvASDX1KpALpFhgqrC05+JfKA+\n/51QMYY1mlJn7izHmwYJr0DRn1usrh5mtJEcOtwiNKR3bo1LI00XW93DIA442IzA\nKqMBZrEYmuy+oL6Jy9Ys4nOVWEzFcOjmUWyjFOMMG/89AgMBAAE=\n-----END PUBLIC KEY-----\n```\n\nSoftHSM 2 does not support creating an extractable key, but on other devices, it\nis recommended to use the `--extractable` flag so you can backup a wrapped\nversion of the new keys.\n\n### Getting the public key\n\nTo retrieve the public key, we can use the `id`, the `object`, or both at the\nsame time:\n\n```console\n$ step kms key 'pkcs11:token=smallstep;id=1000;object=my-p256?pin-value=password'\n-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjg5Zs/fSuvfodhZQcxcu07deKsdX\nsQf46/JPxQ39kPIkhD+onVVxCl462yMGVTQeLDCN3fwImoOdqZ3eKhoQOA==\n-----END PUBLIC KEY-----\n$ step kms key 'pkcs11:token=smallstep;id=1001?pin-value=password'\n-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEBDdy2wnC6r8n2qZTa3kefjo3CEkaWXz6\nrWTbDNEYrzc9LXEoA7zI1j+liSGR9wLmu91keOBnweQOIR06QV12InEKFX2l3lRx\nnDPvq7P3MeRo9UqzKlZT+D+dhYQjB54K\n-----END PUBLIC KEY-----\n$ step kms key 'pkcs11:token=smallstep;object=my-rsa?pin-value=password'\n-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAzAtriAh4ABfboPff15CD\nSkzxghaeb5SqcCwvZYdlZDRlZHlcbweY80bHjFvcU+ytSZOoMgBw+XooUnTmeVo3\nhOy039wlZwkfv/MEL4HP1AUVNA2iS19tmybAUTK0Myl/Ui+1iGllYA3e1ChCEZwV\n3B5KPfpG5KiPurhKfv5q3edIVcMKL8qj8Y9HYrzFBebQil23vkWrFylb1r/54W/O\n5kT2emYEGaJ8lJqzvJaIsvQpk8EqkJ7FHuAMeZyb3BK8cGjIP/GI22mL6NO3LpFc\nPK3Zjo7mZS5tQlFR9CULEbCuM+jiOs7FRJdyhUhdkygDxuWk1hfrCMYcG59P8pQX\nmPaCwE78GB3Bsi50Bp4+UI9KBcp+JARdPKocd6RvASDX1KpALpFhgqrC05+JfKA+\n/51QMYY1mlJn7izHmwYJr0DRn1usrh5mtJEcOtwiNKR3bo1LI00XW93DIA442IzA\nKqMBZrEYmuy+oL6Jy9Ys4nOVWEzFcOjmUWyjFOMMG/89AgMBAAE=\n-----END PUBLIC KEY-----\n```\n\n### Signing\n\nLet's first, initialize a hello world to sign:\n\n```console\necho \"Hello World\" \u003e data.txt\n```\n\nAnd then use the previous keys to sign, as before we can either use `id`,\n`object`, or both:\n\n```console\n$ step kms sign --in data.txt 'pkcs11:token=smallstep;id=1000;object=my-p256?pin-value=password'\nMEQCIH2WfsgVRfCJs/sgIftT3i7xbpslS+9ShW/3qO9jXeA7AiBZFkcum+68zQ7pxluUE1v1yjCDyo34OEGIIyic9ItBcA==\n$ step kms sign --in data.txt 'pkcs11:token=smallstep;id=1001?pin-value=password'\nMGUCMQDtK5cADG4D3AXRLeTLvOpcDoOfYHJqt8eVVhKPg+Q5z9Hk3DSBlz/h1+YGyV11crYCMEVnQIqSdYQLB096DyLrZG28+cMjKfs+mlg+UUeVShnjHgBNGt2tHCeAZAS0VV4u4A==\n$ step kms sign --in data.txt 'pkcs11:token=smallstep;object=my-rsa?pin-value=password'\nAYbuQf6JfQMxrnaolaOyaddW4dfHU4Rg/mXXYTzSns3WUxuxJ2yXysm2Af0DrSaoqg3J4pFAmKiadDf+AZeBi0Lwwx1GpTxxOaiGDAuCuUJyUDcA/G2mTNX9+eEQkI/vOIM6Z+5T9kqP48BN3GKV5e51feSmkP6ihnQVXhW7kgPDOWt2Qq3GjJvOrn0pIjSgiYMYviMDvgcgxPuIhktYc7ZBWW63gmZ40nR3TFzTveWn7vBCGPJMOi6eOjPKRvpzo0II5froUgbTZXXFfb0r7xhMx872i2/MlRL/xhc0iy2BEXWWcoJovrbO5SdMGM0iDDkAOYceQxqW+HPf6Ghd7KA/hP6Rr0PwpfdxW7h8fF45bHrKDCXzIY4U+tHF9E16adA5axDwHVSnO8Hm5tajhB0VM7w3DYnu3npX/ko4RJw/kXe0PzhBqr+f67mhoCOuKkrsc8p8ABensZA5LeWivo78i1KMFWkh9SMRcq728GUx5/wdkc9boYr/jFNJ4WKf\n```\n\nWe can use `step` to verify one of these signatures:\n\n```console\n$ step kms key 'pkcs11:token=smallstep;id=1000?pin-value=password' \u003e my-p256.key\n$ step crypto key verify --key my-p256.key \\\n  --signature MEQCIH2WfsgVRfCJs/sgIftT3i7xbpslS+9ShW/3qO9jXeA7AiBZFkcum+68zQ7pxluUE1v1yjCDyo34OEGIIyic9ItBcA== data.txt\ntrue\n```\n\nBy default, RSA signatures use the RSA PKCS #1 scheme with SHA256, but we can\nuse the `--alg` to select the hash function and `--pss` to use the RSA-PSS\nscheme:\n\n```console\n$ step kms sign --alg SHA512  --in data.txt 'pkcs11:token=smallstep;object=my-rsa?pin-value=password'\nljdurcImEwOgAOxntf4+U56w1+lf8V/wOWrRfMS3PvtSz3KSfRZZu10ZxtIG7ilZFNUnb0svTM9e3+ViYCOX+3zxu22F4DWp6E5S92TbS7AImQbMybl7rYtYloDBSagJ5T0d1h3wVg77Npi5Fkcn39ekWDeSmrEK359H0EJAoSFTVfYJ4vYUvFHbO5Zn/BgWQNtTVoSCDSnSX1cu3Nar9N2bAcGbbfjBcwQsjg+NDRgdxxNJESKYHL280gvZR0wLpYvX4jf57UUVLF4WdMEh1YGPsBGzO/M1rSMS8pYZVD1kNOwIq7buFGAVAgl8UirtIe0joUYQekVhFbGEgADTv33fWOa8B95ARGraR5mE0lg5vwC/8SeZL9M4iIS5cdn+lOs/Nj5GDySykpgsCPi+irqKRgMcC88omv8/ofqcUIJpm+IOhE47IvL3CjlItEJV55kQjC4qrdNb9/w4vk7fFtW/amdxb5juajU2AIfuKFduaHhwSJpyguzmi2Zc0r7e\n$ step kms sign --alg SHA256 --pss  --in data.txt 'pkcs11:token=smallstep;object=my-rsa?pin-value=password'\niT/enoe6zXfz4bZolrQUoYf+B5bDhn++cfkgM4x4ozqX8xd6lljPMODGB3Z43rfvUHc3A//ULzN8DjAzA7nuExneexrlAalwhqeMHSLHAmJsztgpuQ2OHdpsEfWIbkQgd4lfZWBq0Srri32SEqTnqp+s2Itf1R1By6PFcsftVMFvH3foXn3bEwWK8gHsxLRt/bnqC7ubXU+b/xjUQiu/LMl+p7RSFVjDtm3e0j07G6cbsABsr4EA0Xlw7JRrYbiP3hz4GwfRbfSBKBXrCF+edpBhGtscJnrdwL9LD/MbaDgEWrf8lO1UFmLp2B6NsjvNiQhZJ4ruQ4isHOF669z5cFcB5Hc14i4ZI81dYAI8AjG7NZvF07bH32gM2h6vVEgesrTqqcKpLW/dge3cpcEimA0Nfzpeg6ZnhnugCtI8FBDZAbo3KP9e4O2mXydP5MmZu4vWajjWc4h3sReBFXg888j2dh8gsJXCIGNUXUzULHysfdTVivnewtW2sDDnEK+L\n```\n\n### Examples\n\n#### Example: Signing a Root CA with step\n\nThe `step-kms-plugin` is automatically used by `step certificate create` and\n`step certificate sign` commands if we use the `--kms` flag. With these\ncommands, we can initialize our PKI using a key stored in a KMS.\n\nLet's create first a root key:\n\n```console\n$ step kms create 'pkcs11:token=smallstep;id=2000;object=root?pin-value=password'\n-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE5fbczGkGeLrLu3nD7mbdS0PmqDUT\njT/f0r5U71dCAhP2T4rTfdrgnFPacX/a4jeQ1sMn4grtNFc1A4CE6vBt0A==\n-----END PUBLIC KEY-----\n```\n\nAnd use it to create the root certificate:\n\n```console\n$ step certificate create --profile root-ca \\\n  --kms 'pkcs11:token=smallstep?pin-value=password' \\\n  --key 'pkcs11:id=2000' \\\n  \"Smallstep Root CA\" root_ca.crt\nYour certificate has been saved in root_ca.crt.\n```\n\nNote that currently, the configuration of the KMS and the reference to the key\nis passed using two different flags. This might be improved in the future.\n\nNow let's create a key for the intermediate certificate:\n\n```console\n$ step kms create 'pkcs11:token=smallstep;id=2001;object=intermediate?pin-value=password'\n-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZUm9hNkXPn9KrXrG1vzhgzTwqD4+\nj0Wo9CQOP7GQApJLcVO9TGpzpLQHEUsUEU2zAnrGlxH7oFAlbZGXH4ueHQ==\n-----END PUBLIC KEY-----\n```\n\nAnd create the intermediate ca:\n\n```console\n$ step certificate create --profile intermediate-ca \\\n  --kms 'pkcs11:token=smallstep?pin-value=password' \\\n  --ca root_ca.crt --ca-key 'pkcs11:id=2000' \\\n  --key pkcs11:id=2001 \\\n  \"Smallstep IntermediateCA\" intermediate_ca.crt\nYour certificate has been saved in intermediate_ca.crt.\n```\n\nWe can also create a CSR backed by a key in the KMS and sign it using the intermediate key:\n\n```console\n$ step kms create 'pkcs11:token=smallstep;id=2002;object=leaf?pin-value=password'\n-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6fMBiDFPAOCrHSQszpoLMQX9JYuk\nJVX8J8X9t/OydimJAgBujwY8xRSgnWdU1SXXdMck+wPZZNBYvcWJWpLN9Q==\n-----END PUBLIC KEY-----\n$ step certificate create --csr \\\n  --kms 'pkcs11:token=smallstep?pin-value=password' \\\n  --key pkcs11:id=2002 \\\n  leaf.internal leaf.csr\nYour certificate signing request has been saved in leaf.csr.\n$ step certificate sign --kms 'pkcs11:token=smallstep?pin-value=password' \\\n  leaf.csr intermediate_ca.crt pkcs11:id=2001\n-----BEGIN CERTIFICATE-----\nMIIBxTCCAWygAwIBAgIQeauacIrgtv7uPgzk+Z4puzAKBggqhkjOPQQDAjAjMSEw\nHwYDVQQDExhTbWFsbHN0ZXAgSW50ZXJtZWRpYXRlQ0EwHhcNMjIwNzEyMjE0MTI4\nWhcNMjIwNzEzMjE0MTI4WjAYMRYwFAYDVQQDEw1sZWFmLmludGVybmFsMFkwEwYH\nKoZIzj0CAQYIKoZIzj0DAQcDQgAE6fMBiDFPAOCrHSQszpoLMQX9JYukJVX8J8X9\nt/OydimJAgBujwY8xRSgnWdU1SXXdMck+wPZZNBYvcWJWpLN9aOBjDCBiTAOBgNV\nHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1Ud\nDgQWBBRx1wnkugvbRewcTzIyBDwkeM2qVzAfBgNVHSMEGDAWgBRWvP5Nn9rbZ5Go\n24uF0oUqmHEghjAYBgNVHREEETAPgg1sZWFmLmludGVybmFsMAoGCCqGSM49BAMC\nA0cAMEQCICWSdIWIStDm5OJqBlqo1fd4lpzkcM0AOQcCwer+AgO1AiAF3sK+26LI\nmX6QduO/H/k8GZzcx923U54bRPCxKUaPvg==\n-----END CERTIFICATE-----\n```\n\n#### Example: Client Certificate on a YubiKey\n\nIn this example, we want to issue a client certificate using a private key stored on a YubiKey.\nWe're using an OIDC CA provisioner in this example. There's no device attestation in this example,\nbut the private key is not exportable from the YubiKey.\n\nFirst, create a private key on the YubiKey in slot 9a, and output a CSR:\n\n```\n$ step certificate create --csr --kms 'yubikey:pin-value=123456' --key 'yubikey:slot-id=9a' mariano@smallstep.com mariano.csr\nYour certificate signing request has been saved in mariano.csr.\n```\n\nNext, get the CSR signed, using the OIDC provisioner:\n\n```\n$ step ca sign mariano.csr mariano.crt\n✔ Provisioner: Google (OIDC) [client: 1087160488420-8qt7bavg3qesdhs6it824mhnfgcfe8il.apps.googleusercontent.com]\nYour default web browser has been opened to visit:\n\nhttps://accounts.google.com/o/oauth2/v2/auth?...\n\n✔ CA: https://ca.smallstep.com:8443\n✔ Certificate: mariano.crt\n```\n\nFinally, import the new certificate into the YubiKey:\n\n```\n$ step kms certificate --import mariano.crt --kms 'yubikey:' 'yubikey:slot-id=9a'\n-----BEGIN CERTIFICATE-----\nMIICQjCCAeigAwIBAgIRANfNWEXAMPLE3zJ+jRZ4TbUwCgYIKoZIzj0EAwIwKTEn\n...\n-----END CERTIFICATE-----\n\n```\n\nNote: To use this client certificate against a server, the server needs to trust the intermediate CA rather than the root CA. That's because YubiKeys only support one certificate per key slot (in this case, the client certificate). On your server, you can either trust the intermediate by itself, or a PEM bundle consisting of the intermediate CA first, then the root CA.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsmallstep%2Fstep-kms-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsmallstep%2Fstep-kms-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsmallstep%2Fstep-kms-plugin/lists"}