The Smallstep agent manages certificates for all your devices and workloads.

Before you begin

• Install the step CLI
• Install curl and polkitd packages
• Install the libpcsclite1 package (optional, for YubiKey support)
• Supported operating systems:
  • Enterprise Linux (RHEL, CentOS Stream, Rocky Linux, Alma Linux, etc)
  • Ubuntu (Current Stable and LTS releases)
  • Debian (Current Releases)
  • Fedora (Current Releases)
• We support amd64 and arm64 architectures
• The following directories are used by default:
  • runtime state in /run/step-agent
  • configuration in /etc/step-agent
  • certificates in/var/lib/step-agent and in your configured locations
• The agent will connect to the following Smallstep hosts:
  • Your CA: <your-team>.ca.smallstep.com and subdomains
  • Agent API: control.infra.smallstep.com
  • Smallstep API: gateway.smallstep.com
  • Device Attestation CA: att.smallstep.com (when device attestation is used)

Install the agent

You should have already installed the step command.

Now you’ll install the Smallstep agent.

Ansible Installation

See the ansible-collection-agent collection for installation and configuration instructions.

Binary Installation

Start by downloading and installing the step-agent-plugin binary:

curl -L -o step-agent-plugin dl.smallstep.com/step-agent-plugin/latest/step-agent-plugin_linux && sudo install -m 0755 -t /usr/bin step-agent-plugin

Next, create the agent user and systemd service unit: