This provider manages step-ca-pro provisioners and
provisioner webhooks through the CA's admin API, which is always enabled on
step-ca-pro. Provisioner configuration becomes declarative HCL: create,
update, import, and drift-detect provisioners of every supported type, plus
their webhooks, without touching ca.json or the step CLI.
- Terraform >= 1.5
This provider is currently in beta. Prereleases never match unqualified version ranges, so pin the exact version:
terraform {
required_providers {
stepca = {
source = "smallstep/step-ca-pro"
version = "0.1.0-beta.1" # prereleases never match version ranges — pin exactly
}
}
}
# JWK auth: bootstrap admin access from a provisioner name + password.
provider "stepca" {
# Path to your step-ca-pro license bundle — the same file the CA server
# reads. May also be set via the STEPCA_LICENSE_FILE environment variable.
license_file = "/etc/step-ca-pro/license.crt"
ca_url = "https://ca.internal:9000"
root = file("root_ca.crt")
jwk_provisioner = {
name = "admin"
password = var.admin_provisioner_password
admin_subject = "step"
}
}This provider is a commercial feature of step-ca-pro and requires a valid
step-ca-pro license to operate. Point license_file (or the
STEPCA_LICENSE_FILE environment variable) at your license bundle — the
same file step-ca-pro start --license-file reads. The check is fully
offline; nothing is transmitted. The provider fails to configure without a
valid license and warns 30 days before expiry.
To obtain a step-ca-pro license, contact Smallstep at smallstep.com.
Full provider documentation is published on the Terraform Registry at registry.terraform.io/providers/smallstep/step-ca-pro/latest/docs. This page goes live with the first release.
This repository distributes releases and documentation for a commercial product; the source is not public. Report issues here or via support.smallstep.com.