Skip to content

Specify time duration format #451

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tashian merged 1 commit into from
Nov 4, 2025
Merged

Specify time duration format #451

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 11 additions & 11 deletions step-ca/configuration.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
---
updated_at: September 18, 2025
updated_at: November 03, 2025
title: Configuring step-ca
html_title: Configuring open source step-ca
description: Learn how to configure step-ca
Expand Down Expand Up @@ -256,31 +256,31 @@ the `--password-file` flag accepts

- **policy**: authority-wide policy for certificate identifiers. See [Policies](./policies.mdx).

- **disableIssuedAtCheck**: ☠️ disable a check verifying that provisioning tokens must be issued after the CA has booted. This claim is one prevention against token reuse. The default value is false. Do not change this unless you know what you are doing.
- **disableIssuedAtCheck**: ☠️ disable a check verifying that provisioning tokens must be issued after the CA has booted. This claim is one prevention against token reuse. The default value is false. Do not change this unless you know what you are doing. All time duration values follow [Go's `time.Duration` string format](https://pkg.go.dev/time#ParseDuration).

- **claims**: default validation for requested attributes in the certificate request. Can be overridden by similar claims objects defined by individual provisioners.

- **minTLSCertDuration**: do not allow certificates with a duration less than this value.
- **minTLSCertDuration**: do not allow TLS certificates with a duration less than this value.

- **maxTLSCertDuration**: do not allow certificates with a duration greater than this value.
- **maxTLSCertDuration**: do not allow TLS certificates with a duration greater than this value.

- **defaultTLSCertDuration**: if no certificate validity period is specified, use this value.
- **defaultTLSCertDuration**: if no TLS certificate validity period is specified, use this value.

- **disableRenewal**: do not allow any certificates to be renewed. The default is false.

- **allowRenewalAfterExpiry**: ☠️ allow expired certificates to be renewed. The default is false. This option adds security risk; proceed with caution and consider alternatives.

- **minUserSSHCertDuration**: do not allow certificates with a duration less than this value.
- **minUserSSHCertDuration**: do not allow SSH user certificates with a duration less than this value.

- **maxUserSSHCertDuration**: do not allow certificates with a duration greater than this value.
- **maxUserSSHCertDuration**: do not allow SSH user certificates with a duration greater than this value.

- **defaultUserSSHCertDuration**: if no certificate validity period is specified, use this value.
- **defaultUserSSHCertDuration**: if no SSH user certificate validity period is specified by the client, use this value.

- **minHostSSHCertDuration**: do not allow certificates with a duration less than this value.
- **minHostSSHCertDuration**: do not allow SSH host certificates with a duration less than this value.

- **maxHostSSHCertDuration**: do not allow certificates with a duration greater than this value.
- **maxHostSSHCertDuration**: do not allow SSH host certificates with a duration greater than this value.

- **defaultHostSSHCertDuration**: if no certificate validity period is specified, use this value.
- **defaultHostSSHCertDuration**: if no SSH host certificate validity period is specified by the client, use this value.

- **enableSSHCA**: enable this provisioner to generate SSH Certificates. The default value is false.

Expand Down