Problem creating EAB credentials...

[wraythex]

Hello,

I have recently downloaded and installed step-ca and step-cli following these instructions:
https://smallstep.com/docs/step-cli/installation/#rhelfedora

I ran into an error during installation where the gpgkey wasn't accepted. But, I used the --nogpgcheck flag for yum/dnf and it installed without issue.

I then followed the smallstep instructions for creating a ca, moving the files to /etc/, and running it as a service.

I want to make sure I am running this securely, so I believe I need to create EAB credentials for my ACME provisioner.

I was able to add the "requireEAB" option to my ACME provisioner.

However, I ran into the following error when trying to create an EAB credential on my ACME provisioner:
(per instructions here: https://smallstep.com/blog/acme-eab-overview/ )

$ sudo step ca acme eab add my-acme
No admin credentials found. You must login to execute admin commands.
? Please enter admin name/subject (e.g., name@example.com): <admin-user/email-address>
? Provisioner: <admin-user/email-address> (JWK) [kid: %kid%]
Please enter the password to decrypt the provisioner key: %password%
error creating ACME EAB key: json: cannot unmarshal number into Go value of type ca.AdminClientError

Can anyone help me troubleshoot this error? Please let me know if there is any other information I can provide to help fix this issue. Thanks for any help you can provide.

---

Here is the yum info on the packages I have installed:
step-ca.x86_64 0.30.2-1 @smallstep
step-cli.x86_64 0.30.6-1 @smallstep

The version numbers from the programs are:
$ step --version
Smallstep CLI/0.30.6 (linux/amd64)
Release Date: 2026-06-10T20:39:13Z

$ step-ca --version
Smallstep CA/0.30.2 (linux/amd64)
Release Date: 2026-03-23T00:18:00Z

$ step-cli --version
Smallstep CLI/0.30.6 (linux/amd64)
Release Date: 2026-06-10T20:39:13Z

Here is most of the configuration from my ca.json file:

"provisioners": [
  {
    "type": "JWK",
    "name": "<admin-user/email-address>",
    "key": {
      "use": <snip>,
      "kty": <snip>,
      "kid": <snip>,
      "crv": <snip>,
      "alg": <snip>,
      "x": <snip>,
      "y": <snip>,
    },
    "encryptedKey": <snip>
  },
  {
    "type": "ACME",
    "name": "my-acme",
    "requireEAB": true,
    "claims": {
      "enableSSHCA": true,
      "disableRenewal": false,
      "allowRenewalAfterExpiry": false,
      "disableSmallstepExtensions": false
    },
    "options": {
      "x509": {},
      "ssh": {}
    }
  }
],
"template": {},
"claims": {
  "minTLSCertDuration": "5m0s",
  "maxTLSCertDuration": "2160h0m0s",
  "defaultTLSCertDuration": "2160h0m0s",
  "disableRenewal": false,
  "allowRenewalAfterExpiry": false
},
"policy": {
  "x509": {
    "allow": {
      "dns": [
        "*.local.domain"
      ],
      "ip": [
        "subnet1.0/24",
        "subnet2.0/24"
      ],
      "email": [
        "<admin-user/email-address>"
      ]
    }
  }
},
"crl": {
  "enabled": true,
  "cacheDuration": "24h0m0s",
  "idpURL": "http://ca.local.domain/1.0/crl"
}

[hslatman]

Hey @wraythex,

I believe the error you're getting is because Remote Management may not be enabled. Try adding "enableAdmin": true, to the authority object in your ca.json. Also see https://smallstep.com/docs/step-ca/provisioners/#enable-remote-provisioner-management.

That said, managing EAB credentials is currently not supported in open source. It is supported in Step CA Pro, and in our hosted offerings.

[wraythex]

Hey hslatman,

Thank you for that suggestion. When I enable that option I get different error messages depending on the option I choose:

$ sudo step ca acme eab add my-acme
No admin credentials found. You must login to execute admin commands.
? Please enter admin name/subject (e.g., name@example.com): <admin-user/email-address>
Use the arrow keys to navigate:
What provisioner key do you want to use?
  > my-acme (ACME)
    <admin-user/email-address> (JWK) [kid: %kid%]

If I choose the first option (ACME) I get this error message:

$ sudo step ca acme eab add my-acme
No admin credentials found. You must login to execute admin commands.
? Please enter admin name/subject (e.g., name@example.com): <admin-user/email-address>
? Provisioner: my-acme (ACME)
error creating admin client: step ACME provisioners do not support token auth flows

And if I choose the second option (JWK) I get this error message:

$ sudo step ca acme eab add my-acme
No admin credentials found. You must login to execute admin commands.
? Please enter admin name/subject (e.g., name@example.com): <admin-user/email-address>
? Provisioner: <admin-user/email-address> (JWK) [kid: %kid%]
Please enter the password to decrypt the provisioner key:
error creating ACME EAB key: adminHandler.authorizeToken; unable to load admin with subject(s) [<admin-user/email-address> <admin-user/email-address>] and provisioner '<admin-user/email-address>'

I'm guessing I should be adding this to the ACME option, right? Does the error "step ACME provisioners do not support token auth flows" come from the thing you said about "EAB credentials is currently not supported in open source"? ie, is EAB disabled/not-available in the open source version, or is it enabled/available but not supported whether it works or not in the open source version?

Is there any way to secure this open source step-ca to restrict the creation of certificates through the ACME (or SCEP) process to authorized users?

Also, why would this need "Remote Management"? That makes it sound like other computers can control the settings of the step-ca running on one computer, when I am wanting to keep control of step-ca restricted to the computer that it is installed on.

Thanks for your help and any insights you can provide to these other questions.

[hslatman]

Hey hslatman,

The default admin user name is step. The first JWK provisioner is assumed to be the 'admin" provisioner that provides the admin credentials.

I'm guessing I should be adding this to the ACME option, right? Does the error "step ACME provisioners do not support token auth flows" come from the thing you said about "EAB credentials is currently not supported in open source"? ie, is EAB disabled/not-available in the open source version, or is it enabled/available but not supported whether it works or not in the open source version?

That error shows because the ACME provisioner was attempted to sign a token. That's not supported on ACME provisioners. It is on JWK provisioners.

ACME EAB is not supported in open source, so after you get the authentication correct, you'll get a message indicating that.

Is there any way to secure this open source step-ca to restrict the creation of certificates through the ACME (or SCEP) process to authorized users?

It's possible to configure webhooks to call into a webhook server that you manage. That also works for SCEP. It's also possible to use dynamic challenges with SCEP through webhooks.

Also, why would this need "Remote Management"? That makes it sound like other computers can control the settings of the step-ca running on one computer, when I am wanting to keep control of step-ca restricted to the computer that it is installed on.

We decided it was best to make it available through Remote Management only. ACME EAB requires managing some state that doesn't fit nicely in ca.json, and was close to how we stored provisioners in the database with Remote Management enabled. Remote Management means that some resources (admins, provisioners, and ACME EAB credentials) are managed through an API instead of (re)writing (to) the ca.json. It requires authenticating (using the first JWK provisioner), so you'd still be in control over who/what can make changes to certain parts of the configuration.

Thanks for your help and any insights you can provide to these other questions.

👍