[darkfronza]

Summary

platform/credential-files.mdx now covers the PKCS12 and PKCS12_LEGACY key formats, which API 2026-11-01 accepts again (smallstep/api#159, smallstep/gateway#651).

• Field reference: format lists both values. A short paragraph explains what they produce:
  • the key file in PKCS#8;
  • service.p12 and password.txt in the agent's directory for the credential, even when key.path is set, with the key file's permissions;
  • the encryption each value uses.
• Permissions: the bundle and password take the key file's permissions:
  • Linux and macOS: the key's owner, group, mode and ACL entries;
  • Windows with an acl on the key: the key's access list;
  • Windows without one: they inherit the agent's folder, which grants only SYSTEM and the Administrators, the same access as the key's default list.
• Windows access: the agent's folder can't be listed by other accounts, so a granted account opens the files by full path. File pickers and type in cmd are denied. Both were checked on a Windows device.
• Rules: both require protection: NONE, and under windows they also require store: MACHINE. A Windows user-scope key is held by the user's session, and the agent can't put it in a bundle.

vale adds nothing new; its two warnings on this page were already there.

Merge after smallstep/gateway#651 is deployed.

Fixes EFF-1134.

🤖 Generated with Claude Code