More vale fixes

tashian · tashian · commit b1b1fe376002 · 2026-02-03T09:00:29.000-08:00
diff --git a/.vale/styles/Smallstep/Branding.yml b/.vale/styles/Smallstep/Branding.yml
@@ -16,3 +16,8 @@ swap:
   Yubikeys: YubiKeys
   yubikeys: YubiKeys
   YUBIKEYS: YubiKeys
+  on-premise: on-premises
+  On-premise: On-premises
+  on premise: on-premises
+  On Premise: On-premises
+  wire: Wire
diff --git a/.vale/styles/config/vocabularies/Smallstep/accept.txt b/.vale/styles/config/vocabularies/Smallstep/accept.txt
@@ -47,6 +47,7 @@ DTLS
 DevOps
 Diffie-Hellman
 Dockerfile
+Docker Compose
 EAB
 EAP
 ECDH
@@ -60,7 +61,10 @@ Encrypt
 Enrollment
 Entra ID
 FIPS
+F5 Access
+F5 Edge
 FQDN
+FreeBSD
 GCP
 Gartner
 GitHub
@@ -92,7 +96,9 @@ JWSs
 JWT
 JWTs
 Jamf
+Jamf Pro
 JavaScript
+Juniper Mist
 Kubernetes
 LDAP
 LTV
@@ -104,12 +110,14 @@ Merkle
 MicroTik
 Micromdm
 MikroTik
+Microsoft Edge
 Modbus
 Modelling
 NDES
 NDR
 NGINX
 NIST
+NixOS
 NSS
 NTP
 NTPS
@@ -313,6 +321,7 @@ Webhook
 Webhooks
 Wi
 Winget
+Wire
 Wireguard
 WjX
 Wolfi
@@ -676,6 +685,7 @@ ie
 ACLs
 Admin
 APIs
+Aruba
 apk
 Asus
 boolean
@@ -712,6 +722,7 @@ plist
 RAs
 rollout
 Sophos
+Sophos UTM
 SSIDs
 STMicro
 tss
@@ -870,6 +881,7 @@ reasonCode
 redirect_uri
 reverse_proxy
 root_ca_key
+root_ca
 sed
 select_account
 serverAuth
diff --git a/certificate-manager/acme/how-to-use-acme.mdx b/certificate-manager/acme/how-to-use-acme.mdx
@@ -9,7 +9,7 @@ With Smallstep Certificate Manager
 you can deploy ACME on your internal network with ease.
 Before deploying,
 it's important to consider what deployment options works best for your organization,
-which include our hosted as well as our on-premise solutions.
+which include our hosted as well as our on-premises solutions.
 For each of those,
 it may be necessary to also deploy a Registration Authority (RA),
 which ensures ACME clients can be challenged on the internal network
@@ -31,7 +31,7 @@ With Smallstep Certificate Manager,
 you can deploy ACME on your internal network with ease.
 It is possible to use our hosted solution,
 or you can deploy the Smallstep platform to your own infrastructure
-using our on-premise solution.
+using our on-premises solution.
 These options are described below.
 
 #### Hosted
@@ -69,7 +69,7 @@ providing control over what domains are allowed to request a certificate,
 or by requiring External Account Binding (EAB) to be used,
 so that only known ACME clients can request a certificate.
 
-#### On-premise
+#### On-premises
 
 It is also possible to deploy the Smallstep platform to your own infrastructure.
 If your infrastructure
diff --git a/certificate-manager/acme/when-to-use-acme.mdx b/certificate-manager/acme/when-to-use-acme.mdx
@@ -34,7 +34,7 @@ The below listing is an overview of exemplary scenarios in which the ACME protoc
     The ACME protocol is primarily well-suited for use cases that are similar as to how the Web PKI is used.
     This means it can be used for issuing certificates to internal workloads, including databases, proxies and queues.
     With the Smallstep platform, certificates issued using ACME are not recorded in a Certificate Transparency log, keeping your internal infrastructure confidential.
-    It is also possible to deploy ACME with an on-premise deployment of the Smallstep platform, to be in full control over the system or to be used in airgapped networks, for example.
+    It is also possible to deploy ACME with an on-premises deployment of the Smallstep platform, to be in full control over the system or to be used in airgapped networks, for example.
 - An environment requiring certificates for Mutual TLS, such as a service mesh.
     This use case is similar as the one above, but this time also includes client side authentication using a certificate.
     Considering the clients in those environments are often primarily concerned with infrastructural concerns, they can be issued a client certificate using ACME if they can solve challenges.
diff --git a/certificate-manager/kubernetes-tls/kubernetes-autocert.mdx b/certificate-manager/kubernetes-tls/kubernetes-autocert.mdx
@@ -42,7 +42,7 @@ step ca provisioner add autocert --create
 
 You’ll be asked to provide a password to encrypt the provisioner private key.
 
-## Create configmaps and a secret for Autocert
+## Create ConfigMaps and a secret for Autocert
 
 In Kubernetes, create a namespace for autocert:
 
diff --git a/certificate-manager/kubernetes-tls/kubernetes-install.mdx b/certificate-manager/kubernetes-tls/kubernetes-install.mdx
@@ -20,7 +20,7 @@ We think issuing a one-year certificate and moving on is setting you up for pain
 In fact, we [blogged about a better way](https://smallstep.com/blog/kubernetes-the-secure-way) and created a pull request to Hightower's repo. 
 You should certainly check it out if you are building a Kubernetes cluster from scratch.
 
-### Extra credit: Ad__phrase_12__lers
+### Extra credit: Admission Controllers
 
 An *[Admission Controller](https://kubernetes.io/blog/2019/03/21/a-guide-to-kubernetes-admission-controllers/)* is a plugin that can intercept calls to the Kubernetes API server and modify the request or reject it altogether. 
 For example, the `autocert` project also uses a *mutating* Admission Controller to inject a secret into the Pod-spec during Pod creation. 
diff --git a/registration-authorities/acme-for-cas.mdx b/registration-authorities/acme-for-cas.mdx
@@ -140,7 +140,7 @@ gcloud privateca subordinates describe example-intermediate-ca \
       --role=roles/privateca.certificateRequester
   ```
 
-#### 7. Launch a "smallstep ACME registration authority for CAS" deployment
+#### 7. Launch a "Smallstep ACME registration authority for CAS" deployment
 
 1. Select "Smallstep ACME Registration Authority for CAS" from GCP marketplace
 and hit the `Launch` button.
diff --git a/ssh/how-it-works.mdx b/ssh/how-it-works.mdx
@@ -103,7 +103,7 @@ The Smallstep SSH SaaS offering includes a hosted certificate authority and a se
 
 ### Smallstep SSH run anywhere
 
-The same offering is available in an on-premise configuration that brings the simplicity of a SaaS offering with a private deployment's control and security. Smallstep SSH Run Anywhere installs in Kubernetes and integrates with your existing HSM for storage of private keys. [Contact Us](https://smallstep.com/pricing-question) for more information.
+The same offering is available in an on-premises configuration that brings the simplicity of a SaaS offering with a private deployment's control and security. Smallstep SSH Run Anywhere installs in Kubernetes and integrates with your existing HSM for storage of private keys. [Contact Us](https://smallstep.com/pricing-question) for more information.
 
 ## Setup and configuration
 
diff --git a/step-ca/installation.mdx b/step-ca/installation.mdx
@@ -172,7 +172,7 @@ Community-maintained packages for NixOS are available:
 - [`step-ca`](https://search.nixos.org/packages?show=step-ca&from=0&size=50&sort=relevance&query=step-ca)
 - [`step-cli`](https://search.nixos.org/packages?show=step-cli&from=0&size=50&sort=relevance&query=step-cli)
 
-#### Freebsd
+#### FreeBSD
 
 Community-maintained packages for FreeBSD are available:
 - [`step-certificates`](https://www.freshports.org/security/step-certificates/)
diff --git a/step-ca/provisioners.mdx b/step-ca/provisioners.mdx
@@ -613,7 +613,7 @@ Valid from:  2019-06-20T18:21:52Z
         to:  2019-06-21T18:21:52Z`}
 </CodeBlock>
 
-#### Configuring your identity provider (idp)
+#### Configuring your identity provider (IdP)
 
 When creating an OAuth app, there isn't much to configure on the IdP.
 Most providers will ask you to specify a Redirect URI, where the ID token will be delivered at the end of the OAuth flow.
@@ -1152,7 +1152,7 @@ TPMs also have privacy constraints and a wide range of use case-specific validat
   </div>
 </Alert>
 
-#### ACME for wire messenger clients
+#### ACME for Wire messenger clients
 
 <Alert severity="warning">
   <div> 
@@ -1450,7 +1450,7 @@ but _you cannot assume that the names on the certificate are authentic_.
 
 Because of this, every host in your infrastructure must be trusted.
 
-#### Mitigating the risk of iids
+#### Mitigating the risk of IIDs
 
 Here are some things you can do to mitigate risk when using IIDs:
 - **Configure the provisioner with `instanceAge`.**
diff --git a/step-cli/basic-crypto-operations.mdx b/step-cli/basic-crypto-operations.mdx
@@ -131,7 +131,7 @@ If you don't want `step` to run a standalone server to respond to the ACME chall
 
 For a dry run, you can use Let's Encrypt's staging server URL: `https://acme-staging-v02.api.letsencrypt.org/directory`
 
-## Generate JSON web tokens (JWTs) and JSON Web Keys (JWKs)
+## Generate JSON Web Tokens (JWTs) and JSON Web Keys (JWKs)
 
 The following command groups work with JOSE objects like JWTs and JWEs:
 * [`step crypto jwt`](./reference/crypto/jwt)
diff --git a/step-cli/installation.mdx b/step-cli/installation.mdx
@@ -126,7 +126,7 @@ Big shout out to the maintainers of these packages! We appreciate you.
 
 Install the [`step-cli`](https://search.nixos.org/packages?channel=20.09&show=step-cli&from=0&size=50&sort=relevance&query=step-cli) package on NixOS.
 
-#### Freebsd
+#### FreeBSD
 
 Install the [`step-cli`](https://www.freshports.org/security/step-cli/) package on FreeBSD.
 
diff --git a/tutorials/browser-certificate-setup-guide.mdx b/tutorials/browser-certificate-setup-guide.mdx
@@ -149,7 +149,7 @@ To test the certificate, restart the browser and visit one your target URLs.
 
 ## Windows
 
-### Microsoft edge and Google Chrome
+### Microsoft Edge and Google Chrome
 
 #### Client certificate auto-selection
 
diff --git a/tutorials/configure-enterprise-relay.mdx b/tutorials/configure-enterprise-relay.mdx
@@ -33,7 +33,7 @@ You can download the Accounts Root CA certificate from your [Authorities](https:
 - **Client Certificate**: An [ACMECertificate MDM payload](https://support.apple.com/guide/deployment/automated-certificate-management-environment-depb95c66a07/web) is used to obtain a client certificate for accessing the Relay.
 - **Relay Configuration**: The Relay is configured using a [Relay MDM payload](https://developer.apple.com/documentation/devicemanagement/relay)
 
-## Example: Jamf pro configuration profile
+## Example: Jamf Pro configuration profile
 
 In this example, we’ll use Jamf Pro to configure endpoints connecting to a Smallstep Relay.
 
diff --git a/tutorials/connect-jamf-pro-to-smallstep.mdx b/tutorials/connect-jamf-pro-to-smallstep.mdx
@@ -37,7 +37,7 @@ Limitations:
 
 ## Step-by-step instructions
 
-## Create an API client in Jamf pro
+## Create an API client in Jamf Pro
 
 This API client will allow Smallstep to read your Jamf device inventory and manage the webhooks necessary for ongoing inventory syncing.
 
@@ -56,7 +56,7 @@ This API client will allow Smallstep to read your Jamf device inventory and mana
 6. Choose **Generate client secret**
 7. Temporarily save the **Client ID** and **Client Secret**. You’ll use them in the next step.
 
-## Connect Jamf pro to Smallstep
+## Connect Jamf Pro to Smallstep
 
 Let’s add the Jamf Pro API credentials you just created to Smallstep.
 
@@ -66,7 +66,7 @@ Let’s add the Jamf Pro API credentials you just created to Smallstep.
 4. Choose **Add Platform**. Your device inventory will start syncing from Jamf to Smallstep.
 5. Temporarily save the **Webhook URL**, **Username**, and **Password** presented.
 
-## Configure a SCEP enrollment webhook in Jamf pro
+## Configure a SCEP enrollment webhook in Jamf Pro
 
 For compatibility reasons, Smallstep may use ACME or SCEP for certificate enrollment. The SCEP Enrollment webhook allows Jamf to request a dynamic, short-lived challenge string from Smallstep during the SCEP request. The challenge string is injected into the [SCEP payload](https://developer.apple.com/documentation/devicemanagement/scep) for your clients to authenticate to Smallstep.
 
@@ -270,7 +270,7 @@ There's two ways to confirm installation on an endpoint:
 - Alternatively, on the device itself, run `/Applications/SmallstepAgent/Contents/MacOS/SmallstepAgent version` to see that the agent is installed. And, in **System Settings**, check **Login Items** to confirm that there is a **Smallstep Agent** entry.
 
 
-## Uninstall Smallstep agent with Jamf pro
+## Uninstall Smallstep agent with Jamf Pro
 
 You can easily remove a Smallstep Agent that was installed on macOS endpoints via Jamf Pro.
 
diff --git a/tutorials/keycloak-oidc-provisioner.mdx b/tutorials/keycloak-oidc-provisioner.mdx
@@ -30,7 +30,7 @@ which is especially useful for issuing X.509 client authentication certificates
 - You'll need a Docker environment, and Docker Compose version 3+.
 - You'll need a hostname and TLS certificate files for your Keycloak instance.
 
-## Install and run Keycloak + MySQL using Docker compose
+## Install and run Keycloak + MySQL using Docker Compose
 
 First let's get Keycloak running.
 The OIDC provisioner in `step-ca` requires that our Keycloak instance run with TLS,
diff --git a/tutorials/vpn-client-setup-guide.mdx b/tutorials/vpn-client-setup-guide.mdx
@@ -30,7 +30,7 @@ For Apple devices using MDM, see [VPN settings overview for Apple devices](https
 For Windows, see [Connect to a VPN in Windows](https://support.microsoft.com/en-us/windows/connect-to-a-vpn-in-windows-3d29aeb1-f497-f6b7-7633-115722c1009c)
 
 
-## F5 edge and F5 access clients
+## F5 Edge and F5 Access clients
 
 Intended audience: Enterprise IT administrators
 Estimated time commitment: 1 hour
diff --git a/tutorials/vpn-setup-guide-strongswan.mdx b/tutorials/vpn-setup-guide-strongswan.mdx
@@ -1,13 +1,13 @@
 ---
 title: Configure strongSwan VPN With Smallstep
 updated_at: February 03, 2026
-html_title: StrongSwan VPN with Certificates Guide
-description: Configure StrongSwan VPN using Smallstep certificates. Secure remote access with certificate-based authentication for enterprises.
+html_title: strongSwan VPN with Certificates Guide
+description: Configure strongSwan VPN using Smallstep certificates. Secure remote access with certificate-based authentication for enterprises.
 ---
 
 This configuration was tested with strongSwan 5.9.13.
 
-### Configure strongswan to accept Smallstep-issued client certificates
+### Configure strongSwan to accept Smallstep-issued client certificates
 
 In this section, you'll configure strongSwan to use full EAP-TLS client authentication with Smallstep client certificates.
 
@@ -34,7 +34,7 @@ For testing, you can get a certificate from the Accounts CA using the Smallstep
 
 To deploy and manage certificates for strongSwan to all your VPN clients, you can use MDM or the Smallstep agent app.
 
-### Configure strongswan with a server TLS certificate
+### Configure strongSwan with a server TLS certificate
 
 In this section, you'll configure a strongSwan Server TLS certificate issued from your Smallstep CA.
 
diff --git a/tutorials/wifi-setup-guide.mdx b/tutorials/wifi-setup-guide.mdx
