docs: correct the JumpCloud tutorial against the live consoles

[joshdrake]

Walked both consoles — the JumpCloud Admin Portal and the Smallstep
console — and fixed every step that did not match what an operator
actually sees.

JumpCloud console

Doc said	Actually
account menu "in the top right"	bottom left of the sidebar (your name)
"Windows Install Certificate" policy	Install Certificate
Software Management → "Private Repository"	➕ Add New → JumpCloud Private Repo
"Choose New Command"	➕ Command opens a three-option menu; pick the plain Command
"select Windows as the type"	Type defaults to Linux; selecting Windows auto-checks Windows PowerShell
—	Command Name is required and was never mentioned; suggest Configure Smallstep Agent
"Set the Launch Event"	the field is Event

Smallstep console

• The connection form takes a Name/Alias. Undocumented.
• The SHA-1 fingerprint is in the console. The doc claimed it "is not
  shown" and had the reader compute it with step or openssl and strip
  colons. The authority page has an Intermediate Fingerprint row with
  a sha256 / sha1 / md5 dropdown and a copy button; the value is
  already unbroken lowercase hex. Removed the CLI commands and the
  colon-stripping step.
  (The step command was also wrong — --sha1 requires --insecure.)
• Say plainly that CA ThumbPrint wants the intermediate, even
  though JumpCloud's tooltip calls it a root thumbprint. Verified against
  a working policy.
• The console has no "Intermediate CA common name" field to read. The
  issuer name is the Authority Name plus Intermediate CA.
• Restored the pre-October-2024 caveat that the Intune and Workspace ONE
  docs both carry, and linked the Authority list as every other tutorial
  does.
• The SCEP challenge is masked — reveal it, and it is 32 hex characters.
  Worth stating, so nobody copies the UUID that also appears on that page.
• Take the team slug from the console URL. (Settings → Team Settings did
  not finish loading on the tenant I checked; the URL is more robust
  anyway.)

Agent install and configuration

• Windows MSI now comes from
  releases.smallstep.com, per request.
  Worth flagging in review: every other tutorial links
  packages.smallstep.com/.../step-agent_amd64_latest.msi, so this is
  now the only one pointing elsewhere. There is a reason — JumpCloud
  Private Repo takes a specific versioned file, which a _latest URL
  does not give you — but it is a deliberate divergence.
• Replaced the jcagent.conf JSON parsing with JumpCloud's built-in
  {{device.id}} command variable, which resolves to the same system id
  that %JumpCloudSystemID% resolves to in the SCEP subject. Much
  shorter, and no dependency on the agent config file's location or
  shape. Quoted, so PowerShell does not try to execute the substituted id.

Conventions

• "Smallstep UI" → "Smallstep console" (error-level vale Branding rule;
  would have failed CI).
• Added JumpCloud to the vale vocabulary.
• Borrowed the wireless tutorial's stronger wording for the intermediate
  going into the Root store — it names the consequence.

Related

• smallstep/web#3054 adds the SCEP panel this doc now tells readers to
  copy the URL and challenge from.
• smallstep/inventory#598 adds the Name/Alias field.

Vale is not installed locally, so the substitution list was checked by
hand rather than run.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YYBwHCnG1u3JziQVuZgKY5

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}