step-ca
What it is
step-ca is an online Certificate Authority for automating X.509 and SSH certificate management. It issues X.509 certificates for TLS, mutual TLS, document signing, and authentication, along with SSH certificates for users and hosts. Provisioners can authorize issuance through ACME challenges, OIDC tokens, cloud instance identity documents, or short-lived JWK tokens. The software supports automated issuance and renewal, plus passive revocation, for clients, servers, and Kubernetes workloads. Templates can customize names and identifiers, restrict domains or key sizes, and create longer certificate chains. For signing-key protection, step-ca integrates with Google Cloud KMS, AWS KMS, Azure Key Vault, PKCS#11 HSMs, TPM 2.0, and YubiKey PIV. Its architecture uses an offline root CA and a configured intermediate CA to issue end-entity certificates. Installation options cover macOS, Windows, Linux, Kubernetes, and Docker. The open-source plan is free, with a single configured intermediate CA and an offline root. Community support is available through Discord; Smallstep offers dedicated support contracts.
For and against
For
- Automates issuance and renewal for X.509 and SSH certificates.
- Supports ACME, SCEP, OIDC, and cloud identity methods.
- Integrates with cloud KMS, HSMs, TPM 2.0, and YubiKey PIV.
- Can issue certificates for Kubernetes workloads.
Against
- Active revocation support is limited.
- No certificate history or metrics are documented.
- No ACME External Account Binding is available.
- Free plan has no Certificate Transparency integration.
The verdict
step-ca provides a free, self-hosted route to automated X.509 and SSH certificate management, with integrations for issuance and signing-key protection. Teams should account for its documented gaps, including limited active revocation and the absence of certificate history and metrics.
Who it suits
step-ca suits DevOps teams managing private certificates for VMs, containers, APIs, databases, Kubernetes pods, and people. It is also relevant for teams needing SSH certificates or integrations with identity systems and key-protection hardware.
Plans and prices
step-ca open source
self-hosted two-tier CA · passive revocation · single intermediate CA
Read 14 Oct 2026 · smallstep.com
step-ca (open source)
single configured intermediate CA · offline root CA · authority-wide issuance policies · no Certificate Transparency integration
Read 30 Sep 2026 · github.com
Smallstep Platform
ACME device attestation · SSH · certificate Wi-Fi · VPN/ZTNA
Read 14 Oct 2026 · smallstep.com
On the record
- ACME server
- step-ca provides a private ACME server compatible with ACMEv2 clients and common HTTP-01, DNS-01 and TLS-ALPN-01 challenges.github.com · read 14 Oct 2026
- API and SDK
- The project includes a Go wrapper and a command-line client, while a seamless infrastructure-as-code API is listed as a commercial-product feature.github.com · read 14 Oct 2026
- Architecture
- step-ca is designed around a two-tier PKI with one offline root CA and one configured intermediate CA issuing end-entity certificates.smallstep.com · read 30 Sep 2026
- Automated renewal
- The system automates certificate enrollment and renewal and uses passive revocation for short-lived certificates.smallstep.com · read 14 Oct 2026
- Binary architectures
- Precompiled Linux binaries are published for amd64, arm64, armv6, armv7, mips, mips64, ppc64le and 386.smallstep.com · read 14 Oct 2026
- Certificate automation
- step-ca supports automated certificate issuance, renewal and passive revocation for clients, servers and Kubernetes workloads.smallstep.com · read 30 Sep 2026
- Company facts
- LinkedIn lists Smallstep as privately held, founded in 2016, headquartered in San Francisco and employing 11–50 people.linkedin.com · read 14 Oct 2026
- Company legal name
- Crunchbase lists the legal entity as Smallstep Labs, Inc.crunchbase.com · read 14 Oct 2026
- Database backends
- State storage supports embedded Badger and BoltDB plus MySQL and PostgreSQL key-value backends.smallstep.com · read 14 Oct 2026
- Databases
- Its configurable database backends include Badger, BoltDB, MySQL and PostgreSQL.smallstep.com · read 30 Sep 2026
- Documentation depth
- Official materials include command references, configuration, provisioners, templates, production guidance, renewal, revocation, integrations and tutorials.smallstep.com · read 14 Oct 2026
- Funding
- Crunchbase lists a private Series A and seven investors, including boldstart ventures and Upside Partnership.crunchbase.com · read 14 Oct 2026
- Independent technical assessment
- DEV.co characterizes deployment complexity as moderate and documentation as strong, while noting that root-key protection remains the operator’s responsibility.dev.co · read 14 Oct 2026
- Installation
- Official installation options cover macOS Homebrew, Windows Winget or Scoop, Linux packages and binaries, Kubernetes and Docker.smallstep.com · read 30 Sep 2026
- Integrations
- Documented integrations include Kubernetes cert-manager, Envoy SDS, ACME clients, OIDC providers, PKCS#11, Google Cloud KMS, AWS KMS and YubiKey PIV.smallstep.com · read 14 Oct 2026
- Key algorithms
- Supported certificate key types include RSA, ECDSA and EdDSA, with configurable lifetimes.smallstep.com · read 14 Oct 2026
- Key protection
- It integrates with Google Cloud KMS, AWS KMS, Azure Key Vault, PKCS#11 HSMs, TPM 2.0 and YubiKey PIV for CA signing-key protection.smallstep.com · read 30 Sep 2026
- License
- The certificates repository is distributed under the Apache-2.0 license.github.com · read 14 Oct 2026
