🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Go to file
Mariano Cano b66a92ca41
Merge pull request #1414 from smallstep/herman/scep-provisioner-decrypter
Add SCEP provisioner decrypter
19 hours ago
.github [action] updated goCI workflow API (#1429) 4 months ago
acme chore(deps): upgrade github.com/go-chi/chi to v5 6 days ago
api Fix redacted tests 21 hours ago
authority Address review remarks 22 hours ago
autocert Use REAMDE.md suggested in code review. 4 years ago
ca Merge branch 'master' into herman/scep-provisioner-decrypter 4 days ago
cas Add namespace field to VaultCAS JSON config 4 months ago
cmd/step-ca bump go.mod to go1.20 and associated linter fixes (#1518) 4 weeks ago
commands Fix typo in flag usage 6 months ago
db Remove db datasource from error msg to prevent leaking of secrets (#1528) 2 weeks ago
debian Clean up Makefile and fix goreleaser deprecation 6 months ago
docker Trying a different approach 3 months ago
errs Fix err assert linter warnings - upgrade outdated package 12 months ago
examples Added some example ansible configs (#813) 2 years ago
logging bump go.mod to go1.20 and associated linter fixes (#1518) 4 weeks ago
monitoring Upgrade newrelic to v3 1 year ago
pki Add support for the disableSmallstepExtensions claim 2 months ago
policy address linter warning for go 1.19 5 months ago
scep Set SCEP authority options once 23 hours ago
scripts bump go.mod to go1.20 and associated linter fixes (#1518) 4 weeks ago
server Address gosec warnings 1 year ago
systemd Fixes #757 2 years ago
templates Ignore principals validations with OIDC 10 months ago
webhook Address code review remarks 4 days ago
.VERSION Added version operability for `git archive` tarball (non git repo) 5 years ago
.dockerignore Remove dockerignore files that are in the repo. 2 years ago
.gitattributes Added version operability for `git archive` tarball (non git repo) 5 years ago
.gitignore Add go workspaces files to gitignore 1 year ago
.gitleaksignore [actiono] Update workflows 1 year ago
.goreleaser.yml Only make PRs on releases, not release candidates 4 weeks ago
.version.sh Use sh instead of bash in .version.sh script 11 months ago
CHANGELOG.md Fix adding certificate templates with ASN.1 functions 2 months ago
CONTRIBUTING.md Trying a different approach 3 months ago
LICENSE Add full version of the license. 3 years ago
Makefile Update Makefile 3 months ago
README.md Update README.md 3 months ago
SECURITY.md Create SECURITY.md 1 year ago
cosign.pub [action] use cosign to sign over goreleaser artifacts 2 years ago
go.mod Merge branch 'master' into herman/scep-provisioner-decrypter 1 day ago
go.sum Merge branch 'master' into herman/scep-provisioner-decrypter 1 day ago
icon.png Commit icons. 4 years ago
icon.svg Commit icons. 4 years ago


Step Certificates

step-ca is an online certificate authority for secure, automated certificate management. It's the server counterpart to the step CLI tool.

You can use it to:

  • Issue X.509 certificates for your internal infrastructure:
    • HTTPS certificates that work in browsers (RFC5280 and CA/Browser Forum compliance)
    • TLS certificates for VMs, containers, APIs, mobile clients, database connections, printers, wifi networks, toaster ovens...
    • Client certificates to enable mutual TLS (mTLS) in your infra. mTLS is an optional feature in TLS where both client and server authenticate each other. Why add the complexity of a VPN when you can safely use mTLS over the public internet?
  • Issue SSH certificates:
    • For people, in exchange for single sign-on ID tokens
    • For hosts, in exchange for cloud instance identity documents
  • Easily automate certificate management:

Whatever your use case, step-ca is easy to use and hard to misuse, thanks to safe, sane defaults.

Don't want to run your own CA? To get up and running quickly, or as an alternative to running your own step-ca server, consider creating a free hosted smallstep Certificate Manager authority.

Questions? Find us in Discussions or Join our Discord.

Website | Documentation | Installation | Getting Started | Contributor's Guide

GitHub release Go Report Card Build Status License CLA assistant

GitHub stars Twitter followers

star us


🦾 A fast, stable, flexible private CA

Setting up a public key infrastructure (PKI) is out of reach for many small teams. step-ca makes it easier.

⚙️ Many ways to automate

There are several ways to authorize a request with the CA and establish a chain of trust that suits your flow.

You can issue certificates in exchange for:

🏔 Your own private ACME server

ACME is the protocol used by Let's Encrypt to automate the issuance of HTTPS certificates. It's super easy to issue certificates to any ACMEv2 (RFC8555) client.

👩🏽‍💻 An online SSH Certificate Authority

  • Delegate SSH authentication to step-ca by using SSH certificates instead of public keys and authorized_keys files
  • For user certificates, connect SSH to your single sign-on provider, to improve security with short-lived certificates and MFA (or other security policies) via any OAuth OIDC provider.
  • For host certificates, improve security, eliminate TOFU warnings, and set up automated host certificate renewal.

🤓 A general purpose PKI tool, via step CLI integration


See our installation docs here.