🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Go to file
github-actions[bot] 8b36f7bc11
Merge pull request #1878 from smallstep/dependabot/go_modules/google.golang.org/api-0.183.0
Bump google.golang.org/api from 0.182.0 to 0.183.0
1 day ago
.github Bump dependabot/fetch-metadata from 2.0.0 to 2.1.0 1 month ago
acme Merge branch 'master' into mariano/account-provisioner 4 weeks ago
api Use a function as the error logger 4 weeks ago
authority Update hardcoded AWS certs (#1881) 1 day ago
autocert Use REAMDE.md suggested in code review. 5 years ago
ca Log errors using slog.Logger 4 weeks ago
cas Merge pull request #1850 from smallstep/mariano/signer 3 weeks ago
cmd/step-ca Enable tpmkms. 3 months ago
commands Let the CA determine the RA lifetime 3 months ago
db Let the CA determine the RA lifetime 3 months ago
debian Clean up Makefile and fix goreleaser deprecation 1 year ago
docker Update Dockerfile.hsm to use Debian bookworm 6 months ago
errs Let the CA determine the RA lifetime 3 months ago
examples Сorrection of spelling errors 4 months ago
internal chore: fix function names in comment (#1813) 2 months ago
logging Make the `requestid` an exported middleware 3 months ago
middleware/requestid Add package comment 3 months ago
monitoring Make the `requestid` an exported middleware 3 months ago
pki Add some basic tests for `GenerateConfig` 8 months ago
policy chore: fix function names in comment (#1813) 2 months ago
scep Log errors using slog.Logger 4 weeks ago
scripts Merge pull request #1719 from smallstep/carl/fix-ra-install 3 months ago
server Address gosec warnings 2 years ago
systemd Fixes #757 3 years ago
templates Ignore principals validations with OIDC 2 years ago
test/integration Remove leftover debug print 2 months ago
webhook Add `provisionerName` to webhook request body 7 months ago
.VERSION Added version operability for `git archive` tarball (non git repo) 5 years ago
.dockerignore Remove dockerignore files that are in the repo. 3 years ago
.gitattributes Added version operability for `git archive` tarball (non git repo) 5 years ago
.gitignore Add go workspaces files to gitignore 2 years ago
.goreleaser.yml Fix winget release URL 2 months ago
.version.sh Use sh instead of bash in .version.sh script 2 years ago
CHANGELOG.md Add changelog for 0.26.1 (#1812) 2 months ago
CONTRIBUTING.md Trying a different approach 12 months ago
LICENSE Add full version of the license. 4 years ago
Makefile Update Makefile 11 months ago
README.md Updated README 4 months ago
SECURITY.md Create SECURITY.md 2 years ago
cosign.pub [action] use cosign to sign over goreleaser artifacts 3 years ago
go.mod Merge branch 'master' into dependabot/go_modules/google.golang.org/api-0.183.0 1 day ago
go.sum Merge branch 'master' into dependabot/go_modules/google.golang.org/api-0.183.0 1 day ago
icon.png Commit icons. 5 years ago
icon.svg Commit icons. 5 years ago



GitHub release Go Report Card Build Status License CLA assistant

step-ca is an online certificate authority for secure, automated certificate management for DevOps. It's the server counterpart to the step CLI tool for working with certificates and keys. Both projects are maintained by Smallstep Labs.

You can use step-ca to:

  • Issue HTTPS server and client certificates that work in browsers (RFC5280 and CA/Browser Forum compliance)
  • Issue TLS certificates for DevOps: VMs, containers, APIs, database connections, Kubernetes pods...
  • Issue SSH certificates:
    • For people, in exchange for single sign-on identity tokens
    • For hosts, in exchange for cloud instance identity documents
  • Easily automate certificate management:

Comparison with Smallstep's commercial product

step-ca is optimized for a two-tier PKI serving common DevOps use cases.

As you design your PKI, if you need any of the following, consider our commerical CA:

  • Multiple certificate authorities
  • Active revocation (CRL, OSCP)
  • Turnkey high-volume, high availability CA
  • An API for seamless IaC management of your PKI
  • Integrated support for SCEP & NDES, for migrating from legacy Active Directory Certificate Services deployments
  • Device identity — cross-platform device inventory and attestation using Secure Enclave & TPM 2.0
  • Highly automated PKI — managed certificate renewal, monitoring, TPM-based attested enrollment
  • Seamless client deployments of EAP-TLS Wi-Fi, VPN, SSH, and browser certificates
  • Jamf, Intune, or other MDM for root distribution and client enrollment
  • Web Admin UI — history, issuance, and metrics
  • ACME External Account Binding (EAB)
  • Deep integration with an identity provider
  • Fine-grained, role-based access control
  • FIPS-compliant software
  • HSM-bound private keys

See our full feature comparison for more.

You can start a free trial or set up a call with us to learn more.

Questions? Find us in Discussions or Join our Discord.

Website | Documentation | Installation | Contributor's Guide


🦾 A fast, stable, flexible private CA

Setting up a public key infrastructure (PKI) is out of reach for many small teams. step-ca makes it easier.

⚙️ Many ways to automate

There are several ways to authorize a request with the CA and establish a chain of trust that suits your flow.

You can issue certificates in exchange for:

🏔 Your own private ACME server

ACME is the protocol used by Let's Encrypt to automate the issuance of HTTPS certificates. It's super easy to issue certificates to any ACMEv2 (RFC8555) client.

👩🏽‍💻 An online SSH Certificate Authority

  • Delegate SSH authentication to step-ca by using SSH certificates instead of public keys and authorized_keys files
  • For user certificates, connect SSH to your single sign-on provider, to improve security with short-lived certificates and MFA (or other security policies) via any OAuth OIDC provider.
  • For host certificates, improve security, eliminate TOFU warnings, and set up automated host certificate renewal.

🤓 A general purpose PKI tool, via step CLI integration


See our installation docs here.