🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Go to file
Herman Slatman e968275a20
Merge pull request #1729 from patsevanton/master
Spelling errors and punctuation have been corrected
5 days ago
.github [action] fix actionlint warnings (#1598) 4 months ago
acme Add `RS1` support for ACME `device-attest-01` 2 months ago
api Change CRL unavailable case to HTTP 404 2 weeks ago
authority Merge pull request #1708 from smallstep/herman/csr-expires-header 2 weeks ago
autocert Use REAMDE.md suggested in code review. 5 years ago
ca Merge branch 'master' into allow_custom_tls_config 2 weeks ago
cas Allow x509 Service CA implementation to be injected through ca and authority options 1 month ago
cmd/step-ca bump go.mod to go1.20 and associated linter fixes (#1518) 6 months ago
commands Implementation of the Prometheus endpoint (#1669) 1 month ago
db Fix linter warnings (#1634) 3 months ago
debian Clean up Makefile and fix goreleaser deprecation 11 months ago
docker Update Dockerfile.hsm to use Debian bookworm 3 months ago
errs Fix err assert linter warnings - upgrade outdated package 1 year ago
examples Update examples/README.md 6 days ago
internal/metrix Implementation of the Prometheus endpoint (#1669) 1 month ago
logging Allow to disable color in the text formatter 5 months ago
monitoring Upgrade newrelic to v3 2 years ago
pki Add some basic tests for `GenerateConfig` 5 months ago
policy address linter warning for go 1.19 10 months ago
scep Fix linter warnings (#1634) 3 months ago
scripts Spelling errors and punctuation have been corrected 6 days ago
server Address gosec warnings 2 years ago
systemd Fixes #757 2 years ago
templates Ignore principals validations with OIDC 1 year ago
webhook Add `provisionerName` to webhook request body 4 months ago
.VERSION Added version operability for `git archive` tarball (non git repo) 5 years ago
.dockerignore Remove dockerignore files that are in the repo. 3 years ago
.gitattributes Added version operability for `git archive` tarball (non git repo) 5 years ago
.gitignore Add go workspaces files to gitignore 1 year ago
.goreleaser.yml Wrap unversioned step into an unversioned dir 5 months ago
.version.sh Use sh instead of bash in .version.sh script 1 year ago
CHANGELOG.md Spelling errors and punctuation have been corrected 6 days ago
CONTRIBUTING.md Trying a different approach 8 months ago
LICENSE Add full version of the license. 4 years ago
Makefile Update Makefile 8 months ago
README.md Amend wrong link to Contribution Guide in README 4 months ago
SECURITY.md Create SECURITY.md 2 years ago
cosign.pub [action] use cosign to sign over goreleaser artifacts 3 years ago
go.mod Bump github.com/newrelic/go-agent/v3 from 3.29.1 to 3.30.0 6 days ago
go.sum Bump github.com/newrelic/go-agent/v3 from 3.29.1 to 3.30.0 6 days ago
icon.png Commit icons. 5 years ago
icon.svg Commit icons. 5 years ago


Step Certificates

step-ca is an online certificate authority for secure, automated certificate management. It's the server counterpart to the step CLI tool.

You can use it to:

  • Issue X.509 certificates for your internal infrastructure:
    • HTTPS certificates that work in browsers (RFC5280 and CA/Browser Forum compliance)
    • TLS certificates for VMs, containers, APIs, mobile clients, database connections, printers, wifi networks, toaster ovens...
    • Client certificates to enable mutual TLS (mTLS) in your infra. mTLS is an optional feature in TLS where both client and server authenticate each other. Why add the complexity of a VPN when you can safely use mTLS over the public internet?
  • Issue SSH certificates:
    • For people, in exchange for single sign-on ID tokens
    • For hosts, in exchange for cloud instance identity documents
  • Easily automate certificate management:

Whatever your use case, step-ca is easy to use and hard to misuse, thanks to safe, sane defaults.

Don't want to run your own CA? To get up and running quickly, or as an alternative to running your own step-ca server, consider creating a free hosted smallstep Certificate Manager authority.

Questions? Find us in Discussions or Join our Discord.

Website | Documentation | Installation | Getting Started | Contributor's Guide

GitHub release Go Report Card Build Status License CLA assistant

GitHub stars Twitter followers

star us


🦾 A fast, stable, flexible private CA

Setting up a public key infrastructure (PKI) is out of reach for many small teams. step-ca makes it easier.

⚙️ Many ways to automate

There are several ways to authorize a request with the CA and establish a chain of trust that suits your flow.

You can issue certificates in exchange for:

🏔 Your own private ACME server

ACME is the protocol used by Let's Encrypt to automate the issuance of HTTPS certificates. It's super easy to issue certificates to any ACMEv2 (RFC8555) client.

👩🏽‍💻 An online SSH Certificate Authority

  • Delegate SSH authentication to step-ca by using SSH certificates instead of public keys and authorized_keys files
  • For user certificates, connect SSH to your single sign-on provider, to improve security with short-lived certificates and MFA (or other security policies) via any OAuth OIDC provider.
  • For host certificates, improve security, eliminate TOFU warnings, and set up automated host certificate renewal.

🤓 A general purpose PKI tool, via step CLI integration


See our installation docs here.