🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
Go to file
Mariano Cano 2f7690c2ae
Merge pull request #2065 from smallstep/mariano/challenge-webhook
Add data support on SCEPCHALLENGE webhooks
2024-11-12 14:09:24 -08:00
.github Bump softprops/action-gh-release from 2.0.8 to 2.0.9 2024-11-04 15:17:26 +00:00
acme Address linter issues 2024-08-20 16:54:29 +02:00
api Address linter issues 2024-08-20 16:54:29 +02:00
authority Add unit tests for scepchallenge webhooks 2024-11-12 13:15:11 -08:00
autocert Use REAMDE.md suggested in code review. 2019-06-18 17:11:29 -07:00
ca Use github.com/smallstep/cli-utils instead of go.step.sm/cli-utils 2024-10-28 10:53:44 +01:00
cas Use github.com/smallstep/cli-utils instead of go.step.sm/cli-utils 2024-10-28 10:53:44 +01:00
cmd/step-ca Use github.com/smallstep/cli-utils instead of go.step.sm/cli-utils 2024-10-28 10:53:44 +01:00
commands Use github.com/smallstep/cli-utils instead of go.step.sm/cli-utils 2024-10-28 10:53:44 +01:00
db Let the CA determine the RA lifetime 2024-03-12 14:29:55 -07:00
debian Clean up Makefile and fix goreleaser deprecation 2023-03-20 21:03:37 -07:00
docker Update Dockerfile.hsm to use Debian bookworm 2023-12-04 18:10:39 -08:00
errs Address linter issues 2024-08-20 16:54:29 +02:00
examples Сorrection of spelling errors 2024-02-24 11:50:30 +06:00
internal chore: fix function names in comment (#1813) 2024-04-24 09:33:51 -07:00
logging Add option for the logging middleware to log real IP (#2002) 2024-09-24 16:14:07 +03:00
middleware/requestid Add package comment 2024-03-08 14:30:07 +01:00
monitoring Make the requestid an exported middleware 2024-03-07 10:41:19 +01:00
pki Use github.com/smallstep/cli-utils instead of go.step.sm/cli-utils 2024-10-28 10:53:44 +01:00
policy chore: fix function names in comment (#1813) 2024-04-24 09:33:51 -07:00
scep Add unit tests for scepchallenge webhooks 2024-11-12 13:15:11 -08:00
scripts Merge pull request #1719 from smallstep/carl/fix-ra-install 2024-03-07 15:01:08 -08:00
server Address gosec warnings 2022-08-18 17:46:20 -07:00
systemd Fixes #757 2021-11-23 18:12:31 -08:00
templates Use github.com/smallstep/cli-utils instead of go.step.sm/cli-utils 2024-10-28 10:53:44 +01:00
test/integration Fix and/or silence linter issues 2024-10-01 14:26:49 +02:00
webhook Add provisionerName to webhook request body 2023-11-08 19:43:13 +01:00
.dockerignore Remove dockerignore files that are in the repo. 2021-04-13 18:24:02 -07:00
.gitattributes Added version operability for git archive tarball (non git repo) 2019-02-21 14:51:03 -08:00
.gitignore Add go workspaces files to gitignore 2022-09-08 17:24:51 -07:00
.goreleaser.yml Update goreleaser YML version (#1901) 2024-06-25 19:07:32 -04:00
.VERSION Added version operability for git archive tarball (non git repo) 2019-02-21 14:51:03 -08:00
.version.sh Use sh instead of bash in .version.sh script 2022-10-19 16:28:31 -07:00
CHANGELOG.md Update changelog for v0.28.0 (#2051) 2024-10-29 16:48:41 -07:00
CONTRIBUTING.md Trying a different approach 2023-06-21 14:44:16 -07:00
cosign.pub [action] use cosign to sign over goreleaser artifacts 2021-08-30 16:53:47 -07:00
go.mod Bump google.golang.org/api from 0.204.0 to 0.205.0 2024-11-11 15:26:11 +00:00
go.sum Bump google.golang.org/api from 0.204.0 to 0.205.0 2024-11-11 15:26:11 +00:00
icon.png Commit icons. 2019-06-12 16:22:39 -07:00
icon.svg Commit icons. 2019-06-12 16:22:39 -07:00
LICENSE Add full version of the license. 2020-05-26 12:21:09 -07:00
Makefile Mirrors smallstep/cli#1214 2024-07-08 16:29:20 -07:00
README.md Updated README 2024-02-28 14:36:25 -08:00
SECURITY.md Create SECURITY.md 2022-07-29 15:17:05 -07:00

step-ca

GitHub release Go Report Card Build Status License CLA assistant

step-ca is an online certificate authority for secure, automated certificate management for DevOps. It's the server counterpart to the step CLI tool for working with certificates and keys. Both projects are maintained by Smallstep Labs.

You can use step-ca to:

  • Issue HTTPS server and client certificates that work in browsers (RFC5280 and CA/Browser Forum compliance)
  • Issue TLS certificates for DevOps: VMs, containers, APIs, database connections, Kubernetes pods...
  • Issue SSH certificates:
    • For people, in exchange for single sign-on identity tokens
    • For hosts, in exchange for cloud instance identity documents
  • Easily automate certificate management:

Comparison with Smallstep's commercial product

step-ca is optimized for a two-tier PKI serving common DevOps use cases.

As you design your PKI, if you need any of the following, consider our commerical CA:

  • Multiple certificate authorities
  • Active revocation (CRL, OSCP)
  • Turnkey high-volume, high availability CA
  • An API for seamless IaC management of your PKI
  • Integrated support for SCEP & NDES, for migrating from legacy Active Directory Certificate Services deployments
  • Device identity — cross-platform device inventory and attestation using Secure Enclave & TPM 2.0
  • Highly automated PKI — managed certificate renewal, monitoring, TPM-based attested enrollment
  • Seamless client deployments of EAP-TLS Wi-Fi, VPN, SSH, and browser certificates
  • Jamf, Intune, or other MDM for root distribution and client enrollment
  • Web Admin UI — history, issuance, and metrics
  • ACME External Account Binding (EAB)
  • Deep integration with an identity provider
  • Fine-grained, role-based access control
  • FIPS-compliant software
  • HSM-bound private keys

See our full feature comparison for more.

You can start a free trial or set up a call with us to learn more.


Questions? Find us in Discussions or Join our Discord.

Website | Documentation | Installation | Contributor's Guide

Features

🦾 A fast, stable, flexible private CA

Setting up a public key infrastructure (PKI) is out of reach for many small teams. step-ca makes it easier.

⚙️ Many ways to automate

There are several ways to authorize a request with the CA and establish a chain of trust that suits your flow.

You can issue certificates in exchange for:

🏔 Your own private ACME server

ACME is the protocol used by Let's Encrypt to automate the issuance of HTTPS certificates. It's super easy to issue certificates to any ACMEv2 (RFC8555) client.

👩🏽‍💻 An online SSH Certificate Authority

  • Delegate SSH authentication to step-ca by using SSH certificates instead of public keys and authorized_keys files
  • For user certificates, connect SSH to your single sign-on provider, to improve security with short-lived certificates and MFA (or other security policies) via any OAuth OIDC provider.
  • For host certificates, improve security, eliminate TOFU warnings, and set up automated host certificate renewal.

🤓 A general purpose PKI tool, via step CLI integration

Installation

See our installation docs here.

Documentation

Feedback?