Skip to content
SPECIFICTION
Get listed

step-ca

smallstep.com

Free plan Open source WindowsmacOSLinuxAPISelf-hosted
Visit smallstep.com
Spec score 8.2 #7 of 26 in Public Key Infrastructure Software

What it is

step-ca is an online Certificate Authority for automating X.509 and SSH certificate management. It issues X.509 certificates for TLS, mutual TLS, document signing and authentication, as well as SSH certificates for users and hosts. Provisioners can authorize issuance through ACME challenges, OIDC tokens, cloud instance identity documents and short-lived JWK tokens. Automated issuance and renewal are supported for clients, servers and Kubernetes workloads, alongside passive revocation. Templates can customize SANs or OIDs, restrict domains or key sizes, and create longer certificate chains. For CA signing-key protection, step-ca integrates with Google Cloud KMS, AWS KMS, Azure Key Vault, PKCS#11 HSMs, TPM 2.0 and YubiKey PIV. Its intended PKI design uses an offline root CA and a configured intermediate CA that issues end-entity certificates. Installation options include macOS, Windows, Linux, Kubernetes and Docker, and database choices include Badger, BoltDB, MySQL and PostgreSQL. The open-source plan costs nothing. Community help is available through Discord, with dedicated support contracts from Smallstep.

Spec sheet

What it does
step-ca is an online certificate authority for automated X.509 and SSH certificate management.Read 14 Oct 2026 · smallstep.com
Purpose
step-ca is an online Certificate Authority for secure, automated X.509 and SSH certificate management.Read 30 Sep 2026 · smallstep.com
Integrations
Documented integrations include Kubernetes cert-manager, Envoy SDS, ACME clients, OIDC providers, PKCS#11, Google Cloud KMS, AWS KMS and YubiKey PIV.Read 14 Oct 2026 · smallstep.com
Support
Open-source users are directed to community Discord support, with optional paid support contracts available from Smallstep.Read 14 Oct 2026 · support.smallstep.com
License
The certificates repository is distributed under the Apache-2.0 license.Read 14 Oct 2026 · github.com
ACME server
step-ca provides a private ACME server compatible with ACMEv2 clients and common HTTP-01, DNS-01 and TLS-ALPN-01 challenges.Read 14 Oct 2026 · github.com
API and SDK
The project includes a Go wrapper and a command-line client, while a seamless infrastructure-as-code API is listed as a commercial-product feature.Read 14 Oct 2026 · github.com
Architecture
step-ca is designed around a two-tier PKI with one offline root CA and one configured intermediate CA issuing end-entity certificates.Read 30 Sep 2026 · smallstep.com
Automated renewal
The system automates certificate enrollment and renewal and uses passive revocation for short-lived certificates.Read 14 Oct 2026 · smallstep.com
Binary architectures
Precompiled Linux binaries are published for amd64, arm64, armv6, armv7, mips, mips64, ppc64le and 386.Read 14 Oct 2026 · smallstep.com
Certificate automation
step-ca supports automated certificate issuance, renewal and passive revocation for clients, servers and Kubernetes workloads.Read 30 Sep 2026 · smallstep.com
Company facts
LinkedIn lists Smallstep as privately held, founded in 2016, headquartered in San Francisco and employing 11–50 people.Read 14 Oct 2026 · linkedin.com
Company legal name
Crunchbase lists the legal entity as Smallstep Labs, Inc.Read 14 Oct 2026 · crunchbase.com
Database backends
State storage supports embedded Badger and BoltDB plus MySQL and PostgreSQL key-value backends.Read 14 Oct 2026 · smallstep.com
Databases
Its configurable database backends include Badger, BoltDB, MySQL and PostgreSQL.Read 30 Sep 2026 · smallstep.com
Documentation depth
Official materials include command references, configuration, provisioners, templates, production guidance, renewal, revocation, integrations and tutorials.Read 14 Oct 2026 · smallstep.com
Funding
Crunchbase lists a private Series A and seven investors, including boldstart ventures and Upside Partnership.Read 14 Oct 2026 · crunchbase.com
Independent technical assessment
DEV.co characterizes deployment complexity as moderate and documentation as strong, while noting that root-key protection remains the operator’s responsibility.Read 14 Oct 2026 · dev.co
Installation
Official installation options cover macOS Homebrew, Windows Winget or Scoop, Linux packages and binaries, Kubernetes and Docker.Read 30 Sep 2026 · smallstep.com
Key algorithms
Supported certificate key types include RSA, ECDSA and EdDSA, with configurable lifetimes.Read 14 Oct 2026 · smallstep.com
Key protection
It integrates with Google Cloud KMS, AWS KMS, Azure Key Vault, PKCS#11 HSMs, TPM 2.0 and YubiKey PIV for CA signing-key protection.Read 30 Sep 2026 · smallstep.com
Limit: CA hierarchy
Open-source step-ca supports one configured intermediate CA and does not support multiple issuing CAs or a single-tier PKI.Read 14 Oct 2026 · smallstep.com
Limit: CLI-oriented workflow
A self-hosted user describes issuing, downloading and revoking certificates through SSH and the CLI and seeks a phone-friendly interface.Read 14 Oct 2026 · reddit.com
Limit: data export
There is no built-in easy data-export API, and embedded databases must be stopped before scripted export.Read 14 Oct 2026 · smallstep.com
Limit: pricing
G2 reviewers describe pricing as concerning or above budget, including a complaint that it is not free after 50 endpoints.Read 14 Oct 2026 · g2.com
Limit: protocols
The project documents limited legacy protocol support, no dynamic SCEP for Intune or Jamf and no ACME External Account Binding.Read 14 Oct 2026 · smallstep.com
Limit: revocation and telemetry
Active CRL or OCSP revocation options are very limited and certificate issuance history or metrics are not supported.Read 14 Oct 2026 · smallstep.com
Limit: setup and integrations
G2 reviewers report that initial setup, advanced configuration and legacy-system integration can be difficult.Read 14 Oct 2026 · g2.com
Limit: wildcard ACME
A Reddit user reports malformed ACME authorization and DNS-01 setup difficulties when attempting wildcard certificates with Caddy.Read 14 Oct 2026 · reddit.com
Limitations
The project documents limited active revocation, limited legacy-protocol and device-attestation options, no certificate history or metrics, no dynamic SCEP and no ACME External Account Binding.Read 30 Sep 2026 · smallstep.com
Notable news
Smallstep announced “Reimagining Device Security for the Enterprise” on May 20, 2025.Read 14 Oct 2026 · smallstep.com
Praise: ease of use
G2 reviewers repeatedly praise simplified certificate management, straightforward issuing and reduced administrative work.Read 14 Oct 2026 · g2.com
Praise: platform coverage
G2 reviewers highlight cross-platform support, Kubernetes compatibility and secure device identity.Read 14 Oct 2026 · g2.com
Provisioners
Provisioners authorize issuance through ACME, OIDC tokens, cloud instance identity documents and single-use JWK tokens.Read 14 Oct 2026 · smallstep.com
Rating on G2
4.2 out of 5 from 10 reviewsRead 14 Oct 2026 · g2.com
Release security
Release artifacts are signed and verified with Sigstore Cosign.Read 14 Oct 2026 · smallstep.com
Security controls
Smallstep states that hosted CA signing keys are held in HSMs, interactions are logged, data is encrypted at rest and TLS or mutual TLS protects transport.Read 14 Oct 2026 · smallstep.com
Self-hosting
Install options cover macOS Homebrew, Windows Winget or Scoop, multiple Linux distributions, Kubernetes Helm and Docker.Read 14 Oct 2026 · smallstep.com
SSH CA
It issues short-lived SSH certificates for users and hosts, including identities authenticated through OIDC single sign-on.Read 14 Oct 2026 · smallstep.com
SSH certificates
It issues SSH certificates to users and hosts and can provide short-lived SSH user certificates through single sign-on.Read 30 Sep 2026 · smallstep.com
Target users
The project is positioned for DevOps teams that need a private CA for certificates used by VMs, containers, APIs, databases, Kubernetes pods and people.Read 30 Sep 2026 · github.com
Templates
Go text templates can customize SANs, OIDs, domain or key-size restrictions and CA path lengths.Read 14 Oct 2026 · smallstep.com
TLS and mTLS
It issues certificates for TLS, mutual TLS, document signing and broader X.509 authentication.Read 14 Oct 2026 · smallstep.com
Webhooks
Webhook requests can be authenticated with HMAC signatures, bearer or basic authorization and mutual TLS.Read 14 Oct 2026 · smallstep.com
X.509 certificates
It issues X.509 certificates for TLS, mutual TLS authentication, document signing and X.509 authentication.Read 30 Sep 2026 · smallstep.com

Plans and prices

step-ca (open source) Free single configured intermediate CA · offline root CA · authority-wide issuance policies · no Certificate Transparency integration · no ACME EAB Read 30 Sep 2026 · github.com
step-ca open source Free self-hosted two-tier CA · passive revocation · single intermediate CA Read 14 Oct 2026 · smallstep.com
Smallstep Platform Priced on request ACME device attestation · SSH · certificate Wi-Fi · VPN/ZTNA · workload identity · certificate authority Read 14 Oct 2026 · smallstep.com

Every step-ca plan and price →

Strong points and limits

Strong points

  • Issues both X.509 and SSH certificates.
  • Automates issuance and renewal for Kubernetes workloads.
  • Supports several cloud KMS and hardware key-protection options.
  • Configurable database backends include MySQL and PostgreSQL.
  • Free open-source plan costs nothing.

Limits

  • Active revocation is limited.
  • No certificate history or metrics.
  • No ACME External Account Binding.
  • Community support is through Discord.

Who it suits

step-ca suits DevOps teams that need a private CA for certificates used by VMs, containers, APIs, databases, Kubernetes pods or people. It also fits teams seeking automated X.509 and SSH issuance and renewal.

Verdict

step-ca covers automated private certificate issuance across X.509 and SSH use cases, with configurable integrations and key protection. Its documented gaps include limited active revocation and missing certificate history and metrics.

Where Specifiction places it

Alternatives to step-caAll alternatives →