Specifiction
For vendors
AdvertiseTop spots, featured rows, home sponsor Get listedAdd a product we don't cover yet Claim a listingFree: verify the domain, then correct your page Vendor dashboardNumbers, orders and placements
List your tool
Vendor dashboard
Tech riderRev. 30 Sept 2026

step-ca

Ch 047.3of 25 Public Key Infrastructure Software
  1. 1Runs onAPI, Linux, Mac, self-hosted, Windows
  2. 2CostsFree plan
  3. 3Deployment modelhybrid
  4. 4ACME supportYes
  5. 5SCEP supportYes
  6. 6HSM integrationYes
  7. 7Certificate profilesYes
7 lines stated Written from the maker's own pages: smallstep.com, github.com
Visit site Alternatives
The step-ca homepage

Overview

step-ca is ranked #4 of 25 in public key infrastructure software on Specifiction. It runs on API, Linux, macOS, Self-hosted, Windows. There is a free plan.

step-ca plans and pricing

All plans
step-ca (open source) Free single configured intermediate CA · offline root CA · authority-wide issuance policies · no Certificate Transparency integration · no ACME EAB github.com · 30 Sept 2026

Compared on public key infrastructure software

Free plan
Yessmallstep.com
Deployment model
hybridsmallstep.com
ACME support
Yessmallstep.com
SCEP support
Yessmallstep.com
HSM integration
Yessmallstep.com
Certificate profiles
Yessmallstep.com

Facts

Purpose
step-ca is an online Certificate Authority for secure, automated X.509 and SSH certificate management.smallstep.com · 30 Sept 2026
X.509 certificates
It issues X.509 certificates for TLS, mutual TLS authentication, document signing and X.509 authentication.smallstep.com · 30 Sept 2026
SSH certificates
It issues SSH certificates to users and hosts and can provide short-lived SSH user certificates through single sign-on.smallstep.com · 30 Sept 2026
Provisioners
Provisioners can authorize issuance through ACME challenge responses, OIDC tokens, AWS/GCP/Azure instance identity documents and short-lived JWK tokens.smallstep.com · 30 Sept 2026
Certificate automation
step-ca supports automated certificate issuance, renewal and passive revocation for clients, servers and Kubernetes workloads.smallstep.com · 30 Sept 2026
Templates
X.509 and SSH templates can add custom SANs or OIDs, restrict domains or key sizes and create longer certificate chains.smallstep.com · 30 Sept 2026
Key protection
It integrates with Google Cloud KMS, AWS KMS, Azure Key Vault, PKCS#11 HSMs, TPM 2.0 and YubiKey PIV for CA signing-key protection.smallstep.com · 30 Sept 2026
Integrations
The integration ecosystem includes ACME, SCEP, OIDC, AWS/GCP/Azure cloud identity, Kubernetes cert-manager, Nebula and Envoy SDS.smallstep.com · 30 Sept 2026
Databases
Its configurable database backends include Badger, BoltDB, MySQL and PostgreSQL.smallstep.com · 30 Sept 2026
Installation
Official installation options cover macOS Homebrew, Windows Winget or Scoop, Linux packages and binaries, Kubernetes and Docker.smallstep.com · 30 Sept 2026
Architecture
step-ca is designed around a two-tier PKI with one offline root CA and one configured intermediate CA issuing end-entity certificates.smallstep.com · 30 Sept 2026
Limitations
The project documents limited active revocation, limited legacy-protocol and device-attestation options, no certificate history or metrics, no dynamic SCEP and no ACME External Account Binding.smallstep.com · 30 Sept 2026
Support
Open-source step-ca support is provided by the user community through Discord, with dedicated support contracts available from Smallstep.support.smallstep.com · 30 Sept 2026
Target users
The project is positioned for DevOps teams that need a private CA for certificates used by VMs, containers, APIs, databases, Kubernetes pods and people.github.com · 30 Sept 2026

Best step-ca alternatives

See all 20
All accessCh 01 EZCA Free trialAndroidAPI from $200/mo7.7 All accessCh 02 KeyTalk CKMS Free trialAndroidiOS from €5/mo7.4 All accessCh 03 SecureW2 Cloud NAC AndroidAPI 7.4 All accessCh 05 OpenCA PKI Free planLinuxMac Free to start7.2 All accessCh 06 XiPKI Free planAPILinux Free to start7.1 All accessCh 07 Entrust Certificate Manager AndroidAPI 7.0

Where it ranks on Specifiction

Is step-ca yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote step-ca

Sources