OpenCA PKI vs step-ca
OpenCA PKI
openca.orgstep-ca
smallstep.comSide by side
| Figure | OpenCA PKI | step-ca |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | Yes |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 3 |
| Spec score · Public Key Infrastructure Software | 8.4 (#5) | 8.2 (#7) |
| Documentation depth | The guide spans design, installation, configuration, user workflows and a technology guide, but the documentation page warns that much of it is outdated. | Official materials include command references, configuration, provisioners, templates, production guidance, renewal, revocation, integrations and tutorials. |
| Integrations | Official dependencies and integrations include OpenLDAP, OpenSSL, Apache HTTP Server and Apache mod_ssl. | Documented integrations include Kubernetes cert-manager, Envoy SDS, ACME clients, OIDC providers, PKCS#11, Google Cloud KMS, AWS KMS and YubiKey PIV. |
| License | The OpenCA source license is an Apache-style permissive license with attribution and trademark conditions. | The certificates repository is distributed under the Apache-2.0 license. |
| Purpose | OpenCA PKI is an open source, out-of-the-box Certification Authority for setting up and managing a PKI. | step-ca is an online Certificate Authority for secure, automated X.509 and SSH certificate management. |
| Support | The project describes community support through mailing lists, forums, and online chat, and mentions paid support from independent third parties. | Open-source users are directed to community Discord support, with optional paid support contracts available from Smallstep. |
| What it does | OpenCA PKI is open-source software for setting up and administering certification authorities and public-key infrastructures. | step-ca is an online certificate authority for automated X.509 and SSH certificate management. |
Plans
step-ca
- step-ca (open source)Free
- step-ca open sourceFree
- Smallstep PlatformPriced on request
In their own words
OpenCA PKI
OpenCA PKI is free, open-source software for establishing and managing a public key infrastructure, with an out-of-the-box Certification Authority. It is intended for on-premises deployment and is listed for Linux, macOS, self-hosted, and web environments. The project says it implements commonly used protocols with full-strength cryptography; listed capabilities include SCEP support, HSM integration, and certificate profiles. The download page lists OpenCA PKI (SpecialK) version 1.5.1. Installation requires other software, including OpenLDAP, OpenSSL, Apache, and Apache mod_ssl, and OpenCA Tools version 1.3.0 is listed as a prerequisite to install first. The project dates to 1998 and describes its work as volunteer-driven and managed through collaboration and consensus. Community support is available through mailing lists, forums, and online chat; independent third parties offer paid support. Security concerns can be reported privately by email or publicly through the project issue trackers. The documentation page says downloadable documentation is unavailable and notes that the OpenCA Guide for version 0.9.2 is outdated in some parts.
step-ca
step-ca is an online Certificate Authority for automating X.509 and SSH certificate management. It issues X.509 certificates for TLS, mutual TLS, document signing and authentication, as well as SSH certificates for users and hosts. Provisioners can authorize issuance through ACME challenges, OIDC tokens, cloud instance identity documents and short-lived JWK tokens. Automated issuance and renewal are supported for clients, servers and Kubernetes workloads, alongside passive revocation. Templates can customize SANs or OIDs, restrict domains or key sizes, and create longer certificate chains. For CA signing-key protection, step-ca integrates with Google Cloud KMS, AWS KMS, Azure Key Vault, PKCS#11 HSMs, TPM 2.0 and YubiKey PIV. Its intended PKI design uses an offline root CA and a configured intermediate CA that issues end-entity certificates. Installation options include macOS, Windows, Linux, Kubernetes and Docker, and database choices include Badger, BoltDB, MySQL and PostgreSQL. The open-source plan costs nothing. Community help is available through Discord, with dedicated support contracts from Smallstep.