OpenXPKI vs step-ca
OpenXPKI
openxpki.orgstep-ca
smallstep.comSide by side
| Figure | OpenXPKI | step-ca |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | Yes | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 3 | 3 |
| Spec score · Public Key Infrastructure Software | 7.6 (#14) | 8.2 (#7) |
| Integrations | Connectors can access flat files, LDAP directories, SQL databases, and web services; Enterprise Edition offers DigiCert, Sectigo, and SwissSign extensions. | Documented integrations include Kubernetes cert-manager, Envoy SDS, ACME clients, OIDC providers, PKCS#11, Google Cloud KMS, AWS KMS and YubiKey PIV. |
| Purpose | OpenXPKI is enterprise-grade PKI and Trustcenter software for customizable management of X.509v3 certificates. | step-ca is an online Certificate Authority for secure, automated X.509 and SSH certificate management. |
| Support | Community Edition support is available through a mailing list; commercial support options with SLAs are offered by White Rabbit Security GmbH. | Open-source users are directed to community Discord support, with optional paid support contracts available from Smallstep. |
Plans
OpenXPKI
- Community EditionFree
- Enterprise EditionPriced on request
- OpenXPKI as a ServicePriced on request
step-ca
- step-ca (open source)Free
- step-ca open sourceFree
- Smallstep PlatformPriced on request
In their own words
OpenXPKI
OpenXPKI is PKI and Trustcenter software for managing X.509v3 certificates in professional environments. Its customizable workflows cover requests, renewals, and revocations, with enrollment through SCEP, EST, SimpleCMC, ACME, and a REST-like API with OpenAPI support. One instance can host multiple PKI Realms, each with separate namespaces, profiles, workflows, and policies. The Ember.js web interface serves users, operators, and administrators in major browsers. Connectors reach flat files, LDAP, SQL databases, and web services; Enterprise Edition adds extensions for DigiCert, Sectigo, and SwissSign. Hardware Security Modules are supported through PKCS#11. YAML configuration can be tracked with revision control, and custom reporting workflows can produce downloadable CSVs. Community Edition is free and fully functional, with Debian 12 packages and mailing-list support. Enterprise Edition has packages for RHEL, SLES, and Ubuntu Server LTS; service and commercial support options are also listed, with SLAs available. The software was founded in 2009.
step-ca
step-ca is an online Certificate Authority for automating X.509 and SSH certificate management. It issues X.509 certificates for TLS, mutual TLS, document signing and authentication, as well as SSH certificates for users and hosts. Provisioners can authorize issuance through ACME challenges, OIDC tokens, cloud instance identity documents and short-lived JWK tokens. Automated issuance and renewal are supported for clients, servers and Kubernetes workloads, alongside passive revocation. Templates can customize SANs or OIDs, restrict domains or key sizes, and create longer certificate chains. For CA signing-key protection, step-ca integrates with Google Cloud KMS, AWS KMS, Azure Key Vault, PKCS#11 HSMs, TPM 2.0 and YubiKey PIV. Its intended PKI design uses an offline root CA and a configured intermediate CA that issues end-entity certificates. Installation options include macOS, Windows, Linux, Kubernetes and Docker, and database choices include Badger, BoltDB, MySQL and PostgreSQL. The open-source plan costs nothing. Community help is available through Discord, with dedicated support contracts from Smallstep.