🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Mariano Cano 9d4bef8cc9
Merge pull request #1072 from smallstep/name-constraints-changelog
2 days ago
.github Merge pull request #1065 from smallstep/max/code-scan 2 days ago
acme A few more linter errors 1 week ago
api Fix errors.As linter warnings 1 week ago
authority Merge branch 'master' into name-constraints 6 days ago
autocert Use REAMDE.md suggested in code review. 3 years ago
ca linting and fixing review feedback 1 week ago
cas Even more linter fixes 1 week ago
cmd Support to ask for key password after crypto change 2 days ago
commands Standardize linting file and fix or ignore lots of linting errors 1 week ago
db Merge branch 'master' into context-authority 4 months ago
debian [action] debian rules syntax 1 year ago
docker include support for GCP and AWS KMS by default 5 months ago
docs fix linter warnings 5 months ago
errs Even more linter fixes 1 week ago
examples Added some example ansible configs (#813) 8 months ago
logging Fix linter warning 2 months ago
make [action] sign and push sigs for multi-arch docker containers w/ cosign 1 year ago
monitoring Upgrade newrelic to v3 2 months ago
pki Standardize linting file and fix or ignore lots of linting errors 1 week ago
policy Render proper policy and constrains errors 1 week ago
scep Standardize linting file and fix or ignore lots of linting errors 1 week ago
scripts We now have an armv5 step-ca build; remove guard clause from RA install script 5 months ago
server Address gosec warnings 1 month ago
systemd Fixes #757 10 months ago
templates Use functions from os instead of io/ioutil 2 months ago
.VERSION Added version operability for `git archive` tarball (non git repo) 4 years ago
.dockerignore Remove dockerignore files that are in the repo. 1 year ago
.gitattributes Added version operability for `git archive` tarball (non git repo) 4 years ago
.gitignore Add go workspaces files to gitignore 3 weeks ago
.gitleaksignore [actiono] Update workflows 5 days ago
.goreleaser.yml [action] attempt to pin goreleaser version 5 months ago
.version.sh Added version operability for `git archive` tarball (non git repo) 4 years ago
CHANGELOG.md Clarify name constraints changelog 2 days ago
LICENSE Add full version of the license. 2 years ago
Makefile Even more linter fixes 1 week ago
README.md Update build status svg and link to github actions 2 weeks ago
SECURITY.md Create SECURITY.md 2 months ago
cosign.pub [action] use cosign to sign over goreleaser artifacts 1 year ago
go.mod more linting fixes 1 week ago
go.sum more linting fixes 1 week ago
icon.png Commit icons. 3 years ago
icon.svg Commit icons. 3 years ago


Step Certificates

step-ca is an online certificate authority for secure, automated certificate management. It's the server counterpart to the step CLI tool.

You can use it to:

  • Issue X.509 certificates for your internal infrastructure:
    • HTTPS certificates that work in browsers (RFC5280 and CA/Browser Forum compliance)
    • TLS certificates for VMs, containers, APIs, mobile clients, database connections, printers, wifi networks, toaster ovens...
    • Client certificates to enable mutual TLS (mTLS) in your infra. mTLS is an optional feature in TLS where both client and server authenticate each other. Why add the complexity of a VPN when you can safely use mTLS over the public internet?
  • Issue SSH certificates:
    • For people, in exchange for single sign-on ID tokens
    • For hosts, in exchange for cloud instance identity documents
  • Easily automate certificate management:

Whatever your use case, step-ca is easy to use and hard to misuse, thanks to safe, sane defaults.

Don't want to run your own CA? To get up and running quickly, or as an alternative to running your own step-ca server, consider creating a free hosted smallstep Certificate Manager authority.

Questions? Find us in Discussions or Join our Discord.

Website | Documentation | Installation | Getting Started | Contributor's Guide

GitHub release Go Report Card Build Status License CLA assistant

GitHub stars Twitter followers

star us


🦾 A fast, stable, flexible private CA

Setting up a public key infrastructure (PKI) is out of reach for many small teams. step-ca makes it easier.

Many ways to automate

There are several ways to authorize a request with the CA and establish a chain of trust that suits your flow.

You can issue certificates in exchange for:

🏔 Your own private ACME server

ACME is the protocol used by Let's Encrypt to automate the issuance of HTTPS certificates. It's super easy to issue certificates to any ACMEv2 (RFC8555) client.

👩🏽💻 An online SSH Certificate Authority

  • Delegate SSH authentication to step-ca by using SSH certificates instead of public keys and authorized_keys files
  • For user certificates, connect SSH to your single sign-on provider, to improve security with short-lived certificates and MFA (or other security policies) via any OAuth OIDC provider.
  • For host certificates, improve security, eliminate TOFU warnings, and set up automated host certificate renewal.

🤓 A general purpose PKI tool, via step CLI integration


See our installation docs here.


Documentation can be found in a handful of different places:

  1. On the web at https://smallstep.com/docs/step-ca.

  2. On the command line with step help ca xxx where xxx is the subcommand you are interested in. Ex: step help ca provisioner list.

  3. In your browser, by running step help --http=:8080 ca from the command line and visiting http://localhost:8080.

  4. The docs folder is being deprecated, but it still has some documentation and tutorials.