Repository files navigation

step-ca is an online certificate authority for secure, automated certificate management for DevOps.It's the server counterpart to thestep CLI tool for working with certificates and keys.Both projects are maintained bySmallstep Labs.

You can usestep-ca to:

• Issue HTTPS server and client certificates thatwork in browsers (RFC5280 andCA/Browser Forum compliance)
• Issue TLS certificates for DevOps: VMs, containers, APIs, database connections, Kubernetes pods...
• Issue SSH certificates:
  • For people, in exchange for single sign-on identity tokens
  • For hosts, in exchange for cloud instance identity documents
• Easily automate certificate management:
  • It's anACME server that supports allpopular ACME challenge types
  • It comes with aGo wrapper
  • ... and there's acommand-line client you can use in scripts!

step-ca is optimized for a two-tier PKI serving common DevOps use cases.

As you design your PKI, if you need any of the following,consider our commerical CA:

• Multiple certificate authorities
• Active revocation (CRL, OSCP)
• Turnkey high-volume, high availability CA
• An API for seamless IaC management of your PKI
• Integrated support for SCEP & NDES, for migrating from legacy Active Directory Certificate Services deployments
• Device identity — cross-platform device inventory and attestation using Secure Enclave & TPM 2.0
• Highly automated PKI — managed certificate renewal, monitoring, TPM-based attested enrollment
• Seamless client deployments of EAP-TLS Wi-Fi, VPN, SSH, and browser certificates
• Jamf, Intune, or other MDM for root distribution and client enrollment
• Web Admin UI — history, issuance, and metrics
• ACME External Account Binding (EAB)
• Deep integration with an identity provider
• Fine-grained, role-based access control
• FIPS-compliant software
• HSM-bound private keys

See ourfull feature comparison for more.

You canstart a free trial orset up a call with us to learn more.

Questions? Find us inDiscussions orJoin our Discord.

Website |Documentation |Installation |Contributor's Guide

Setting up apublic key infrastructure (PKI) is out of reach for many small teams.step-ca makes it easier.

• Choose key types (RSA, ECDSA, EdDSA) and lifetimes to suit your needs
• Short-lived certificates with automated enrollment, renewal, and passive revocation
• Can operate asan online intermediate CA for an existing root CA
• Badger, BoltDB, Postgres, and MySQL database backends

There are several ways to authorize a request with the CA and establish a chain of trust that suits your flow.

You can issue certificates in exchange for:

• ACME challenge responses from any ACMEv2 client
• OAuth OIDC single sign-on tokens, eg:
  • ID tokens from Okta, GSuite, Azure AD, Auth0.
  • ID tokens from an OAuth OIDC service that you host, likeKeycloak orDex
• Cloud instance identity documents, for VMs on AWS, GCP, and Azure
• Single-use, short-lived JWK tokens issued by your CD tool — Puppet, Chef, Ansible, Terraform, etc.
• A trusted X.509 certificate (X5C provisioner)
• A host certificate from your Nebula network
• A SCEP challenge (SCEP provisioner)
• An SSH host certificates needing renewal (the SSHPOP provisioner)
• Learn more in ourprovisioner documentation

ACME is the protocol used by Let's Encrypt to automate the issuance of HTTPS certificates. It'ssuper easy to issue certificates to any ACMEv2 (RFC8555) client.

• Use ACME in development & pre-production

• Supports the most popularACME challenge types:

  • Forhttp-01, place a token at a well-known URL to prove that you control the web server
  • Fordns-01, add aTXT record to prove that you control the DNS record set
  • Fortls-alpn-01, respond to the challenge at the TLS layer (as Caddy does) to prove that you control the web server

• Works with any ACME client. We've written examples for:

  • certbot
  • acme.sh
  • win-acme
  • Caddy
  • Traefik
  • Apache
  • nginx

• Get certificates programmatically using ACME, using these libraries:

  • lego for Golang (example usage)
  • certbot'sacme module for Python (example usage)
  • acme-client for Node.js (example usage)

• Our ownstep CLI tool is also an ACME client!

• See ourACME tutorial for more

• Delegate SSH authentication tostep-ca by usingSSH certificates instead of public keys andauthorized_keys files
• For user certificates,connect SSH to your single sign-on provider, to improve security with short-lived certificates and MFA (or other security policies) via any OAuth OIDC provider.
• For host certificates, improve security,eliminate TOFU warnings, and set up automated host certificate renewal.

• Generate key pairs where they're needed so private keys are never transmitted across the network
• Authenticate and obtain a certificate using any provisioner supported bystep-ca
• Securelydistribute root certificates andbootstrap PKI relying parties
• Renew andrevoke certificates issued bystep-ca
• Install root certificates on your machine and browsers, so your CA is trusted
• Inspect andlint certificates

See our installation docshere.

• Official documentation is on smallstep.com
• Thestep command reference is available viastep help,on smallstep.com,or by runningstep help --http=:8080 from the command lineand visitinghttp://localhost:8080.

• Tell us what you like and don't like about managing your PKI - we're eager to help solve problems in this space.Join our Discord orGitHub Discussions
• Tell us about a feature you'd like to see!Request a Feature