# step-ca

Online certificate authority for X.509 and SSH certificates, with an ACME server that issues TLS certificates for web servers and other hosts.


Source: https://findsoftware.frbit.cloud/step-ca/
Last reviewed: 2026-10-30
Listed since: 2026-10-30

## Record

### Links

- home: https://smallstep.com/docs/step-ca/
- repository: https://github.com/smallstep/certificates
- docs: https://smallstep.com/docs/step-ca/
- x: https://twitter.com/smallsteplabs
- discord: https://u.step.sm/discord
- forum: https://github.com/smallstep/certificates/discussions
- youtube: https://www.youtube.com/@smallsteplabs

### Identity

- status: active
- maintainer: Smallstep Labs, Inc.
- maintainerType: company
- parent: unknown
- firstRelease: 2018
- hqCountry: US

### Kind

- category: web-server
- hosting: binary
- language: go
- runtime: binary
- runtimeMin: unknown
- basedOn: unknown

### Content

- contentStore: not applicable
- databases: not applicable
- adminUi: not applicable
- headlessApi: not applicable
- templating: not applicable
- i18n: not applicable

### Rendering and deploy

- runsAs: always-on
- renderingModes: not applicable
- installMethod: homebrew

### License

- licenseModel: open-source
- license: Apache-2.0

### Releases

- currentMajor: 0
- latestReleaseDate: 2026-03-23

### Adoption

- githubStargazers: 9025
- packagistDownloads: not applicable
- npmWeeklyDownloads: not applicable
- contributors: 97
- pluginCount: unknown
- packagistMonthlyDownloads: unknown
- ecosystemsMonthlyDownloads: unknown
- httpArchiveSites: unknown
- wordpressActiveInstalls: unknown
- dependentRepos: unknown
- dependentPackages: unknown

### Sources

- urls: https://smallstep.com/docs/step-ca/ (read 2026-10-30)
- urls: https://api.github.com/repos/smallstep/certificates (read 2026-10-30)
- urls: https://smallstep.com/docs/step-ca/installation/ (read 2026-10-30)
- maintainer: https://smallstep.com/terms-of-use/ (read 2026-10-30)
- hqCountry: https://smallstep.com/terms-of-use/ (read 2026-10-30)
- maintainerType: https://raw.githubusercontent.com/smallstep/certificates/master/README.md (read 2026-10-30)
- category: https://raw.githubusercontent.com/smallstep/certificates/master/README.md (read 2026-10-30)
- language: https://api.github.com/repos/smallstep/certificates (read 2026-10-30)
- runtime: https://smallstep.com/docs/step-ca/installation/ (read 2026-10-30)
- installMethod: https://smallstep.com/docs/step-ca/installation/ (read 2026-10-30)
- installMethod: https://smallstep.com/docs/step-ca/installation/ (read 2026-10-30)
- installMethod: https://smallstep.com/docs/step-ca/installation/ (read 2026-10-30)
- installMethod: https://smallstep.com/docs/step-ca/installation/ (read 2026-10-30)
- installMethod: https://smallstep.com/docs/step-ca/installation/ (read 2026-10-30)
- installMethod: https://smallstep.com/docs/step-ca/installation/ (read 2026-10-30)
- installMethod: https://smallstep.com/docs/step-ca/installation/ (read 2026-10-30)
- runsAs: https://smallstep.com/docs/step-ca/certificate-authority-server-production/ (read 2026-10-30)
- license: https://raw.githubusercontent.com/smallstep/certificates/master/LICENSE (read 2026-10-30)
- licenseModel: https://raw.githubusercontent.com/smallstep/certificates/master/LICENSE (read 2026-10-30)
- currentMajor: https://api.github.com/repos/smallstep/certificates/releases/latest (read 2026-10-30)
- latestReleaseDate: https://api.github.com/repos/smallstep/certificates/releases/latest (read 2026-10-30)
- firstRelease: https://api.github.com/repos/smallstep/certificates/releases (read 2026-10-30)
- githubStargazers: https://api.github.com/repos/smallstep/certificates (read 2026-10-30)
- contributors: https://api.github.com/repos/smallstep/certificates/contributors?per_page=1 (read 2026-10-30)

## Notes

step-ca is a certificate authority that signs X.509 and SSH certificates and works as an ACME server, so ACME clients can request TLS certificates for web servers from it. Its ACME basics page notes that any web server can answer the http-01 challenge by serving the response as a static file. The README describes it as the server counterpart to the step command-line client, and OIDC single sign-on tokens are one way to authorize a certificate request.

Packages are published for several operating systems, along with a Homebrew formula, Winget and Scoop packages, binaries and a Docker image. The production documentation describes running the server under systemd.

## Worth knowing

The README points to a commercial certificate authority from the same company for needs such as multiple certificate authorities and active revocation.

---

Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Attributes are recorded, never scored; absent means unknown.
Credit, in full: FindSoftware, CC BY 4.0