step-ca
Online certificate authority for X.509 and SSH certificates, with an ACME server that issues TLS certificates for web servers and other hosts.
smallstep.com/docs/step-ca/repositorydocs
step-ca is a certificate authority that signs X.509 and SSH certificates and works as an ACME server, so ACME clients can request TLS certificates for web servers from it. Its ACME basics page notes that any web server can answer the http-01 challenge by serving the response as a static file. The README describes it as the server counterpart to the step command-line client, and OIDC single sign-on tokens are one way to authorize a certificate request.
Packages are published for several operating systems, along with a Homebrew formula, Winget and Scoop packages, binaries and a Docker image. The production documentation describes running the server under systemd.
Worth knowing
The README points to a commercial certificate authority from the same company for needs such as multiple certificate authorities and active revocation.
Identity
Rendering and deploy
Releases
Adoption
Sources
- 2026-10-30: links
smallstep.com/docs/step-ca/ - 2026-10-30: links, Written in, GitHub stars
api.github.com/repos/smallstep/certificates - 2026-10-30: links, Runtime, Install with
smallstep.com/docs/step-ca/installation/ - 2026-10-30: Maintainer, Headquarters
smallstep.com/terms-of-use/ - 2026-10-30: Maintained by, Categories
raw.githubusercontent.com/smallstep/certificates/master/README.md - 2026-10-30: Runs as
smallstep.com/docs/step-ca/certificate-authority-server-production/ - 2026-10-30: License, License model
raw.githubusercontent.com/smallstep/certificates/master/LICENSE - 2026-10-30: Current major version, Last release
api.github.com/repos/smallstep/certificates/releases/latest - 2026-10-30: First release
api.github.com/repos/smallstep/certificates/releases - 2026-10-30: Contributors
api.github.com/repos/smallstep/certificates/contributors?per_page=1