step-ca is a private certificate authority and ACME server enabling secure, automated issuance and management of X.509 and SSH certificates for DevOps environments.
🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
This tool is designed for DevOps teams and security engineers who need to automate the issuance and management of TLS and SSH certificates within private infrastructures. It facilitates secure communication by providing a private CA that supports HTTPS, SSH single sign-on, and ACME protocols, making it ideal for managing certificates across VMs, containers, APIs, and Kubernetes clusters.
step-ca is optimized for smaller teams and two-tier PKI setups; for advanced enterprise features like active revocation, high availability, and deep identity provider integration, consider Smallstep's commercial offerings. Users should ensure proper configuration of ACME challenges and secure storage of private keys. Integration with single sign-on systems enhances SSH certificate issuance security.
Visit the official documentation at https://smallstep.com/docs/step-ca/installation for detailed installation steps
Download and install the step CLI tool from https://github.com/smallstep/cli
Set up step-ca server following the installation guide to initialize your private CA
Configure step-ca according to your environment requirements (key types, lifetimes, ACME settings)
Use the step CLI or Go wrapper to interact with the step-ca server for certificate issuance and managementstep-ca start
Starts the step-ca server to begin issuing certificates
step ca certificate <name> <cert-file> <key-file>
Issues a new certificate for a given name and saves it to specified files
step ssh certificate <user> <public-key-file> --principal <principal>
Issues an SSH user certificate based on a public key and principal
step ca renew
Renews an existing certificate
step ca revoke <certificate>
Revokes a certificate issued by the CA
step ca provisioner add <name>
Adds a new provisioner for authentication and authorization