step-ca

Overview

Its two-tier design keeps an offline root CA separate from the configured intermediate that issues end-entity certificates. That is a sensible foundation for routine automated issuance, but the free plan allows one configured intermediate, which constrains teams that need several independent issuing authorities.

step-ca issues X.509 certificates for TLS, mutual TLS, document signing and authentication, alongside SSH certificates for users and hosts. Single sign-on can provide short-lived SSH user certificates. It also automates issuance, renewal and passive revocation for clients, servers and Kubernetes workloads. The distinction between passive and active revocation matters: teams with demanding certificate-response workflows should not assume this replaces a fuller revocation system.

Key features

Provisioners authorize certificate issuance through ACME challenges, OIDC tokens, cloud instance identity documents from AWS, GCP and Azure, or short-lived JWK tokens. This range gives infrastructure teams several ways to tie issuance to existing identity and deployment processes rather than relying on a single credential model.

Templates can add custom SANs or OIDs, restrict domains or key sizes, and create longer certificate chains. Those controls are useful when certificate policy varies by workload, but step-ca still lacks certificate history and metrics, leaving teams without those built-in views for auditing issuance or monitoring activity.

For signing-key protection, integrations include Google Cloud KMS, AWS KMS, Azure Key Vault, PKCS#11 HSMs, TPM 2.0 and YubiKey PIV. The wider ecosystem covers ACME, SCEP, OIDC, cloud identity, Kubernetes cert-manager, Nebula and Envoy SDS. Configurable database backends include Badger, BoltDB, MySQL and PostgreSQL. The project also documents no dynamic SCEP and no ACME External Account Binding, and has limited legacy-protocol and device-attestation options; organizations relying on those specific capabilities should consider another fit.

Pricing

step-ca (open source): 0.00 USD per free. The plan includes one configured intermediate CA, an offline root CA and authority-wide issuance policies. It is a strong starting point for teams comfortable operating open-source infrastructure, with no paid tier or per-seat, quota, trial or renewal terms stated for this plan. It does not include Certificate Transparency integration or ACME EAB. Community support is provided through Discord; dedicated support contracts are available from Smallstep.

Platforms

step-ca supports API, Linux, macOS, Windows and self-hosted deployment. Official installation routes cover macOS Homebrew, Windows Winget or Scoop, Linux packages and binaries, Kubernetes and Docker. Its hybrid deployment model suits teams placing certificate services alongside their infrastructure, while the range of install paths supports both conventional hosts and containerized environments.

Who it's for

DevOps teams managing private certificates for VMs, containers, APIs, databases, Kubernetes pods and people are the clearest audience. It is particularly appropriate when automated issuance and renewal, cloud identity provisioners, and protected CA signing keys matter more than built-in history or metrics. Teams needing active revocation, extensive legacy protocol support, device attestation, dynamic SCEP or ACME EAB should assess those gaps before adopting it.

Pros and cons

• Pros: Free open-source plan combines X.509 and SSH issuance with automation across clients, servers and Kubernetes workloads.
• Pros: Multiple identity provisioners and KMS, HSM, TPM and YubiKey integrations support varied infrastructure and key-protection needs.
• Pros: Templates and configurable databases offer useful policy and deployment flexibility.
• Cons: One configured intermediate CA limits the free plan for organizations needing multiple issuing authorities.
• Cons: Limited active revocation and no certificate history or metrics weaken response and operational visibility.
• Cons: No Certificate Transparency integration or ACME EAB, alongside limited legacy-protocol and device-attestation options.

Alternatives

Public Key Infrastructure Software is the broader category to browse if step-ca's operating model or feature gaps do not match your needs.

SecureW2 Cloud NAC is a paid alternative with Android, iOS, web and desktop platform coverage; choose it if you want to compare a product sold through a quote process that asks about solution type, organization type and device count.

XiPKI is another free, open-source option with API, Linux, macOS and self-hosted platform support; consider it if you want to evaluate a different open-source PKI project.

EZCA suits buyers seeking a paid service with a free trial and a stated Basic plan at 200.00 USD per month, described as FIPS 140-3 Level 2 HSM-backed CAs.

Entrust Certificate Manager is a paid alternative for readers considering another certificate-management provider.

KeyTalk CKMS is worth comparing for readers considering paid key-management software with a free trial and a stated S/MIME on-premise plan at 5.00 EUR per month per user.

HashiCorp Nomad offers a freemium option; consider it if you are comparing certificate-related needs alongside a product with self-managed and customizable enterprise plans.

Keyfactor Platform is a paid alternative with a free trial; its certificate lifecycle automation plan states no per-certificate fees and a deployment tested for more than 500 million certificates.

SSL.com Certificate Lifecycle Management is another freemium option to compare for API and web use.

Verdict

Choose step-ca if your team wants a free, self-hosted private CA that automates X.509 and SSH issuance and can integrate with existing identity and key-protection systems. Its focused two-tier model and broad integration range are compelling for infrastructure automation. Look elsewhere if active revocation, certificate history, metrics, multiple configured intermediates or the missing protocol features are central requirements.