OpenCA PKI
7.4#4 in public key infrastructure softwareFree planFree planWebLinuxmacOSSelf-hosted
VisitOpenCA PKI vs step-ca
What both publish
| Fact | OpenCA PKI | step-ca |
|---|---|---|
| Documentation depth | The guide spans design, installation, configuration, user workflows and a technology guide, but the documentation page warns that much of it is outdated. | Official materials include command references, configuration, provisioners, templates, production guidance, renewal, revocation, integrations and tutorials. |
| Integrations | Official dependencies and integrations include OpenLDAP, OpenSSL, Apache HTTP Server and Apache mod_ssl. | Documented integrations include Kubernetes cert-manager, Envoy SDS, ACME clients, OIDC providers, PKCS#11, Google Cloud KMS, AWS KMS and YubiKey PIV. |
| License | The OpenCA source license is an Apache-style permissive license with attribution and trademark conditions. | The certificates repository is distributed under the Apache-2.0 license. |
| Purpose | OpenCA PKI is an open source, out-of-the-box Certification Authority for setting up and managing a PKI. | step-ca is an online Certificate Authority for secure, automated X.509 and SSH certificate management. |
OpenCA PKI plans
- OpenCA PKIFree
step-ca plans
- step-ca (open source)Free
- step-ca open sourceFree
- Smallstep PlatformPriced on request
Pick OpenCA PKI if…
It suits organizations that need to run their own certificate authority and PKI on Linux, macOS, or a self-hosted web setup. Teams should be prepared to install its named prerequisites and work with limited, partly outdated documentation.
Pick step-ca if…
step-ca is positioned for DevOps teams managing certificates for VMs, containers, APIs, databases, Kubernetes workloads, and people. It may suit teams building a private CA with automated certificate workflows.