Repolode
Submit
smallstep

smallstep/certificates

An online private certificate authority and ACME server for issuing X.509 TLS and SSH certificates with automated renewal.

View on GitHubWebsite
Stars
8,983
Forks
610
Open issues
308
Last commit
2 days ago

What is it?

step-ca is an online certificate authority for running your own private PKI. It issues short-lived X.509 certificates for HTTPS servers and clients, TLS certificates for VMs, containers, APIs, database connections and Kubernetes pods, and SSH certificates for both people and hosts.

It includes a built-in ACME server that supports the http-01, dns-01 and tls-alpn-01 challenge types, so any ACMEv2 client such as certbot, Caddy or Traefik can request certificates from it. Requests are authorized through provisioners, including OIDC single sign-on tokens, cloud instance identity documents, JWK tokens issued by CD tools, and X5C or SCEP flows.

The project is designed around a two-tier PKI for common DevOps use cases and stores state in Badger, BoltDB, Postgres or MySQL. It is meant to be used together with the separate step CLI for key generation, certificate renewal and root distribution.

Key features

  • 01Issues X.509 certificates with RSA, ECDSA or EdDSA keys and configurable lifetimes.
  • 02Built-in ACME server supporting http-01, dns-01 and tls-alpn-01 challenges.
  • 03SSH certificate authority for user logins via OIDC single sign-on and for host certificates.
  • 04Provisioners authorize issuance through OIDC tokens, cloud instance identity, JWK tokens and X5C.
  • 05Can run as an online intermediate CA under an existing root CA.
  • 06Stores state in Badger, BoltDB, Postgres or MySQL.

Use cases

  • Issuing internal TLS certificates for services, containers and Kubernetes pods in a private network.
  • Running a private ACME server for development and pre-production environments.
  • Replacing shared authorized_keys files with short-lived SSH certificates tied to SSO identity.
  • Automating renewal of host certificates for VMs on AWS, GCP or Azure.

Quick start

  1. 1

    Follow the official installation guide linked in the README

Things to know

  • The README says active revocation (CRL, OCSP) is only in the commercial product, not this open-source version.
  • It is optimized for a two-tier PKI and does not list multiple certificate authorities as a supported feature.

In collections

Security scanners, audits & threat intel tools

Topics

#pki#tls#acme#ssh#x509#certificate-authority#security#acme-server#ca#certificates

FAQ

What is certificates?
An online private certificate authority and ACME server for issuing X.509 TLS and SSH certificates with automated renewal. step-ca is an online certificate authority for running your own private PKI. It issues short-lived X.509 certificates for HTTPS servers and clients, TLS certificates for VMs, containers, APIs, database connections and Kubernetes pods, and SSH certificates for both people and hosts.
Is certificates free to use? What license does it have?
certificates is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is certificates still maintained?
Actively maintained. The last commit to certificates was on Oct 23, 2026.
What can I use certificates for?
Issuing internal TLS certificates for services, containers and Kubernetes pods in a private network. Running a private ACME server for development and pre-production environments. Replacing shared authorized_keys files with short-lived SSH certificates tied to SSO identity. Automating renewal of host certificates for VMs on AWS, GCP or Azure.
How do I install certificates?
Follow the official installation guide linked in the README
Where can I get certificates?
The source code and installation instructions are on GitHub: https://github.com/smallstep/certificates

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects