step-ca — Private Certificate Authority for DevOps

Introduction

step-ca is a private ACME Certificate Authority that brings the automation of the public web PKI to your internal infrastructure. Just as certbot gets free certificates from the public internet, step-ca issues certificates for internal services — enabling mutual TLS, encrypted internal traffic, and SSH certificate-based authentication.

With over 8,000 GitHub stars, step-ca is created by Smallstep and used by organizations that need automated certificate management for microservices, Kubernetes, databases, and internal tools without exposing them to public CAs.

What step-ca Does

step-ca runs as an online Certificate Authority that issues X.509 certificates (for TLS) and SSH certificates (for SSH authentication). It supports the ACME protocol (same as the public internet), enabling automatic certificate issuance and renewal. This means you can use standard tools like certbot, Caddy, and Traefik with your private CA.

Architecture Overview

[step-ca Server]
Private Certificate Authority
ACME, OIDC, JWK provisioners
        |
+-------+-------+-------+
|       |       |       |
[X.509  [SSH     [mTLS]
Certs]   Certs]   Mutual]
TLS for  SSO for  Service-to-
services SSH      service auth
        |
   [Provisioners]
   ACME: auto-issue via protocol
   OIDC: issue via SSO login
   JWK: issue via token
   Cloud: AWS/GCP/Azure identity
        |
   [Integrations]
   Caddy, Traefik, Nginx
   Kubernetes cert-manager
   systemd, cron renewal
   OpenSSH certificates

Self-Hosting & Configuration

# Initialize CA with ACME support
step ca init \
  --name "Internal CA" \
  --dns ca.internal \
  --address :8443 \
  --provisioner admin@example.com

# Enable ACME provisioner
step ca provisioner add acme --type ACME

# Start the CA
step-ca $(step path)/config/ca.json

# Issue a certificate for a service
step ca certificate api.internal api.crt api.key --ca-url https://ca.internal:8443

# Auto-renew with step CLI
step ca renew --daemon api.crt api.key

# SSH certificate authentication
step ssh certificate admin@example.com ssh_user_key \
  --principal admin --principal root

# Use with Kubernetes cert-manager
# Install step-issuer for cert-manager
# to automatically issue certs for Ingress/Services

// ca.json — CA configuration
{
  "address": ":8443",
  "dnsNames": ["ca.internal"],
  "authority": {
    "provisioners": [
      {
        "type": "ACME",
        "name": "acme"
      },
      {
        "type": "OIDC",
        "name": "google",
        "clientID": "...",
        "configurationEndpoint": "https://accounts.google.com/.well-known/openid-configuration"
      }
    ]
  },
  "tls": {
    "minVersion": 1.2,
    "maxVersion": 1.3
  }
}

Key Features

• ACME Protocol — same automation as public web CAs (certbot compatible)
• X.509 Certificates — TLS for internal services, databases, and APIs
• SSH Certificates — replace SSH keys with short-lived certificates (SSO for SSH)
• mTLS — mutual TLS for service-to-service authentication
• Multiple Provisioners — ACME, OIDC (SSO), JWK, cloud identity
• Auto-Renewal — certificates renew automatically before expiry
• Kubernetes — cert-manager integration for automatic K8s certs
• Short-Lived Certs — issue certificates valid for hours, not years

Comparison with Similar Tools

FAQ

Q: step-ca vs mkcert — when should I use which? A: mkcert for local development certificates. step-ca for production internal PKI with automated certificate lifecycle, SSH certificates, and mTLS. mkcert is a dev tool; step-ca is infrastructure.

Q: Can I use step-ca with Caddy? A: Yes. Point Caddy to your step-ca ACME endpoint and it automatically gets certificates for internal domains — just like it does with public domains.

Q: How do SSH certificates work? A: Instead of distributing SSH public keys, step-ca issues short-lived SSH certificates. Users authenticate via SSO (OIDC), receive a certificate valid for 8 hours, and SSH servers trust the CA. No more managing authorized_keys files.

Q: Is step-ca free? A: Yes, step-ca is open source (Apache-2.0). Smallstep offers a commercial managed service (Smallstep Certificate Manager) for teams that want hosted PKI.

Sources

• GitHub: https://github.com/smallstep/certificates
• Documentation: https://smallstep.com/docs
• Website: https://smallstep.com
• Created by Smallstep Labs
• License: Apache-2.0