step-ca

step-ca is ranked #3 of 25 in public key infrastructure software on The Geeks Club. It runs on API, Linux, macOS, Self-hosted, Windows. There is a free plan.

step-ca plans and pricing

All plans

step-ca (open source) Free single configured intermediate CA · offline root CA · authority-wide issuance policies · no Certificate Transparency integration · no ACME EAB github.com · 30 Sept 2026

Compared on public key infrastructure software

Free plan: Yes
Deployment model: hybrid
ACME support: Yes
SCEP support: Yes
HSM integration: Yes
Certificate profiles: Yes

Best step-ca alternatives

See all 12

7.3 EZCA Free trial $200/mo

7.2 KeyTalk CKMS Free trial €5/mo

7.1 XiPKI Free plan

7.0 Keyfactor Platform Free trial

6.8 Sectigo Certificate Manager Free trial $20.83/mo

6.8 SecureW2 Cloud NAC

step-ca

Purpose: step-ca is an online Certificate Authority for secure, automated X.509 and SSH certificate management.
X.509 certificates: It issues X.509 certificates for TLS, mutual TLS authentication, document signing and X.509 authentication.
SSH certificates: It issues SSH certificates to users and hosts and can provide short-lived SSH user certificates through single sign-on.
Provisioners: Provisioners can authorize issuance through ACME challenge responses, OIDC tokens, AWS/GCP/Azure instance identity documents and short-lived JWK tokens.
Certificate automation: step-ca supports automated certificate issuance, renewal and passive revocation for clients, servers and Kubernetes workloads.
Templates: X.509 and SSH templates can add custom SANs or OIDs, restrict domains or key sizes and create longer certificate chains.
Key protection: It integrates with Google Cloud KMS, AWS KMS, Azure Key Vault, PKCS#11 HSMs, TPM 2.0 and YubiKey PIV for CA signing-key protection.
Integrations: The integration ecosystem includes ACME, SCEP, OIDC, AWS/GCP/Azure cloud identity, Kubernetes cert-manager, Nebula and Envoy SDS.
Databases: Its configurable database backends include Badger, BoltDB, MySQL and PostgreSQL.
Installation: Official installation options cover macOS Homebrew, Windows Winget or Scoop, Linux packages and binaries, Kubernetes and Docker.
Architecture: step-ca is designed around a two-tier PKI with one offline root CA and one configured intermediate CA issuing end-entity certificates.
Limitations: The project documents limited active revocation, limited legacy-protocol and device-attestation options, no certificate history or metrics, no dynamic SCEP and no ACME External Account Binding.
Support: Open-source step-ca support is provided by the user community through Discord, with dedicated support contracts available from Smallstep.
Target users: The project is positioned for DevOps teams that need a private CA for certificates used by VMs, containers, APIs, databases, Kubernetes pods and people.
Price from: Free

Visit site Alternatives

Where it ranks on The Geeks Club

Best Public Key Infrastructure Software in 2026#3 of 25

Is step-ca yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote step-ca

Sources

smallstep.com/docs/step-ca/· checked 30 Sept 2026
smallstep.com/docs/step-ca/cryptographic-protection/· checked 30 Sept 2026
smallstep.com/docs/step-ca/integrations/· checked 30 Sept 2026
smallstep.com/docs/step-ca/configuration/· checked 30 Sept 2026
smallstep.com/docs/step-ca/installation/· checked 30 Sept 2026
support.smallstep.com/en/articles/8471361· checked 30 Sept 2026
github.com/smallstep/certificates· checked 30 Sept 2026