SHSelfHostIndex

step-ca

Private online certificate authority for internal PKI

Identity & SSO ★ 8.9k stars Medium setup Apache-2.0

step-ca is an open-source online certificate authority for issuing TLS and SSH certificates for internal services and devices. It supports ACME and is fully self-hosted.

Official siteSource code

Key features

  • Private certificate authority
  • ACME server
  • SSH certificates
  • Short-lived certs

Strengths

  • Released under the Apache-2.0 license
  • First-class Docker support for quick deployment
  • Mature project with 8.9k GitHub stars
  • Written in Go

Is step-ca secure?

No known vulnerabilities affect step-ca's latest release (v0.30.2). OSV.dev lists 4 past advisories for the project; none of them applies to this release. No known vulnerabilities is not proof of security: it means none have been publicly catalogued.

  • Most recent fixed advisory CVE-2026-40097, published 2026-04-10 (187 days ago), fixed in 0.30.0

Source: OSV.dev, checked 2026-10-14. How this is measured.

step-ca replaces

Self-hosted DigiCert alternatives

Health badge

Maintain step-ca? Add its health score to your README. The badge links back to this page.

SelfHostIndex: 91 · excellent

Markdown
[![SelfHostIndex health score for step-ca](https://selfhostindex.com/badge/smallstep-ca.svg)](https://selfhostindex.com/app/smallstep-ca/)
HTML
<a href="https://selfhostindex.com/app/smallstep-ca/"><img src="https://selfhostindex.com/badge/smallstep-ca.svg" alt="SelfHostIndex health score for step-ca"></a>
reStructuredText
.. image:: https://selfhostindex.com/badge/smallstep-ca.svg
   :alt: SelfHostIndex health score for step-ca
   :target: https://selfhostindex.com/app/smallstep-ca/

The score is recomputed on every nightly rebuild from public repository data — see how it is calculated.

Similar identity & sso apps