🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
Find a file
Mariano Cano 5785caa111
Add support for the disableSmallstepExtensions claim
This commit adds a new claim to exclude the Smallstep provisioner
extension from the generated certificates.

Fixes #620
2023-07-20 10:59:38 -07:00
.github [action] updated goCI workflow API (#1429) 2023-06-13 11:13:42 -07:00
acme Fix TPM simulator initialization for tests 2023-07-10 13:07:58 +02:00
api Merge pull request #1381 from smallstep/max/go-1.19 2023-05-10 10:34:24 -07:00
authority Add support for the disableSmallstepExtensions claim 2023-07-20 10:59:38 -07:00
autocert Use REAMDE.md suggested in code review. 2019-06-18 17:11:29 -07:00
ca Wait for Accept in TestBootstrapClientServerRotation 2023-07-19 14:56:09 -07:00
cas Add namespace field to VaultCAS JSON config 2023-06-07 13:25:47 -05:00
cmd/step-ca Fix linting errors 2023-02-21 11:26:33 -08:00
commands Fix typo in flag usage 2023-03-30 15:23:21 -07:00
db address linter warning for go 1.19 2023-05-09 23:47:28 -07:00
debian Clean up Makefile and fix goreleaser deprecation 2023-03-20 21:03:37 -07:00
docker Trying a different approach 2023-06-21 14:44:16 -07:00
errs Fix err assert linter warnings - upgrade outdated package 2022-10-12 16:32:26 -07:00
examples Added some example ansible configs (#813) 2022-02-02 18:54:55 +01:00
logging Fix linter warning 2022-08-11 17:47:58 -07:00
monitoring Upgrade newrelic to v3 2022-08-04 11:16:11 -07:00
pki Add support for the disableSmallstepExtensions claim 2023-07-20 10:59:38 -07:00
policy address linter warning for go 1.19 2023-05-09 23:47:28 -07:00
scep address linter warning for go 1.19 2023-05-09 23:47:28 -07:00
scripts Fix typo in comment 2023-07-18 14:21:55 -07:00
server Address gosec warnings 2022-08-18 17:46:20 -07:00
systemd Fixes #757 2021-11-23 18:12:31 -08:00
templates Ignore principals validations with OIDC 2022-12-14 17:51:50 -08:00
webhook Add SCEP webhook validation tests 2023-05-01 11:14:50 +02:00
.dockerignore Remove dockerignore files that are in the repo. 2021-04-13 18:24:02 -07:00
.gitattributes Added version operability for git archive tarball (non git repo) 2019-02-21 14:51:03 -08:00
.gitignore Add go workspaces files to gitignore 2022-09-08 17:24:51 -07:00
.gitleaksignore [actiono] Update workflows 2022-09-23 23:21:44 -07:00
.goreleaser.yml Add unversioned filenames to GitHub assets 2023-06-14 17:18:28 -07:00
.VERSION Added version operability for git archive tarball (non git repo) 2019-02-21 14:51:03 -08:00
.version.sh Use sh instead of bash in .version.sh script 2022-10-19 16:28:31 -07:00
CHANGELOG.md Update changelog for ACME kid / provisioner name change (#1426) 2023-06-09 12:03:00 -07:00
CONTRIBUTING.md Trying a different approach 2023-06-21 14:44:16 -07:00
cosign.pub [action] use cosign to sign over goreleaser artifacts 2021-08-30 16:53:47 -07:00
go.mod Add support for the disableSmallstepExtensions claim 2023-07-20 10:59:38 -07:00
go.sum Add support for the disableSmallstepExtensions claim 2023-07-20 10:59:38 -07:00
icon.png Commit icons. 2019-06-12 16:22:39 -07:00
icon.svg Commit icons. 2019-06-12 16:22:39 -07:00
LICENSE Add full version of the license. 2020-05-26 12:21:09 -07:00
Makefile Update Makefile 2023-07-08 02:49:58 -07:00
README.md Update README.md 2023-07-08 02:50:05 -07:00
SECURITY.md Create SECURITY.md 2022-07-29 15:17:05 -07:00

Step Certificates

step-ca is an online certificate authority for secure, automated certificate management. It's the server counterpart to the step CLI tool.

You can use it to:

  • Issue X.509 certificates for your internal infrastructure:
    • HTTPS certificates that work in browsers (RFC5280 and CA/Browser Forum compliance)
    • TLS certificates for VMs, containers, APIs, mobile clients, database connections, printers, wifi networks, toaster ovens...
    • Client certificates to enable mutual TLS (mTLS) in your infra. mTLS is an optional feature in TLS where both client and server authenticate each other. Why add the complexity of a VPN when you can safely use mTLS over the public internet?
  • Issue SSH certificates:
    • For people, in exchange for single sign-on ID tokens
    • For hosts, in exchange for cloud instance identity documents
  • Easily automate certificate management:

Whatever your use case, step-ca is easy to use and hard to misuse, thanks to safe, sane defaults.


Don't want to run your own CA? To get up and running quickly, or as an alternative to running your own step-ca server, consider creating a free hosted smallstep Certificate Manager authority.


Questions? Find us in Discussions or Join our Discord.

Website | Documentation | Installation | Getting Started | Contributor's Guide

GitHub release Go Report Card Build Status License CLA assistant

GitHub stars Twitter followers

star us

Features

🦾 A fast, stable, flexible private CA

Setting up a public key infrastructure (PKI) is out of reach for many small teams. step-ca makes it easier.

⚙️ Many ways to automate

There are several ways to authorize a request with the CA and establish a chain of trust that suits your flow.

You can issue certificates in exchange for:

🏔 Your own private ACME server

ACME is the protocol used by Let's Encrypt to automate the issuance of HTTPS certificates. It's super easy to issue certificates to any ACMEv2 (RFC8555) client.

👩🏽‍💻 An online SSH Certificate Authority

  • Delegate SSH authentication to step-ca by using SSH certificates instead of public keys and authorized_keys files
  • For user certificates, connect SSH to your single sign-on provider, to improve security with short-lived certificates and MFA (or other security policies) via any OAuth OIDC provider.
  • For host certificates, improve security, eliminate TOFU warnings, and set up automated host certificate renewal.

🤓 A general purpose PKI tool, via step CLI integration

Installation

See our installation docs here.

Documentation

Feedback?