🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
Find a file
2022-07-13 08:56:47 +08:00
.github Merge pull request #915 from smallstep/max/removing-beta 2022-05-19 22:53:59 -07:00
acme all: reformat all go files with the next gofmt (Go 1.19) 2022-06-16 01:28:59 +07:00
api add minor doco, Test_CRLGeneration(), fix some issues from merge 2022-07-13 08:56:47 +08:00
authority Merge branch 'master' into crl-support 2022-07-13 08:52:58 +08:00
autocert Use REAMDE.md suggested in code review. 2019-06-18 17:11:29 -07:00
ca all: reformat all go files with the next gofmt (Go 1.19) 2022-06-16 01:28:59 +07:00
cas Merge branch 'master' into crl-support 2022-07-13 08:52:58 +08:00
cmd pinfile 2022-06-09 13:51:14 -04:00
commands all: reformat all go files with the next gofmt (Go 1.19) 2022-06-16 01:28:59 +07:00
db add minor doco, Test_CRLGeneration(), fix some issues from merge 2022-07-13 08:56:47 +08:00
debian [action] debian rules syntax 2021-04-13 16:53:30 -07:00
docker include support for GCP and AWS KMS by default 2022-04-25 14:25:31 +02:00
docs add minor doco, Test_CRLGeneration(), fix some issues from merge 2022-07-13 08:56:47 +08:00
errs api/render, api/log: initial implementation of the packages (#860) 2022-03-30 11:22:22 +03:00
examples Added some example ansible configs (#813) 2022-02-02 18:54:55 +01:00
kms Split Go 1.19 problematic with build tags 2022-06-16 10:58:45 -07:00
logging all: reformat all go files with the next gofmt (Go 1.19) 2022-06-16 01:28:59 +07:00
make [action] sign and push sigs for multi-arch docker containers w/ cosign 2021-09-01 12:43:59 -07:00
monitoring ca-component -> certificates 2018-10-31 21:36:01 -07:00
pki Allow KMS type to be specified in the helm chart template if specified on the command line. 2022-05-05 00:10:59 +01:00
policy Explicitly disable wildcard Common Name constraint 2022-05-06 13:58:48 +02:00
scep Remove scep handler after merge. 2022-05-12 17:39:36 -07:00
scripts We now have an armv5 step-ca build; remove guard clause from RA install script 2022-04-20 09:48:06 -07:00
server Use Golang's default keep-alive. 2021-10-15 14:12:43 -07:00
systemd Fixes #757 2021-11-23 18:12:31 -08:00
templates update commented template names to match reality 2021-11-17 21:42:53 -08:00
.dockerignore Remove dockerignore files that are in the repo. 2021-04-13 18:24:02 -07:00
.gitattributes Added version operability for git archive tarball (non git repo) 2019-02-21 14:51:03 -08:00
.gitignore git: ignore .envrc files 2022-03-14 13:18:44 +02:00
.golangci.yml Pin golangci-lint to v1.43.0 and fix issues 2021-11-13 01:30:03 +01:00
.goreleaser.yml [action] attempt to pin goreleaser version 2022-04-19 15:20:00 -07:00
.VERSION Added version operability for git archive tarball (non git repo) 2019-02-21 14:51:03 -08:00
.version.sh Added version operability for git archive tarball (non git repo) 2019-02-21 14:51:03 -08:00
CHANGELOG.md Add changelog template 2022-07-06 15:04:55 -07:00
cosign.pub [action] use cosign to sign over goreleaser artifacts 2021-08-30 16:53:47 -07:00
go.mod Fix Dependabot warning on an indirect dependency 2022-05-25 17:11:45 -07:00
go.sum Fix Dependabot warning on an indirect dependency 2022-05-25 17:11:45 -07:00
icon.png Commit icons. 2019-06-12 16:22:39 -07:00
icon.svg Commit icons. 2019-06-12 16:22:39 -07:00
LICENSE Add full version of the license. 2020-05-26 12:21:09 -07:00
Makefile Add -s to make fmt and bump golangci-lint to 1.45.2 2022-05-19 22:40:47 -07:00
README.md Update README.md 2022-06-30 11:27:05 -06:00

Step Certificates

step-ca is an online certificate authority for secure, automated certificate management. It's the server counterpart to the step CLI tool.

You can use it to:

  • Issue X.509 certificates for your internal infrastructure:
    • HTTPS certificates that work in browsers (RFC5280 and CA/Browser Forum compliance)
    • TLS certificates for VMs, containers, APIs, mobile clients, database connections, printers, wifi networks, toaster ovens...
    • Client certificates to enable mutual TLS (mTLS) in your infra. mTLS is an optional feature in TLS where both client and server authenticate each other. Why add the complexity of a VPN when you can safely use mTLS over the public internet?
  • Issue SSH certificates:
    • For people, in exchange for single sign-on ID tokens
    • For hosts, in exchange for cloud instance identity documents
  • Easily automate certificate management:

Whatever your use case, step-ca is easy to use and hard to misuse, thanks to safe, sane defaults.


Don't want to run your own CA? To get up and running quickly, or as an alternative to running your own step-ca server, consider creating a free hosted smallstep Certificate Manager authority.


Questions? Find us in Discussions or Join our Discord.

Website | Documentation | Installation | Getting Started | Contributor's Guide

GitHub release Go Report Card Build Status License CLA assistant

GitHub stars Twitter followers

star us

Features

🦾 A fast, stable, flexible private CA

Setting up a public key infrastructure (PKI) is out of reach for many small teams. step-ca makes it easier.

⚙️ Many ways to automate

There are several ways to authorize a request with the CA and establish a chain of trust that suits your flow.

You can issue certificates in exchange for:

🏔 Your own private ACME server

ACME is the protocol used by Let's Encrypt to automate the issuance of HTTPS certificates. It's super easy to issue certificates to any ACMEv2 (RFC8555) client.

👩🏽‍💻 An online SSH Certificate Authority

  • Delegate SSH authentication to step-ca by using SSH certificates instead of public keys and authorized_keys files
  • For user certificates, connect SSH to your single sign-on provider, to improve security with short-lived certificates and MFA (or other security policies) via any OAuth OIDC provider.
  • For host certificates, improve security, eliminate TOFU warnings, and set up automated host certificate renewal.

🤓 A general purpose PKI tool, via step CLI integration

Installation

See our installation docs here.

Documentation

Documentation can be found in a handful of different places:

  1. On the web at https://smallstep.com/docs/step-ca.

  2. On the command line with step help ca xxx where xxx is the subcommand you are interested in. Ex: step help ca provisioner list.

  3. In your browser, by running step help --http=:8080 ca from the command line and visiting http://localhost:8080.

  4. The docs folder is being deprecated, but it still has some documentation and tutorials.

Feedback?