750e9ee2f8
This change attempts to fix the test TestBootstrapClientServerRotation. Due to the backdate, the renew options get too large, causing continuous renewals, and random errors. After experimenting with different options, truncating durations to seconds have shown better results than rounding or just use the plain time. |
||
|---|---|---|
| .github | ||
| acme | ||
| api | ||
| authority | ||
| autocert | ||
| ca | ||
| cas | ||
| cmd | ||
| commands | ||
| db | ||
| debian | ||
| docker | ||
| docs | ||
| errs | ||
| examples | ||
| kms | ||
| logging | ||
| make | ||
| monitoring | ||
| pki | ||
| scep | ||
| scripts | ||
| server | ||
| systemd | ||
| templates | ||
| .dockerignore | ||
| .gitattributes | ||
| .gitignore | ||
| .golangci.yml | ||
| .goreleaser.yml | ||
| .VERSION | ||
| .version.sh | ||
| CHANGELOG.md | ||
| cosign.pub | ||
| go.mod | ||
| go.sum | ||
| icon.png | ||
| icon.svg | ||
| LICENSE | ||
| Makefile | ||
| README.md | ||
Step Certificates
step-ca is an online certificate authority for secure, automated certificate management. It's the server counterpart to the step CLI tool.
You can use it to:
- Issue X.509 certificates for your internal infrastructure:
- HTTPS certificates that work in browsers (RFC5280 and CA/Browser Forum compliance)
- TLS certificates for VMs, containers, APIs, mobile clients, database connections, printers, wifi networks, toaster ovens...
- Client certificates to enable mutual TLS (mTLS) in your infra. mTLS is an optional feature in TLS where both client and server authenticate each other. Why add the complexity of a VPN when you can safely use mTLS over the public internet?
- Issue SSH certificates:
- For people, in exchange for single sign-on ID tokens
- For hosts, in exchange for cloud instance identity documents
- Easily automate certificate management:
- It's an ACME v2 server
- It has a JSON API
- It comes with a Go wrapper
- ... and there's a command-line client you can use in scripts!
Whatever your use case, step-ca is easy to use and hard to misuse, thanks to safe, sane defaults.
Don't want to run your own CA?
To get up and running quickly, or as an alternative to running your own step-ca server, consider creating a free hosted smallstep Certificate Manager authority.
Questions? Find us in Discussions or Join our Discord.
Website | Documentation | Installation | Getting Started | Contributor's Guide
Features
🦾 A fast, stable, flexible private CA
Setting up a public key infrastructure (PKI) is out of reach for many small teams. step-ca makes it easier.
- Choose key types (RSA, ECDSA, EdDSA) and lifetimes to suit your needs
- Short-lived certificates with automated enrollment, renewal, and passive revocation
- Capable of high availability (HA) deployment using root federation and/or multiple intermediaries
- Can operate as an online intermediate CA for an existing root CA
- Badger, BoltDB, and MySQL database backends
⚙️ Many ways to automate
There are several ways to authorize a request with the CA and establish a chain of trust that suits your flow.
You can issue certificates in exchange for:
- ACME challenge responses from any ACMEv2 client
- OAuth OIDC single sign-on tokens, eg:
- Cloud instance identity documents, for VMs on AWS, GCP, and Azure
- Single-use, short-lived JWK tokens issued by your CD tool — Puppet, Chef, Ansible, Terraform, etc.
- A trusted X.509 certificate (X5C provisioner)
- A SCEP challenge (SCEP provisioner)
- An SSH host certificates needing renewal (the SSHPOP provisioner)
- Learn more in our provisioner documentation
🏔 Your own private ACME server
ACME is the protocol used by Let's Encrypt to automate the issuance of HTTPS certificates. It's super easy to issue certificates to any ACMEv2 (RFC8555) client.
-
Supports the most popular ACME challenge types:
- For
http-01, place a token at a well-known URL to prove that you control the web server - For
dns-01, add aTXTrecord to prove that you control the DNS record set - For
tls-alpn-01, respond to the challenge at the TLS layer (as Caddy does) to prove that you control the web server
- For
-
Works with any ACME client. We've written examples for:
-
Get certificates programmatically using ACME, using these libraries:
legofor Golang (example usage)- certbot's
acmemodule for Python (example usage) acme-clientfor Node.js (example usage)
-
Our own
stepCLI tool is also an ACME client! -
See our ACME tutorial for more
👩🏽💻 An online SSH Certificate Authority
- Delegate SSH authentication to
step-caby using SSH certificates instead of public keys andauthorized_keysfiles - For user certificates, connect SSH to your single sign-on provider, to improve security with short-lived certificates and MFA (or other security policies) via any OAuth OIDC provider.
- For host certificates, improve security, eliminate TOFU warnings, and set up automated host certificate renewal.
🤓 A general purpose PKI tool, via step CLI integration
- Generate key pairs where they're needed so private keys are never transmitted across the network
- Authenticate and obtain a certificate using any provisioner supported by
step-ca - Securely distribute root certificates and bootstrap PKI relying parties
- Renew and revoke certificates issued by
step-ca - Install root certificates on your machine and browsers, so your CA is trusted
- Inspect and lint certificates
Installation
See our installation docs here.
Documentation
Documentation can be found in a handful of different places:
-
On the web at https://smallstep.com/docs/step-ca.
-
On the command line with
step help ca xxxwherexxxis the subcommand you are interested in. Ex:step help ca provisioner list. -
In your browser, by running
step help --http=:8080 cafrom the command line and visiting http://localhost:8080. -
The docs folder is being deprecated, but it still has some documentation and tutorials.
Feedback?
- Tell us what you like and don't like about managing your PKI - we're eager to help solve problems in this space.
- Tell us about a feature you'd like to see! Add a feature request Issue, ask on Discussions, or hit us up on Twitter.