🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
Find a file
2021-04-13 15:47:26 -07:00
.github [action] use go version matrix for the test / build step 2021-04-13 15:47:26 -07:00
acme Remove check of deprecated value 2021-04-13 14:53:05 -07:00
api add WriteError method for acme api 2021-03-29 23:16:39 -07:00
authority Merge pull request #496 from smallstep/max/acme 2021-04-13 15:02:03 -07:00
autocert Use REAMDE.md suggested in code review. 2019-06-18 17:11:29 -07:00
ca Merge pull request #496 from smallstep/max/acme 2021-04-13 15:02:03 -07:00
cas Clarify comment. 2021-03-25 11:07:58 -07:00
cmd Fix wrong format of the first flag on step-ca --help 2021-03-24 14:55:34 -07:00
commands Add support for the flag --issuer-password-file 2021-03-24 14:53:19 -07:00
db Fix typos. 2020-10-05 17:20:22 -07:00
debian [action] change debian package and src name in debian build files 2021-03-02 11:21:37 -08:00
docker Change HEALTHCHECK to use step ca health. Change shell CMD exec to skip redundant /bin/sh -c 2020-09-08 09:44:35 -07:00
docs Update provisioners.md 2021-04-05 17:19:27 -05:00
errs Fix error message of bad request 2020-09-10 23:45:44 +09:00
examples Fix example and use ClientCAs. 2020-09-02 15:10:11 -07:00
kms Merge pull request #485 from smallstep/max/actions 2021-02-22 22:23:48 -08:00
logging Log successful /health requests at Trace lvl 2021-03-09 14:52:13 +00:00
make [action] change step-certificates to step-ca where possible 2021-03-02 11:58:42 -08:00
monitoring ca-component -> certificates 2018-10-31 21:36:01 -07:00
pki Remove unused code. 2020-11-18 16:57:24 -08:00
server ServetTLS => ServeTLS in function docs 2018-12-20 12:10:32 -05:00
systemd Quoting fix 2021-03-17 18:24:10 -07:00
templates Update sshd_config.tpl to a Match all block. 2021-04-12 18:37:10 -07:00
.dockerignore Update Dockerfile.step-ca to match best practices 2020-09-02 11:41:47 -07:00
.gitattributes Added version operability for git archive tarball (non git repo) 2019-02-21 14:51:03 -08:00
.gitignore Add support for TLS-ALPN-01 challenge. 2020-02-07 14:37:13 -05:00
.golangci.yml go mod tidy and golang 1.15.0 cleanup ... 2020-08-17 13:48:37 -07:00
.goreleaser.yml [action] set goreleaser config values back to default 2021-03-15 12:27:29 -07:00
.VERSION Added version operability for git archive tarball (non git repo) 2019-02-21 14:51:03 -08:00
.version.sh Added version operability for git archive tarball (non git repo) 2019-02-21 14:51:03 -08:00
CHANGELOG.md first pass at README 2018-11-05 20:37:58 -08:00
distribution.md [action] change step-certificates to step-ca where possible 2021-03-02 11:58:42 -08:00
go.mod Update go.step.sm/crypto. 2021-03-18 18:04:38 -07:00
go.sum Update go.step.sm/crypto. 2021-03-18 18:04:38 -07:00
icon.png Commit icons. 2019-06-12 16:22:39 -07:00
icon.svg Commit icons. 2019-06-12 16:22:39 -07:00
LICENSE Add full version of the license. 2020-05-26 12:21:09 -07:00
Makefile Move golangci-lint to github action | update bootstrap 2021-04-13 15:32:46 -07:00
README.md Updates to README 2021-04-06 12:58:36 -07:00

Step Certificates

step-ca is an online certificate authority for secure, automated certificate management. It's the server counterpart to the step CLI tool.

You can use it to:

  • Issue X.509 certificates for your internal infrastructure:
    • HTTPS certificates that work in browsers (RFC5280 and CA/Browser Forum compliance)
    • TLS certificates for VMs, containers, APIs, mobile clients, database connections, printers, wifi networks, toaster ovens...
    • Client certificates to enable mutual TLS (mTLS) in your infra. mTLS is an optional feature in TLS where both client and server authenticate each other. Why add the complexity of a VPN when you can safely use mTLS over the public internet?
  • Issue SSH certificates:
    • For people, in exchange for single sign-on ID tokens
    • For hosts, in exchange for cloud instance identity documents
  • Easily automate certificate management:

Whatever your use case, step-ca is easy to use and hard to misuse, thanks to safe, sane defaults.

Questions? Find us in Discussions.

Website | Documentation | Installation | Getting Started | Contributor's Guide

GitHub release CA Image Go Report Card Build Status License CLA assistant

GitHub stars Twitter followers

Features

🦾 A fast, stable, flexible private CA

Setting up a public key infrastructure (PKI) is out of reach for many small teams. step-ca makes it easier.

⚙️ Many ways to automate

There are several ways to authorize a request with the CA and establish a chain of trust that suits your flow.

You can issue certificates in exchange for:

🏔 Your own private ACME server

ACME is the protocol used by Let's Encrypt to automate the issuance of HTTPS certificates. It's super easy to issue certificates to any ACMEv2 (RFC8555) client.

👩🏽‍💻 An online SSH Certificate Authority

  • Delegate SSH authentication to step-ca by using SSH certificates instead of public keys and authorized_keys files
  • For user certificates, connect SSH to your single sign-on provider, to improve security with short-lived certificates and MFA (or other security policies) via any OAuth OIDC provider.
  • For host certificates, improve security, eliminate TOFU warnings, and set up automated host certificate renewal.

🤓 A general purpose PKI tool, via step CLI integration

Installation

See our installation docs here.

Documentation

Documentation can be found in a handful of different places:

  1. On the web at https://smallstep.com/docs/step-ca.

  2. On the command line with step help ca xxx where xxx is the subcommand you are interested in. Ex: step help ca provisioner list.

  3. In your browser, by running step help --http=:8080 ca from the command line and visiting http://localhost:8080.

  4. The docs folder is being deprecated, but it still has some documentation and tutorials.

Feedback?