step-ca

Free#13 of 26 in Public Key Infrastructure Software

step-ca: A flexible open-source CA for teams automating TLS, mTLS, SSH, and internal PKI. Ranked #13 of 26 in Public Key Infrastructure Software by our editors (8.1/10); pricing: Free plan; best for open-source TLS, mTLS, and SSH CA.

8.1/10★★★★☆Editor score

Visit step-ca

At a glance

• Editor score
  8.1 / 10
• Pricing
  Free plan
• Best for
  Open-source TLS, mTLS, and SSH CA
• Free plan
  Yes
• Paid from
  Free
• Deployment model
  Hybrid
• Facts checked
  21 Sep 2026

• Where it wins

  • Supports X.509 and SSH certificate authorities
  • Automates enrollment with ACME and SCEP
  • Integrates with HSMs, cloud KMS, Kubernetes, and Envoy

• Where it doesn't

  • Self-managed operation requires PKI administration
  • Policy and template configuration needs technical ownership
  • Best suited to teams comfortable with open-source infrastructure

Our verdict on step-ca

step-ca is an open-source online certificate authority for teams managing private infrastructure, Kubernetes workloads, mutual TLS, SSH access, and internal PKI. It issues and manages X.509 certificates for TLS, mTLS, document signing, and authentication, alongside SSH certificates for users and hosts. Windows, macOS, and Linux are supported, with deployment suited to local, cloud, and on-premises environments.

The published model is open source with a free plan, making step-ca a practical fit for teams that want control over certificate authority operations without adopting a proprietary CA platform. Its feature depth is concentrated in automated certificate lifecycle management: ACME enrollment and renewal, SCEP enrollment, configurable provisioners for people and machines, custom X.509 and SSH templates, and policies covering subjects, SANs, and principals. These controls support differentiated issuance for workloads, users, hosts, and services.

Platform fit is a major strength. Kubernetes cert-manager and Envoy Secret Discovery Service integrations connect step-ca to common workload and service-mesh workflows, while Google Cloud KMS, AWS KMS, Azure Key Vault, PKCS#11 HSMs, YubiKey PIV, and TPM 2.0 support provide options for protecting CA keys. The trade-off is operational ownership: teams must manage the CA, database backend, certificate policies, templates, and key-protection architecture themselves. Choose step-ca when an open-source CA with X.509 and SSH coverage is the priority; consider another product if your team wants a more managed PKI experience or a narrower administrative burden.

Your product? Our editors can test step-ca in depth and publish a review, labelled as paid · from $149/mo →

step-ca pricing

step-ca fact sheet

step-ca integrations

step-ca lists 8 integrations on its own site.

• Kubernetes cert-manager
• Envoy Secret Discovery Service
• Google Cloud KMS
• AWS KMS
• Azure Key Vault
• PKCS#11 HSMs
• YubiKey PIV
• TPM 2.0

See all step-ca integrations →

Alternatives to step-ca

• EJBCAA broad, self-hosted PKI platform with deep certificate and deployment support.9.4
• DigiCert Private CAA flexible private CA for enterprises managing certificates across hybrid and air-gapped environments.9.2
• SSL.com Private Enterprise PKIManaged private PKI with broad enrollment protocols, lifecycle controls, and published plan pricing.9.1

See all step-ca alternatives →

Used step-ca? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used step-ca for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Website

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

5 stars★4 stars★3 stars★2 stars★1 star★

Title

Your review

0 characters · at least 80, up to 3,000

Pros (optional · one per line)

Cons (optional · one per line)

Your name (shown with your review)

Role (optional)

Company (optional)

How long have you used it?Prefer not to sayLess than a month1–6 months6–12 months1–2 years2+ years

I've used step-ca myself and this is my honest opinion — nobody paid or asked me to write it.

Send my reviewPosted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update