step-ca review
A flexible open-source CA for teams automating TLS, mTLS, SSH, and internal PKI.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
step-ca is an open-source online certificate authority for teams managing private infrastructure, Kubernetes workloads, mutual TLS, SSH access, and internal PKI. It issues and manages X.509 certificates for TLS, mTLS, document signing, and authentication, alongside SSH certificates for users and hosts. Windows, macOS, and Linux are supported, with deployment suited to local, cloud, and on-premises environments.
The published model is open source with a free plan, making step-ca a practical fit for teams that want control over certificate authority operations without adopting a proprietary CA platform. Its feature depth is concentrated in automated certificate lifecycle management: ACME enrollment and renewal, SCEP enrollment, configurable provisioners for people and machines, custom X.509 and SSH templates, and policies covering subjects, SANs, and principals. These controls support differentiated issuance for workloads, users, hosts, and services.
Platform fit is a major strength. Kubernetes cert-manager and Envoy Secret Discovery Service integrations connect step-ca to common workload and service-mesh workflows, while Google Cloud KMS, AWS KMS, Azure Key Vault, PKCS#11 HSMs, YubiKey PIV, and TPM 2.0 support provide options for protecting CA keys. The trade-off is operational ownership: teams must manage the CA, database backend, certificate policies, templates, and key-protection architecture themselves. Choose step-ca when an open-source CA with X.509 and SSH coverage is the priority; consider another product if your team wants a more managed PKI experience or a narrower administrative burden.
step-ca pros and cons
- Where it wins
- Supports X.509 and SSH certificate authorities
- Automates enrollment with ACME and SCEP
- Integrates with HSMs, cloud KMS, Kubernetes, and Envoy
- Where it doesn't
- Self-managed operation requires PKI administration
- Policy and template configuration needs technical ownership
- Best suited to teams comfortable with open-source infrastructure
step-ca fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update