step-ca: run your own certificate authority for internal TLS and SSH

step-ca (about 9,000 stars on GitHub) is a private certificate authority written in Go and maintained by Smallstep Labs, the company founded by Mike Malone that also publishes the companion step command line client. The repository was opened in 2018. The problem it solves is familiar to anyone who has run internal services: browsers and tools insist on TLS, public certificate authorities will not issue certificates for private names and addresses, and self-signed certificates have to be distributed and renewed by hand. step-ca lets you run a small CA of your own that issues short-lived certificates automatically.

What it does

step-ca runs as a service and issues X.509 certificates for TLS and certificates for SSH user and host authentication. Clients prove who they are through one of several provisioners: a one-time token from the step client, an ACME endpoint compatible with certbot, Caddy, Traefik and other ACME clients, OpenID Connect identity from a single sign-on provider, cloud instance identity documents from AWS, GCP or Azure, or Kubernetes service accounts. Certificates are short-lived by default, which turns renewal into a routine automated step rather than a yearly emergency. The CA can also act as a registration authority in front of a cloud HSM or another CA.

Who it is for

• Administrators who want HTTPS on internal dashboards, home lab services and development hosts without browser warnings.
• Teams that want SSH certificates instead of managing authorized_keys files on every server.
• Developers who need a local ACME server to test certificate automation before pointing it at Let’s Encrypt.
• Platform teams issuing identities to services for mutual TLS.

How to install and try it

brew install step
step version
step ca init
step-ca $(step path)/config/ca.json

The init command creates a root and intermediate key pair and a configuration file after a few questions; the last command starts the CA. Packages are available for Debian, Ubuntu, Red Hat, Arch, Homebrew, Scoop and as a Docker image. The documentation covers each provisioner, the ACME setup and how to install your root certificate on clients.

Credit

step-ca and the step CLI are developed by Smallstep Labs and contributors. Both are published under the Apache License 2.0; Smallstep also sells a hosted version, but the open source CA is complete for self-hosted use. For encrypting files rather than issuing certificates, see the entry on age.