step-ca is a private certificate authority and ACME server for automated certificate management across DevOps infrastructure.
The tool addresses the complexity of setting up a public key infrastructure by providing an online CA that automates certificate issuance and renewal. It works by acting as both an X.509 certificate authority for HTTPS and TLS, and an SSH certificate authority, while also implementing the ACME protocol to enable automated certificate provisioning. This dual capability means teams can use a single system to issue browser-valid HTTPS certificates, TLS certificates for infrastructure components like containers and Kubernetes pods, and SSH certificates for both user authentication via single sign-on and host authentication via cloud instance identity documents.
The tool suits small to medium teams building DevOps infrastructure who need certificate automation without the complexity of a full enterprise PKI. It works well for organizations automating certificate management across VMs, containers, APIs, and Kubernetes environments. The README identifies its optimization for two-tier PKI serving common DevOps use cases and notes that teams requiring multiple certificate authorities, active revocation mechanisms like CRL or OCSP, high-volume high-availability setups, device identity and attestation, fine-grained role-based access control, or deep identity provider integration should consider the commercial offering instead.
The project maintains active community engagement through discussions and Discord, with documentation covering installation, ACME basics, and challenge types. Development appears focused on supporting the core use cases of automated certificate issuance and renewal for DevOps workflows, with the tool designed to integrate with existing infrastructure through its Go wrapper library and command-line client companion.
