step-ca
Private certificate authority and ACME server for X.509 and SSH
8.8k stars 580 forks last commit first released Apache-2.0
Actively maintained
Last commit 24 Aug 2026.
step-ca is an online private certificate authority for issuing and managing X.509 (TLS) and SSH certificates. It is designed for automated certificate lifecycle management in DevOps environments, including short-lived certificates and multiple enrollment options.
Key Features
- Private ACMEv2 server for automated TLS certificate issuance and renewal
- Issues X.509 server and client certificates (configurable key types and lifetimes)
- SSH certificate authority for user and host certificates
- Multiple provisioning methods, including ACME challenges, OIDC/OAuth tokens, cloud instance identity documents, and JWK-based bootstrapping
- Supports operating as an intermediate CA under an existing root CA
- Pluggable database backends for CA state (including embedded and SQL options)
Use Cases
- Automate internal TLS for services, APIs, containers, and Kubernetes workloads
- Replace static SSH keys with short-lived SSH certificates tied to SSO
- Run a private ACME service for development, staging, and internal production environments
Limitations and Considerations
- Some enterprise PKI features (for example full HA at very high volume, advanced revocation services, or a web admin UI) may require additional tooling or a commercial offering
step-ca is a strong choice for teams that need a flexible private CA with ACME automation and SSH certificate support. It helps standardize identity and trust across infrastructure while reducing manual certificate handling.
Categories:
Tags:
Tech Stack:
Similar to step-ca
Cert Warden
Centralized ACME certificate manager with REST API and UI
Open-source centralized ACME client to manage TLS certificates with automated renewals, API-key retrieval for clients, http-01/dns-01 challenge support, Go backend and React UI.
OpenSSH SFTP server
SFTP server subsystem of the OpenSSH secure-remote-access suite
The sftp-server subsystem in OpenSSH provides SFTP file-transfer services over SSH with support for internal-sftp, chroot jails, public-key and certificate authentication, and protocol extensions.
LLDAP
Lightweight LDAP authentication server with a web UI
LLDAP is a lightweight LDAP server for authentication and user management, providing a simplified LDAP interface, a web admin UI, and SQLite/MySQL/PostgreSQL backends.
OpenSMTPD
Secure, lightweight SMTP server implementation compliant with RFC 5321
OpenSMTPD is an open-source, minimal SMTP daemon from the OpenBSD project providing an RFC-compliant MTA with privilege separation, table backends, filters and TLS support.
OpenVPN
Open-source VPN daemon for TLS-based secure tunneling
OpenVPN is a widely used open-source VPN daemon providing TLS/SSL-based secure tunneling, flexible client-server and site-to-site modes, and cross-platform support.
Soft Serve
Self-hosted Git server with an SSH-accessible terminal UI
Self-hostable Git server focused on SSH, featuring a terminal UI, access control, and Git LFS support, with cloning via SSH, HTTP, or the Git protocol.