step-ca

Initialize new CA

$ step ca init

$ step-ca [$(step path)/config/ca.json]

$ step ca certificate [hostname] [host.crt] [host.key]

$ step ca renew [host.crt] [host.key]

$ step ca revoke [host.crt]

$ step ca provisioner add [name] --type [OIDC] --client-id [id] --configuration-endpoint [url]

$ step ca health

$ step ca root

step-ca [config] [options]
step ca command [options]

step-ca is a private certificate authority server. Combined with step ca client commands, it provides automated certificate lifecycle management.
step ca init creates PKI structure with root and intermediate CAs. The resulting configuration defines provisioners, certificate templates, and policies.
Provisioners authenticate certificate requests. Types include ACME, OIDC, JWK, X5C, and SSHPOP. Each provisioner has specific authentication requirements and certificate constraints.
step ca certificate requests certificates using configured provisioners. ACME provisioner enables Let's Encrypt-style automation. Certificates include specified SANs.
Renewal with step ca renew extends certificate lifetime. Pair with step-renewer daemon for automatic renewal. Revocation invalidates certificates before expiration.
step-ca supports ACME protocol, enabling integration with certbot and other ACME clients for automated certificate issuance.

$(step path)/config/ca.json

Main CA server configuration defining address, database, TLS settings, and authority parameters.

Default client settings including CA URL and fingerprint.

Directory containing root and intermediate CA certificates.

Directory containing CA private keys (root and intermediate).

--password-file path

Password file for CA key.

Password for issuer key.

DNS resolver address.

PID file path.

init

Initialize a new PKI and CA configuration.

Request a new certificate.

Renew a certificate.

Revoke a certificate.

Sign a certificate signing request.

Manage provisioners.

Download root certificate.

Check CA health.

Generate authentication token.

Configure client to trust CA.

--san name

Subject Alternative Name (repeatable).

Expiration time or duration.

Provisioner to use.

Key type: EC, RSA, OKP.

Key size.

Overwrite existing files.

Root key security is critical—compromise enables issuing arbitrary certificates. ACME requires proper DNS or HTTP challenge configuration. Certificate templates require understanding of X.509. Production deployments need proper backup and HSM consideration.

step-ca was created by Smallstep and released in 2018 as part of their open-source PKI toolkit. It was designed to bring modern certificate management to internal infrastructure. The project enables zero-trust security through automated certificate issuance. Smallstep offers commercial products built on the open-source foundation.

openssl(1), certbot(1), cfssl(1), vault(1)