wingetCollections
  • Auto
  • Search
  • Awesome Collections
  • Awesome Programs
  • My Favorite Collections
  • My Collections
  • Account / Settings
  • Terms of Service
  • Privacy
  • About

© 2025 winget.ragerworks.com

Loading...
Install step-ca using Winget - wingetCollections
  1. Go back
  2. Packages
  3. step-ca
step-ca logo

step-ca Smallstep

certificates cli smallstep tls
Use this command to install step-ca:
winget install --id=Smallstep.step-ca -e

A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management.

step-ca is a private certificate authority (X.509 & SSH) and ACME server designed to provide secure, automated certificate management for DevOps teams and security professionals.

Key Features:

  • Issues HTTPS server and client certificates compliant with RFC5280 and CA/Browser Forum standards.
  • Manages TLS certificates for DevOps use cases, including VMs, containers, APIs, databases, and Kubernetes pods.
  • Supports SSH certificate issuance for user authentication via single sign-on (SSO) tokens or host identity documents.
  • Enables automated enrollment, renewal, and passive revocation with short-lived certificates.
  • Integrates with multiple provisioners, including OAuth OIDC, ACME, cloud instance identities, and SCEP.
  • Acts as an ACME server compatible with popular clients like certbot, acme.sh, and Caddy.

Audience & Benefit:
Ideal for DevOps teams, security engineers, and organizations seeking to simplify certificate lifecycle management. step-ca helps automate PKI operations, reduce manual overhead, and enhance security by enabling short-lived certificates and seamless integration with existing identity providers and infrastructure tools. It supports both X.509 and SSH use cases, making it a versatile solution for modern DevOps environments.

step-ca can be installed via winget, ensuring easy setup and deployment.

README

step-ca

GitHub release Go Report Card Build Status License CLA assistant

step-ca is an online certificate authority for secure, automated certificate management for DevOps. It's the server counterpart to the step CLI tool for working with certificates and keys. Both projects are maintained by Smallstep Labs.

You can use step-ca to:

  • Issue HTTPS server and client certificates that work in browsers (RFC5280 and CA/Browser Forum compliance)
  • Issue TLS certificates for DevOps: VMs, containers, APIs, database connections, Kubernetes pods...
  • Issue SSH certificates:
    • For people, in exchange for single sign-on identity tokens
    • For hosts, in exchange for cloud instance identity documents
  • Easily automate certificate management:
    • It's an ACME server that supports all popular ACME challenge types
    • It comes with a Go wrapper
    • ... and there's a command-line client you can use in scripts!

Comparison with Smallstep's commercial product

step-ca is optimized for a two-tier PKI serving common DevOps use cases.

As you design your PKI, if you need any of the following, consider our commerical CA:

Versions
0.28.4
0.28.3
0.28.2
0.28.1
0.28.0
0.27.5
0.27.4
0.27.2
0.27.1
0.27.0
show 7 more
Website
github.com
License
Last Updated
7/16/2025
  • Multiple certificate authorities
  • Active revocation (CRL, OSCP)
  • Turnkey high-volume, high availability CA
  • An API for seamless IaC management of your PKI
  • Integrated support for SCEP & NDES, for migrating from legacy Active Directory Certificate Services deployments
  • Device identity — cross-platform device inventory and attestation using Secure Enclave & TPM 2.0
  • Highly automated PKI — managed certificate renewal, monitoring, TPM-based attested enrollment
  • Seamless client deployments of EAP-TLS Wi-Fi, VPN, SSH, and browser certificates
  • Jamf, Intune, or other MDM for root distribution and client enrollment
  • Web Admin UI — history, issuance, and metrics
  • ACME External Account Binding (EAB)
  • Deep integration with an identity provider
  • Fine-grained, role-based access control
  • FIPS-compliant software
  • HSM-bound private keys

    • See our full feature comparison for more.

    You can start a free trial or set up a call with us to learn more.

    Questions? Find us in Discussions or Join our Discord.

    Website | Documentation | Installation | Contributor's Guide

    Features

    🦾 A fast, stable, flexible private CA

    Setting up a public key infrastructure (PKI) is out of reach for many small teams. step-ca makes it easier.

    • Choose key types (RSA, ECDSA, EdDSA) and lifetimes to suit your needs
    • Short-lived certificates with automated enrollment, renewal, and passive revocation
    • Can operate as an online intermediate CA for an existing root CA
    • Badger, BoltDB, Postgres, and MySQL database backends

    ⚙️ Many ways to automate

    There are several ways to authorize a request with the CA and establish a chain of trust that suits your flow.

    You can issue certificates in exchange for:

    • ACME challenge responses from any ACMEv2 client
    • OAuth OIDC single sign-on tokens, eg:
      • ID tokens from Okta, GSuite, Azure AD, Auth0.
      • ID tokens from an OAuth OIDC service that you host, like Keycloak or Dex
    • Cloud instance identity documents, for VMs on AWS, GCP, and Azure
    • Single-use, short-lived JWK tokens issued by your CD tool — Puppet, Chef, Ansible, Terraform, etc.
    • A trusted X.509 certificate (X5C provisioner)
    • A host certificate from your Nebula network
    • A SCEP challenge (SCEP provisioner)
    • An SSH host certificates needing renewal (the SSHPOP provisioner)
    • Learn more in our provisioner documentation

    🏔 Your own private ACME server

    ACME is the protocol used by Let's Encrypt to automate the issuance of HTTPS certificates. It's super easy to issue certificates to any ACMEv2 (RFC8555) client.

    • Use ACME in development & pre-production

    • Supports the most popular ACME challenge types:

      • For http-01, place a token at a well-known URL to prove that you control the web server
      • For dns-01, add a TXT record to prove that you control the DNS record set
      • For tls-alpn-01, respond to the challenge at the TLS layer (as Caddy does) to prove that you control the web server

    • Works with any ACME client. We've written examples for:

      • certbot
      • acme.sh
      • win-acme
      • Caddy
      • Traefik
      • Apache
      • nginx

    • Get certificates programmatically using ACME, using these libraries:

      • lego for Golang (example usage)
      • certbot's acme module for Python (example usage)
      • acme-client for Node.js (example usage)

    • Our own step CLI tool is also an ACME client!

    • See our ACME tutorial for more

    👩🏽‍💻 An online SSH Certificate Authority

    • Delegate SSH authentication to step-ca by using SSH certificates instead of public keys and authorized_keys files
    • For user certificates, connect SSH to your single sign-on provider, to improve security with short-lived certificates and MFA (or other security policies) via any OAuth OIDC provider.
    • For host certificates, improve security, eliminate TOFU warnings, and set up automated host certificate renewal.

    🤓 A general purpose PKI tool, via step CLI integration

    • Generate key pairs where they're needed so private keys are never transmitted across the network
    • Authenticate and obtain a certificate using any provisioner supported by step-ca
    • Securely distribute root certificates and bootstrap PKI relying parties
    • Renew and revoke certificates issued by step-ca
    • Install root certificates on your machine and browsers, so your CA is trusted
    • Inspect and lint certificates

    Installation

    See our installation docs here.

    Documentation

    • Official documentation is on smallstep.com
    • The step command reference is available via step help, on smallstep.com, or by running step help --http=:8080 from the command line and visiting http://localhost:8080.

    Feedback?

    • Tell us what you like and don't like about managing your PKI - we're eager to help solve problems in this space. Join our Discord or GitHub Discussions
    • Tell us about a feature you'd like to see! Request a Feature