Smallstep loves open source

Traditional PKI workflows built around OpenSSL scripts, AD CS, CFSSL, manual CRLs, and static certificates were not designed for modern, automated, cloud-native environments. They fail under the demands of ephemeral workloads, Kubernetes clusters, multi-cloud services, Zero Trust architectures, and frequent certificate rotation, where identity must be continuously validated and infrastructure changes constantly.

The Smallstep open-source suite replaces these brittle approaches with a modern, automation-first system. It includes step-ca, a lightweight and automation-friendly certificate authority, and step, a uniform CLI for issuing, renewing, inspecting, and debugging certificates. The platform provides native ACME support, including ACME Device Attestation, Kubernetes-native certificate automation through step-issuer and autocert, cloud workload identity using AWS, GCP, and Azure instance identity documents, and automated mTLS without requiring a service mesh. Together, these tools deliver a scriptable, safe-by-default PKI built for modern infrastructure.

step-ca is optimized for simplicity, automation, and modern identity workflows rather than heavyweight enterprise policy engines. It is designed to be easy to deploy, automate, and integrate into contemporary infrastructure and developer-centric environments.

Its key differentiators include a single-binary architecture with no external dependencies, built-in support for ACME, OIDC and OAuth, SSH certificates, and workload identity, and configuration using JSON or YAML instead of proprietary policy languages. step-ca integrates natively with Kubernetes, cloud providers, and SSO platforms, and is built for highly automated workflows. Rather than attempting to replicate every feature of AD CS or Vault, step-ca modernizes PKI for Zero Trust and cloud identity use cases.

Yes, many organizations run step-ca in production environments. It is production-capable and suitable for real-world use, but operating it at scale requires careful setup and disciplined operations.

Advanced production requirements are addressed by Step CA Pro, which adds enterprise capabilities such as HSM-backed CA keys, online revocation through OCSP, distributed high-availability clustering, SQL-backed durability, enterprise audit logging and metrics, registration authority mode for delegated issuance, and support for compliance frameworks including FIPS binaries and SLAs. Step CA Pro provides the additional hardening needed for regulated or large-scale deployments.

OpenSSL is a general-purpose cryptographic library with a notoriously complex and error-prone interface. While powerful, it was never designed for operational certificate lifecycle management.

The step CLI is built specifically for PKI automation. It provides safe defaults, simplifies CSR generation, certificate inspection, and linting, automates renewal loops, supports ACME client operations, manages JWT and JWK workflows, issues SSH certificates, and handles mTLS development tasks seamlessly. step focuses on making PKI operationally safe and automated rather than exposing low-level cryptographic primitives.

Smallstep provides two Kubernetes-native automation layers for certificate management. step-issuer integrates with cert-manager to allow it to issue mTLS certificates directly from step-ca, while autocert operates as a sidecar or controller that issues and renews certificates automatically without requiring cert-manager.

Both approaches support ACME, ACME Device Attestation, pod and service workload identities, automatic certificate reloads, and multi-cluster deployments. This enables mTLS across microservices without the need for a service mesh.

step-ca integrates directly with AWS instance identity documents, Google Cloud instance identity tokens, and Azure managed identity tokens. Workloads present these cloud provider–signed tokens as cryptographic proof of identity during enrollment.

This approach eliminates shared secrets and manual provisioning, enables automatic rotation, and delivers strong workload identity across cloud environments. There is no need to SSH into hosts, install static keys, or distribute root credentials.

Yes, step-ca includes an SSH certificate authority mode that supports user SSH certificates, host SSH certificates, OIDC-based step ssh login, and automatic host provisioning.

This replaces traditional authorized_keys sprawl with short-lived, identity-bound SSH credentials that are easier to manage and revoke.

The open-source version of step-ca supports ACME-based renewal, automated retry loops and hooks, lightweight CRL generation, and a short-lived certificate model that relies on passive revocation through expiration.

Active online revocation via OCSP and distributed revocation infrastructure are provided by Step CA Pro, as these capabilities require high availability, durable storage, and coordinated signing. In practice, short-lived certificates greatly reduce the operational need for traditional CRLs and OCSP.

step-ca can run in virtually any environment, including Kubernetes through Helm or containers, Linux systemd services, Docker or Docker Compose setups, local developer machines, edge and IoT systems, and any virtual machine or bare-metal host.

Its minimal footprint and no-dependency architecture make it well suited for cloud, on-prem, and hybrid deployments.

Yes, step-ca supports common migration patterns that allow organizations to modernize PKI without disruptive cutovers. These include importing an existing root CA, running step-ca as an intermediate under an existing root, or deploying it as a registration authority in front of legacy certificate authorities.

Organizations also commonly replace SCEP with ACME-based enrollment and migrate static, long-lived certificates to short-lived mTLS certificates. step-ca is designed to coexist with legacy systems, enabling phased and low-risk migrations.

Yes, the open-source CA implements the ACME device-attest-01 challenge and supports TPM 2.0 attestation, Apple device attestation for supervised devices, Chrome Verified Access, and vTPM attestation for cloud virtual machines.

Step CA Pro adds packaged manufacturer trust bundles, enterprise-scale validation, and high-availability and governance controls. The open-source version provides the framework, while Pro delivers the scale and operational safeguards.

Cryptographically, the open-source CA is sufficient, but regulated environments typically require additional operational and compliance guarantees. These include HSM-backed keys, FIPS-validated cryptography, high availability, strong audit trails, policy governance, and formal SLAs.

These requirements are addressed by Step CA Pro rather than the open-source version alone. The OSS edition is well suited for development, internal PKI, and edge workloads, while Step CA Pro is designed for regulated or large-scale enterprise deployments.

Service meshes provide mTLS, but they often introduce significant operational overhead through sidecars, control planes, and complex traffic routing. This complexity can outweigh the benefits, especially outside tightly controlled Kubernetes environments.

Smallstep offers a simpler alternative by providing a general-purpose PKI layer that issues certificates for workloads and devices without requiring sidecars or mesh-specific routing rules. It works across multi-cloud and hybrid environments, and teams commonly use step-ca to simplify mTLS and secure infrastructure that service meshes cannot reach, such as virtual machines, bare metal systems, and IoT devices.