Smallstep
Open-source certificate management toolchain for automated internal PKI.
About
Smallstep maintains the leading open-source certificate management toolchain for automated PKI across cloud and on-prem environments. Its step-ca is a private certificate authority for X.509 and SSH certificates with an ACME server, and step is a general-purpose cryptography CLI that issues certificates, verifies JWTs, and handles OAuth and OIDC flows.
The founding thesis is replacing long-lived API keys and static credentials with short-lived certificates for workloads, and its 2026 materials extend that to AI agents and MCP integrations. Paid products include a device identity platform and a managed Certificate Manager, while the open-source core stays free. Founded in 2018, it is widely regarded as one of the most approachable ways to run TLS-everywhere infrastructure.
What it can do
- Private CA for X.509 and SSH certificates
- ACME, OIDC, and one-time-token enrollment
- Short-lived certificates for workloads and agents
- step CLI for certs, JWTs, OAuth, and OTP
Setup
Install step and step-ca via Homebrew or the install scripts, then run step ca init to bootstrap a private CA.
Prerequisites
A server or fleet needing internal certificates.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 96; Trending score 78/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.