# smallstep/certificates

🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.

Repository: https://github.com/smallstep/certificates
Canonical: https://ross.abutalabs.com/products/certificates
Homepage: https://smallstep.com/certificates
Language: Go
License: Apache-2.0
License Family: permissive
Topics: tls, x509, certificates, security, security-tools, certificate-authority, pki, ca, go, acme-server, ssh, acme
Last push: 2026-08-24T21:12:41+00:00

## Health v2 (maintenance only)
Score: 91/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 75, longevity 100
- inputs: {"age_days": 2862, "days_push": 9, "days_rel": 164, "gap_med": 29.0, "n_releases_24m": 11}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 8779, forks 580 (observed 2026-08-28T04:10:25.698516+00:00)

## What it is
step-ca is an online private certificate authority (X.509 and SSH) and ACME server for secure, automated certificate management in DevOps environments. It issues TLS and SSH certificates with SSO and cloud identity integrations, enabling TLS everywhere and certificate-based SSH authentication.

## Use cases
- run a private certificate authority for internal TLS certificates
- issue HTTPS certificates for dev, staging, and internal services that work in browsers
- automate certificate issuance and renewal with an ACME server
- issue short-lived SSH certificates with single sign-on instead of managing authorized_keys
- issue TLS certificates for Kubernetes pods, containers, VMs, and database connections
- replace static API keys and SSH keys with short-lived certificates
- set up certificate-based mTLS authentication between services

## When to choose
- you need a self-hosted private CA for internal TLS without paying public CAs
- you want automated, short-lived certificate lifecycle management via ACME
- you want SSH certificate authentication tied to an identity provider
- you need RFC5280 and CA/Browser Forum compliant certificates for browsers and clients

## When to avoid
- you need multiple certificate authorities, CRL/OCSP active revocation, or high-volume HA CA features
- you need SCEP/NDES, device attestation with TPM/Secure Enclave, or MDM integrations - these are in Smallstep's commercial product
- you want a web admin UI or ACME External Account Binding
- you just need certificates from a public CA for public websites - use Let's Encrypt directly

## Facets
- artifact type: service
- maturity: active
- function: security, cryptography, http-server, api-framework, auth, deployment
- domain: security, networking, self-hosted, infrastructure-as-code
- platform: windows, self-hosted, go, cli
- tags: certificate-authority, pki, x509, ssh-certificates, acme-server, tls, step-ca, zero-trust, short-lived-certificates, devops, linux, macos, docker, kubernetes

## Member repositories
- smallstep/certificates (main) score 91

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:25.698516+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:25:13.715454+00:00, confidence not recorded.
  - readme: https://github.com/smallstep/certificates (fetched 2026-08-28T04:10:25.698516+00:00, sha fd84fdf836de)
  - homepage: https://smallstep.com/certificates (fetched 2026-08-29T08:25:42.506771+00:00, sha 94cc2489dcf7)
  - site_page: https://smallstep.com/docs/platform (fetched 2026-08-29T08:25:42.511448+00:00, sha c8cf6f7dc3d9)
  - site_page: https://smallstep.com/about (fetched 2026-08-29T08:25:42.515510+00:00, sha b4d951adc57c)
  - site_page: https://smallstep.com/webforms/pricing (fetched 2026-08-29T08:25:42.509712+00:00, sha 2b58cb459100)
  - site_page: https://smallstep.com/integrations (fetched 2026-08-29T08:25:42.513630+00:00, sha a68af91100b0)
- Data as of 2026-08-30T08:39:29.467469+00:00.