# Step-ca

Step-ca is a self-hosted network services app. Private Certificate Authority for Unraid, providing trusted HTTPS certificates for services on your LAN and an internal ACME server for automated certificate issuance - built on Smallstep's open-source step-ca. It is open source and self-hosted, installable on Docker Hub, Kubernetes (Helm), Proxmox and Unraid.

Canonical page: https://ourlocalhost.com/app/503/step-ca

## Description

Private Certificate Authority for Unraid, providing trusted HTTPS certificates for services on your LAN and an internal ACME server for automated certificate issuance - built on Smallstep's open-source step-ca. Rather than self-signing each internal service's certificate separately (and having to trust every one of them individually), step-ca lets you run your own CA: trust its single root certificate once, and every certificate it issues - for any internal hostname - is trusted automatically. Pair it with an ACME-capable reverse proxy to issue and renew those certificates without any manual steps. step-ca can also issue SSH certificates and be used as a general-purpose X.509 CA; the ACME/TLS use case above is just the most common reason to run it on Unraid.

## Platform availability

Available on 3 of 9 platforms: Unraid, Proxmox, Helm.

## Health score

81/100 (Excellent), based on 4 of 5 factors.
- Maintained: 100 (last commit 17 days ago)
- Popular: 79 (8,937 GitHub stars)
- Easy to install: 55 (3 install platforms, install notes, Docker image)
- Security check: 73 (no serious findings, 7 minor, CI, tests, OpenSSF Scorecard 7.8/10)

## Links

- Docker Hub: https://hub.docker.com/r/smallstep/step-ca/
- GitHub: https://github.com/smallstep/certificates
- Kubernetes (Helm): https://artifacthub.io/packages/helm/smallstep/step-certificates
- Proxmox: https://community-scripts.github.io/ProxmoxVE/scripts?id=step-ca
- Unraid: https://ca.unraid.net/apps/step-ca-1es2x1r1dsk1wz?q=step-ca
- Official website: https://smallstep.com/certificates

## Common questions

### Which ACME challenge types does step-ca support?

It is an ACME server and supports all popular ACME challenge types.

### Can step-ca issue SSH certificates?

Yes, it can issue SSH certificates for people in exchange for single sign-on identity tokens and for hosts in exchange for cloud instance identity documents.

### Does self-hosted step-ca support active revocation such as CRL or OCSP?

The README lists active revocation (CRL, OCSP) as a feature to consider in Smallstep's commercial CA rather than self-hosted step-ca.

### What policy scopes can be configured on a self-hosted step-ca instance?

A self-hosted step-ca instance can be configured with a policy on the authority level only.

## Alternatives

- CertMate: Self-hosted certificate lifecycle management: issue, renew, discover, inventory and deploy TLS certificates across your infrastructure
- EJBCA
- xca - X Certificate and Key management: X Certificate and Key management is an interface for managing asymetric keys like RSA or DSA.

---
Source: Our Local Host (https://ourlocalhost.com/app/503/step-ca), the self-hosted and open-source app directory.