← Directory

Step-ca

Private Certificate Authority for Unraid, providing trusted HTTPS certificates for services on your LAN and an internal ACME server for automated certificate…

  • Network Services
  • Other
  • Security
  • Tools & Utilities
Private Certificate Authority for Unraid, providing trusted HTTPS certificates for services on your LAN and an internal ACME server for automated certificate issuance - built on Smallstep's open-source step-ca. Rather than self-signing each internal service's certificate separately (and having to trust every one of them individually), step-ca lets you run your own CA: trust its single root certificate once, and every certificate it issues - for any internal hostname - is trusted automatically. Pair it with an ACME-capable reverse proxy to issue and renew those certificates without any manual steps. step-ca can also issue SSH certificates and be used as a general-purpose X.509 CA; the ACME/TLS use case above is just the most common reason to run it on Unraid.

Platform availability

Available on 3 of 9 platforms

  • Unraid
  • TrueNAS (not listed)
  • Umbrel (not listed)
  • ZimaOS (not listed)
  • Proxmox
  • Helm
  • Mac (not listed)
  • Windows (not listed)
  • Linux (not listed)

Health score?A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). When the source code has been checked, a fifth factor, security check (20%: automated scan for committed secrets, unsafe desktop-app settings, known-vulnerable dependencies and project hygiene; any serious finding caps it at 20), is added. Factors without data are left out and the rest are rescaled.

81/100 Excellent

Maintained
100last commit 17 days ago
Popular
798,937 GitHub stars
Easy to install
553 install platforms, install notes, Docker image
Light to run
No data
Security check
73no serious findings, 7 minor, CI, tests, OpenSSF Scorecard 7.8/10

Based on 4 of 5 factors.

Availability: platform listings confirmed today, links checked 22 days ago

GitHub stars
8,937
Open issues
304
Last commit
2026-10-05
Latest release
v0.30.2
License
Apache-2.0
Activity
declining

Checked 15 days ago - source: GitHub (smallstep/certificates)

Resources & Compatibility

ARM (e.g. Raspberry Pi) is supported.

Checked 23 days ago - source: Docker Hub image tags and published docs

First-install notes

  • Check AWS credentials and port 8083 Set AWS credentials (the keys that identify your account) in environment variables or a saved profile, and make sure port 8083 is reachable. If they're missing or the port is blocked, local Step Functions may fail or you won't be able to connect to it. source
  • Start from a SAM sample app Run sam init to download a sample application, then follow the prompts for template, language, and project name. This gives you a working starting point instead of making the required project files by hand. source
  • Keep your state machine simple and valid Your state machine definition needs a StartAt value and a matching state name under States. If they don't match, Step Functions won't know where to start and the state machine won't run. source
  • First start On first start (when the appdata directory is empty), the container initializes a brand-new root and intermediate CA. source

Fetched 14 days ago - each note links to its source

Alternatives (3)

  • CertMate - Self-hosted certificate lifecycle management: issue, renew, discover, inventory and deploy TLS certificates across your infrastructure
  • EJBCA
  • xca - X Certificate and Key management - X Certificate and Key management is an interface for managing asymetric keys like RSA or DSA.

Checked 20 days ago - source: AlternativeTo

Common questions

Which ACME challenge types does step-ca support?

It is an ACME server and supports all popular ACME challenge types.

Can step-ca issue SSH certificates?

Yes, it can issue SSH certificates for people in exchange for single sign-on identity tokens and for hosts in exchange for cloud instance identity documents.

Does self-hosted step-ca support active revocation such as CRL or OCSP?

The README lists active revocation (CRL, OCSP) as a feature to consider in Smallstep's commercial CA rather than self-hosted step-ca.

What policy scopes can be configured on a self-hosted step-ca instance?

A self-hosted step-ca instance can be configured with a policy on the authority level only.

Answers sourced from github.com, smallstep.com

Community

Collected yesterday - public community threads