Self-host step-ca
updated Oct 2026deployed by usprices checked · Jul 2026Install verified on Ubuntu 26.04 · Oct 2026 · how we test
We earn commissions when you shop through the links below. Full disclosure →
An online certificate authority from Smallstep for automated certificate management: it issues X.509 certificates for HTTPS and TLS and SSH certificates, and runs an ACME server so ACME clients can request certificates from it. In the Docker image it initialises itself on first start from environment variables.
Key facts
CategorySecurity
LicenseApache-2.0
StackGo
Min RAM128 MB
Official imageyes
Measured idle RAM13 MB
Last commitOctober 23, 2026
Last releasev0.30.2, March 23, 2026
CheckedGitHub, October 25, 2026
Difficulty
Runs on a VPS from $4/mo (Kamatera 1GB, 1 GB RAM) · prices checked Sep 2026
Our recommendation
Pick step-ca when you need your own certificate authority for internal services: the README describes it as an online CA for secure, automated certificate management that issues X.509 certificates for HTTPS and TLS, issues SSH certificates (to people in exchange for single sign-on tokens and to hosts in exchange for cloud instance identity documents) and runs an ACME server that works with ACMEv2 clients. Authorization comes from provisioners such as ACME, OIDC, cloud identity documents, single-use JWK tokens and X5C. It is Apache-2.0 Go, and the Docker image initialises itself on first start from `DOCKER_STEPCA_INIT_*` variables. Our snippet is the Docker Hub setup as a Compose file, pinned to a release tag, with an ACME provisioner enabled. We did not find an upstream RAM minimum, so our 128 MB floor is an estimate. The catalog's Caddy and Traefik can obtain certificates from an ACME server, which is how most people use a private CA.
What you need
- Any VPS with at least 128 MB of RAM
- A domain you control — most self-hosted setups need HTTPS in front of them
- Under an hour if you've used Docker before
Where to host itaffiliate disclosure
Hetzner Cloudrun it on
From $23.59/mo · 2 vCPU / 4 GB / 80 GB · EU + USKamaterafree trial
From $4/mo · 1 vCPU / 1 GB / 20 GB · US + EU + AsiaDigitalOceanalso works on
From $6/mo · 1 vCPU / 1 GB / 25 GB · US + EU + AsiaPaid link — we earn a commission if you shop through it.
Install
Run these commands on your server:
# step-ca — private certificate authority — based on the project's Docker image docs, pinned to 0.30.2
cat > docker-compose.yml <<'EOF'
services:
step-ca:
image: smallstep/step-ca:0.30.2
restart: unless-stopped
ports:
- 9000:9000
environment:
DOCKER_STEPCA_INIT_NAME: Example Internal CA
DOCKER_STEPCA_INIT_DNS_NAMES: localhost,SERVER_IP
DOCKER_STEPCA_INIT_ACME: "true"
volumes:
- step_data:/home/step
volumes:
step_data:
EOF
docker compose up -d
timeout 120 bash -c 'until curl -ksf https://localhost:9000/health >/dev/null; do sleep 3; done'
docker compose logs step-ca | grep -i -E "password|fingerprint" | head
# → https://SERVER_IP:9000/healthWhat you take on
step-ca's Docker Hub page and README flag these before it becomes your root of trust:
non-negotiableThe DOCKER_STEPCA_INIT_* variables are read only once, before the first run. The generated CA password and the root certificate fingerprint appear in the container logs (our snippet prints them); copy both, because clients need the fingerprint to bootstrap trust, and the page also shows how to read the fingerprint later. The page marks setting the password through an environment variable as not recommended and offers DOCKER_STEPCA_INIT_PASSWORD_FILE for a Docker secret.
non-negotiableDOCKER_STEPCA_INIT_NAME and DOCKER_STEPCA_INIT_DNS_NAMES are required; the DNS names or IPs are the ones clients will use to reach the CA, so replace the SERVER_IP placeholder with your own. The CA serves HTTPS on port 9000 with its own certificate, so a plain http:// request answers 400 and the health check is https://localhost:9000/health.
non-negotiableThe CA keys, configuration and database live in /home/step, which our step_data volume holds. Losing it means every certificate issued under that root has to be replaced, so back it up and keep the root key protected.
non-negotiableThe README says step-ca is optimized for a two-tier PKI serving common DevOps use cases and points to Smallstep's commercial product for multiple CAs, CRL and OCSP revocation, high availability, FIPS software, HSM-bound keys and role-based access control.
More self-hosted tools
Security
2FAuth
PHPLaravelSQLite
easyRead guide →
Security
CrowdSec
GoSQLite
moderateRead guide →
File sync & storage
Syncthing
Go
easyRead guide →
SSO & Identity
Tinyauth
Go
easyRead guide →