9k stars · Apache-2.0 · v0.30.2 (2026-03-23) · Track this in Scout
A certificate authority you run yourself, for machines the public internet cannot reach.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It runs as a service that signs certificates when something asks for one. It speaks ACME, the same protocol Let's Encrypt uses, so any tool that already renews certificates on its own works against it with one setting changed. It issues X.509 certificates, which is the kind used for TLS, the encryption behind an address beginning https. It also issues SSH certificates, which replace the habit of copying a public key onto every machine by hand. Certificates can be set to last hours rather than months, so a stolen one stops working quickly. Identity can be checked against an existing single sign-on provider, against a cloud machine's own identity document, or against a one-time token. The step command-line tool does the daily work of asking for a certificate and reading one. It does not make certificates the wider internet will trust: a browser on a stranger's machine rejects them until this authority's root certificate has been installed there.
Why it matters
Who it suits. Anyone running more than two or three services that talk to each other on a network the public cannot reach, and who wants those conversations encrypted anyway. It also suits a small team that has grown tired of adding and removing SSH keys on every machine, because an SSH certificate expires by itself. Skip it if everything being run is a public website on a public address, because Let's Encrypt already covers that for nothing and with less to install.
Verdict. Worth the half hour, and the clearest recommendation in this edition. The reason is the one in the headline: FiloSottile/mkcert is the tool most people reach for here, it has 59,500 stars, and no code has been pushed to it since August 2024. mkcert is also a different shape of thing: it makes a certificate once, by hand, for a developer's own machine, and nothing renews it. This one renews. The thing to watch out for is the root key. It is the one secret that matters, and if it leaks, every certificate ever signed with it becomes worthless, so read the project's own page on where to keep it before putting it anywhere permanent. If everything already runs inside Kubernetes, a container scheduler, then cert-manager/cert-manager is the better fit, and the two are often used together.
- Speaks the same protocol as Let's Encrypt, so existing renewal tools need almost no change.
- Does SSH certificates as well as web certificates, which is rare in one tool.
- Short-lived certificates are a setting, not a project.
- The root key has to be protected properly, and getting that wrong undoes the whole point.
- Every machine and browser that should trust it needs its root certificate installed first, which is fiddly on phones.
- The company behind it sells a hosted version, so some documentation pushes gently toward the paid service.
- FiloSottile/mkcert
Makes locally trusted certificates for one developer machine with a single command, which is simpler, but it issues them once by hand and no code has been pushed to it since August 2024.
Track this in Scout - cert-manager/cert-manager
Apache-2.0, the same job inside Kubernetes only, where it watches for expiring certificates and replaces them without being asked.
Track this in Scout
docker run -d --name step-ca \ -v step:/home/step \ -p 9000:9000 \ -e "DOCKER_STEPCA_INIT_NAME=Example" \ -e "DOCKER_STEPCA_INIT_DNS_NAMES=localhost,ca.example.internal" \ smallstep/step-ca
