OpenFrame Gen1 is Here

Smallstep logo

Smallstep

Identity and Access Management (IAM)

Open Source
Self-hosted
E
Enterprise
OpenMSP Score
0
N/A
Reddit Impact Score
Github Score
0
8KStars
546Forks
0
Apache License 2.0License
Mar 23, 2026Last commit

Alternative Vendors

Keycloak
Keycloak
Teleport
Teleport
Authentik
Authentik
CAS
CAS

Commercial Alternatives

Okta
Okta
Azure Active Directory
Azure Active Directory
Huntress
Huntress
Duo Security
Duo Security
Smallstep is a San Francisco-based security company whose flagship open-source project, step-ca, is a private certificate authority for X.509 and SSH certificates, paired with the step CLI for interacting with the CA and managing keys/certs locally. step-ca implements the ACME protocol (including ACME device-attestation), issues short-lived certificates for automated renewal, supports mutual TLS (mTLS) between services, and provisions SSH host/user certificates as an alternative to static SSH keys. It integrates with Kubernetes via the step-issuer/step-cluster-issuer for cert-manager, plus service-account, cloud-identity (AWS/GCP/Azure), OIDC, SCEP, and webhook-based provisioners for automated enrollment. Both step-ca and step CLI are fully open source under the Apache 2.0 license and can be self-hosted for free indefinitely. Smallstep also sells Smallstep Certificate Manager, a commercial hosted/managed PKI platform built on the same open-source engine, adding a web-based admin console, managed hosting/HA, device attestation for MDM-managed fleets, SSH/VPN/Wi-Fi identity products, enterprise support, and compliance attestations - aimed at organizations that want the automation without operating the CA infrastructure themselves.
image media

Key Features

ACME Server

Full ACME protocol support including device-attestation challenges, letting standard ACME clients auto-enroll and renew certificates.

SSH Certificate Authority

Issues short-lived SSH host and user certificates as a passwordless alternative to distributing static SSH keys.

mTLS Automation

Automates mutual TLS certificate issuance/rotation for service-to-service authentication in microservices and zero-trust architectures.

Short-Lived Certificates

Defaults to short certificate lifetimes with automated renewal to reduce reliance on revocation.

cert-manager / Kubernetes Integration

step-issuer and step-cluster-issuer plug step-ca into cert-manager for native Kubernetes TLS issuance.

Multiple Provisioner Types

Supports JWK, OIDC/OAuth SSO, X5C, SSHPOP, SCEP, K8s Service Account, and AWS/GCP/Azure cloud-identity provisioners.

Pros and Cons

Pros

Free and Fully Open Source

Apache 2.0 licensed with no feature gating on the core CA/CLI - usable in production at no cost.

Broad Protocol Support

Native ACME, SSH CA, and mTLS in one binary avoids stitching together separate tools.

Strong Kubernetes/Cloud-Native Fit

First-class cert-manager issuer and cloud-identity provisioners suit containerized and multi-cloud environments.

Automation-First Design

Short-lived certs plus automated renewal reduce manual cert lifecycle work and outage risk from expired certs.

Active, Well-Documented Project

Backed by a funded company with extensive docs, tutorials, and a maintained GitHub repo.

Cons

Requires PKI Expertise

Designing trust hierarchies, provisioners, and renewal policies demands real PKI/security knowledge.

Self-Managed HA/Scaling

Running step-ca in production HA (clustering, database backends, key storage/HSM) is on the operator.

No Built-In Web Admin UI

The open-source CA is CLI/API-driven only; a graphical console is reserved for the paid Certificate Manager.

Best Enterprise Features Are Commercial-Only

SSO for admin access, hosted multi-tenant management, and compliance attestations sit behind the paid product.

Custom/Quote-Based Commercial Pricing

No public pricing for Certificate Manager, making cost comparison harder for smaller MSPs.

Feature Comparison

Comments

No Comments Yet

Be the first to share your experience with Smallstep.

Frequently Asked Questions

Getting Started

OpenMSP is The MSP Knowledge Hub & Community Platform designed specifically for Managed Service Providers seeking to optimize their technology stack, reduce vendor costs, and discover open-source alternatives. We combine a comprehensive vendor directory, open-source solution catalog, and integrated community discussions to help MSPs make informed decisions.
Yes, completely free. Browse vendors and tools, read comparisons, and join community discussions - no cost, no registration required. OpenMSP is community-supported and focused on empowering MSPs to reduce costs and improve operational efficiency through open-source technology.
We help MSPs identify cost-effective alternatives to expensive commercial solutions, provide transparent vendor information, and connect you with proven open-source alternatives. Our platform enables MSPs to make informed decisions about their technology investments.
No account required for browsing vendors, reading comparisons, or accessing community content. Creating a free account with SSO (Microsoft, Google, or Slack) allows you to participate in discussions and save your favorite tools.

Platform Information

OpenMSP is currently community-supported. We focus on providing value to the MSP community first. Any future monetization will keep the core platform free for MSPs while maintaining our independence and commitment to unbiased information.
We focus exclusively on MSP needs with transparent vendor information and open-source alternatives. No vendor partnerships or sponsored listings - just honest, community-driven information to help MSPs make better technology decisions. Our biggest value is our community where MSPs help each other with questions, setup guidance, and sharing real-world experiences.
Our community of MSP professionals helps verify and update information. We also maintain direct research on tools and vendors to ensure accuracy. Community members can report outdated information, and we work to keep everything current.
OpenMSP was founded by Michael Assraf, who has extensive experience in the MSP industry and product leadership. As the former CEO & Founder of Vicarius, Michael grew a startup from $0 to $9M ARR with 500+ customers and deep experience working with MSPs, partners, and fundraising. OpenMSP represents his commitment to empowering the MSP community through better technology decisions and cost optimization.

Open-Source Tools & Alternatives

We assess tools based on active development, community size, documentation quality, production deployments by MSPs, and available support options. Tools must meet strict criteria for reliability and enterprise readiness.
Many open-source projects offer multiple support options including community forums, commercial support from vendors, professional services, and our community discussions where experienced MSPs share implementation guidance.