Self-host step-ca on a VPS
An online certificate authority for your own PKI.
Issue and renew certificates for internal services, with ACME support so it fits existing tooling.
Why self-host step-ca?
step-ca lets you run internal TLS properly — short-lived certs, automatic renewal — without a public CA.
How to install step-ca
- 1
Provision a VPS
Choose a plan with room for your data as well as the app.
- 2
Install the stack
Install Single Go binary.
- 3
Deploy the application
Follow the project’s official install guide for your distribution.
- 4
Enable HTTPS
Serve it on your own domain behind a reverse proxy with a certificate.
- 5
Back it up
Schedule a database dump plus a copy of any uploaded files to an off-box location.
Practical tips
- Give step-ca its own database user with rights only on its own schema.
- Reverse-proxy step-ca and terminate TLS at the proxy so certificates are managed in one place.
- Take a VPS snapshot before major upgrades so you can roll back cleanly.
- Keep step-ca patched — most self-hosting incidents are unpatched software.
Frequently asked questions
- How much RAM does step-ca need?
- Plan on 1 GB for typical use; add headroom if you expect many concurrent users.
- What stack does step-ca run on?
- Single Go binary.
- Can I run other things on the same VPS?
- Yes — size the plan so step-ca plus your other workloads fit in RAM with room to spare.
Looking for something else? Popular alternatives include OpenSSL CA, Vault PKI, Cert-manager/Vault — browse all app guides.
About step-ca
step-ca is open-source software released under the Apache-2.0 licence. HostingSwift does not maintain, sell or support step-ca itself — you install and run it on your own VPS. These are the official links to the project:
- Website: smallstep.com/certificates/
- Source code: github.com/smallstep/certificates
Read the project's own documentation before deploying. We credit upstream projects because we genuinely run and recommend them — see our full open-source directory.