Awesome Open Source
Awesome Open Source

Step CLI

GitHub release Go Report Card Build Status License CLA assistant

GitHub stars Twitter followers

step is an easy-to-use CLI tool for building, operating, and automating Public Key Infrastructure (PKI) systems and workflows. It's the client counterpart to the step-ca online Certificate Authority (CA). You can use it for many common crypto and X.509 operations—either independently, or with an online CA.

Questions? Ask us on GitHub Discussions or Discord.

Website | Documentation | Installation | Basic Crypto Operations | Contributor's Guide


Step CLI's command groups illustrate its wide-ranging uses:

  • step certificate: Work with X.509 (TLS/HTTPS) certificates.

    • Create, revoke, validate, lint, and bundle X.509 certificates.
    • Install (and remove) X.509 certificates into your system's (and brower's) trust store.
    • Validate certificate deployment and renewal status for automation
    • Create key pairs (RSA, ECDSA, EdDSA) and certificate signing requests (CSRs)
    • Sign CSRs
    • Create RFC5280 and CA/Browser Forum-compliant certificates that work for TLS and HTTPS
    • Create CA certificates (root and intermediate signing certificates)
    • Create self-signed & CA-signed certificates
    • Inspect and lint certificates on disk or in use by a remote server
    • Install root certificates so your CA is trusted by default (issue development certificates that work in browsers)
  • step ca: Administer and use a step-ca server, or any ACMEv2 (RFC8555) compliant CA server. ACME is the protocol used by Let's Encrypt to automate the issuance of HTTPS certificates.

  • step crypto: A general-purpose crypto toolkit

  • step oauth: Add an OAuth 2.0 single sign-on flow to any CLI application.

    • Supports OAuth authorization code, out-of-band (OOB), JWT bearer, and refresh token flows
    • Get OAuth access tokens and OIDC identity tokens at the command line from any provider.
    • Verify OIDC identity tokens (step crypto jwt verify)
  • step ssh: Create and manage SSH certificates (requires an online or offline step-ca instance)

    • Generate SSH user and host key pairs and short-lived certificates
    • Add and remove certificates to the SSH agent
    • Inspect SSH certificates
    • Login and use single sign-on SSH


See our installation docs here.


Here's a quick example, combining step oauth and step crypto to get and verify the signature of a Google OAuth OIDC token:

Animated terminal showing step in practice


Further Reading

Alternatives To Cli
Select To Compare

Alternative Project Comparisons
Related Awesome Lists
Top Programming Languages
Top Projects

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
Go (161,144
Security (31,799
Token (29,687
Ssh (14,428
Oauth (14,231
Encryption (11,916
Certificate (11,219
Cryptography (10,910
Jwt (9,904
Sign (7,514
Tls (4,953
Verify (3,618
Sso (2,027
Security Tools (1,973
Oidc (1,033
Totp (801
Mfa (759
Jose (581
X509 (389
Oath (243
Jws (237
Jwe (142