# smallstep

Source: https://startwithidentity.com/vendors/pki/smallstep/
Last updated: 2026-06-19
License: content by Start with Identity. Cite the source URL.

---

## Overview

Smallstep (founded 2016, privately held) builds open-source and commercial tooling for automated private PKI, device identity, and short-lived certificates. Its open-source step-ca and step CLI are widely adopted by engineering teams rolling out mutual TLS and workload identity. In the [PKI and certificate lifecycle category](https://startwithidentity.com/vendors/pki/) it sits at the developer-first, cloud-native end, focused on internal trust rather than public, browser-trusted certificates.

## What it is good at

Developer experience and automation are the standout. step-ca is a lightweight private CA that supports ACME, short-lived certificates, and automated renewal, making mTLS between services and devices practical without manual cert handling. The tooling fits cloud-native and Kubernetes environments cleanly and treats certificates as ephemeral [machine identity](https://startwithidentity.com/guides/fundamentals/what-is-machine-identity/) rather than long-lived artifacts to babysit. The open-source core lowers the barrier to adoption, and commercial tiers add managed hosting, device identity, and team features.

## Where it falls short

Smallstep issues private trust, not public, browser-trusted certificates, so it does not replace a public CA for internet-facing TLS. It is also not a turnkey enterprise CLM with heavy governance, broad multi-CA discovery, and compliance reporting, which large regulated estates often require. The focus is depth in internal PKI and device identity rather than breadth across an enterprise certificate fleet.

## Pricing

Open-source core (step-ca, step CLI) is free to self-operate. Managed and enterprise tiers are usage-based, adding hosting, device identity, and team management. Model managed versus self-hosted cost with the [TCO calculator](https://startwithidentity.com/tools/tco-calculator/).

## Best for, and who should look elsewhere

Choose Smallstep when engineering teams need automated internal PKI, short-lived certificates, and mTLS for services and devices. For public, browser-trusted certificates, use [DigiCert](https://startwithidentity.com/vendors/pki/digicert/), [Sectigo](https://startwithidentity.com/vendors/pki/sectigo/), or [GlobalSign](https://startwithidentity.com/vendors/pki/globalsign/); for enterprise multi-CA CLM and governance, [Keyfactor](https://startwithidentity.com/vendors/pki/keyfactor/) or [AppViewX](https://startwithidentity.com/vendors/pki/appviewx/).

## Bottom line

A developer-friendly, automation-first choice for private PKI, device identity, and mTLS, best for cloud-native teams rather than public-trust or heavy-governance needs.