Side by side

OpenXPKI vs step-ca

Both stand on public key infrastructure software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.

OpenXPKI

Free plan APILinuxSelf-hosted+1

OpenXPKI covers certificate lifecycle workflows, multiple PKI Realms, integrations, and reporting. Community Edition is free; Enterprise Edition and service options list additional modules and support arrangements.

Visit OpenXPKI

step-ca

Free plan Open source APILinuxMac+2

step-ca offers a free, open-source route to automated private certificate issuance, with integrations for multiple identity and key-protection systems. Teams should assess its documented revocation and monitoring gaps before adopting it.

Visit step-ca

The facts

	OpenXPKI	step-ca
Free plan	Yes	Yes
Open source	Not published	Yes
Runs on	API, Linux, Self-hosted, Web	API, Linux, Mac, Self-hosted, Windows
Lowest paid plan	Free or on request	Free or on request
Plans published	3	3
Maker	Not published	Not published
Website	openxpki.org	smallstep.com
On public key infrastructure software	#8 of 26	#4 of 26

OpenXPKI: what it does well

Supports certificate request, renewal, and revocation workflows.
Enrollment interfaces include SCEP, EST, SimpleCMC, and ACME.
A single instance can host multiple PKI Realms.
Supports HSMs through PKCS#11.
Community Edition is free and includes mailing-list support.

What to know first

Community Edition packages are listed for Debian 12.
Community Edition support is through a mailing list.
Commercial support options and SLAs are separate offerings.

step-ca: what it does well

Automates certificate issuance and renewal.
Supports X.509 and SSH certificates.
Integrates with cloud key-management services and HSMs.
Installation options include Linux, Kubernetes, and Docker.

What to know first

Active revocation is limited.
No certificate history or metrics.
No ACME External Account Binding.

Alternatives to OpenXPKI Alternatives to step-ca The whole list