alternatives to
Managed private certificate authority on AWS for issuing internal certificates. A closed product from Amazon Web Services.
| Tool | Fit | Stars | Licence | Terms | Self-hosted | Language | Latest | Last push |
|---|---|---|---|---|---|---|---|---|
| step-ca | Full replacement | 8.9k | Apache-2.0 | Open source | Yes | Go | v0.30.2 | 2026-10-05 |
| EJBCA | Full replacement | 960 | LGPL-2.1 | Open source | Yes | Java | r9.6.3 | 2026-09-15 |
| OpenXPKI | Full replacement | 699 | Apache-2.0 | Open source | Yes | Perl | v3.34.0 | 2026-09-26 |
3 alternatives
🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
Private CA with ACME, OIDC and cloud identity provisioners for X.509 and SSH certificates.
EJBCA® – Open-source public key infrastructure (PKI) and certificate authority (CA) software.
Full PKI with multiple CAs, ACME, SCEP, EST and CMP enrollment.
OpenXPKI Code
PKI with configurable workflows and SCEP, EST and RPC enrollment.