Home / Marketplace / Smallstep step-ca on Ubuntu 24.04 LTS

Smallstep step-ca on Ubuntu 24.04 LTS

step-ca is an online private certificate authority with ACME support — issue TLS certificates for internal services, mTLS and SSH from a root of trust you own. This image gives you a production-ready deployment within minutes of first boot — no dependency wrangling, no manual hardening checklist. Published and maintained by Derek Coleman & Associates Inc: freshly rebuilt against current security advisories and deployable straight from the Azure Marketplace into your own subscription.

Get it on Azure Marketplace Deploy on Azure Support & quick start

Version: step-ca 0.30.2 (step CLI 0.30.6)Platform: Ubuntu 24.04 LTSPorts: 9000 (CA HTTPS API, ACME)Category: Security & Identity

What's included

Smallstep step-ca installed from the official upstream source
Ubuntu 24.04 LTS base with automatic security updates enabled
No shared or default passwords — a unique admin credential is generated on your VM at first boot
Trusted Launch support: Secure Boot + vTPM
Azure Monitor Agent, Defender for Cloud, and Update Manager install cleanly

Quick start

Deploy from the Azure Marketplace (Get It Now → Create), choosing your SSH key at the Administration step.
Allow inbound SSH (22) for yourself plus the application port(s): 9000 (CA API) — to the clients that need certificates — restrict to your own IP where possible. The in-image firewall already allows them; only the Network Security Group (NSG) keeps them closed.
Bootstrap a client with the CA URL and fingerprint from the credential file (see First login below).
Add an ACME provisioner (`step ca provisioner add acme --type ACME`) to let certbot/Caddy/Traefik enroll automatically.

Get your admin password (one time)

ssh <your-username>@<VM-IP>
sudo cat /root/step-ca-admin-credentials.txt

There is no web login. Trust is established with the root fingerprint; certificates are minted with the provisioner password (or ACME).

Common use cases

Private PKI for internal services
ACME-issued certificates inside a VNet
mTLS between microservices
SSH certificate authority

Why our images

Freshly rebuilt against the latest security advisories, no shared default credentials, Trusted Launch support, and automatic OS security updates — everything runs in your own Azure subscription under your governance.

Need help?

Product support page
support@dcassociatesgroup.com
Contact form