step-ca smallstep/step-ca https://hub.docker.com/r/smallstep/step-ca/ bridge bash false https://raw.githubusercontent.com/simonlehmann/unraid-templates/main/step-ca/icon.svg https://[IP]:[PORT:9000]/health Private Certificate Authority for Unraid, providing trusted HTTPS certificates for services on your LAN and an internal ACME server for automated certificate issuance - built on Smallstep's open-source step-ca. Rather than self-signing each internal service's certificate separately (and having to trust every one of them individually), step-ca lets you run your own CA: trust its single root certificate once, and every certificate it issues - for any internal hostname - is trusted automatically. Pair it with an ACME-capable reverse proxy to issue and renew those certificates without any manual steps. step-ca can also issue SSH certificates and be used as a general-purpose X.509 CA; the ACME/TLS use case above is just the most common reason to run it on Unraid. On first start (when the appdata directory is empty), the container initializes a brand-new root and intermediate CA using the "CA Name" and "DNS Names" values below. Keep the appdata volume safe afterwards: it holds your root CA's private key, and must survive container recreation and image upgrades. https://github.com/simonlehmann/unraid-templates/issues https://github.com/smallstep/certificates https://raw.githubusercontent.com/simonlehmann/unraid-templates/main/step-ca/step-ca.xml https://raw.githubusercontent.com/simonlehmann/unraid-templates/main/step-ca/README.md Security: Network: acme pki tls ssh certificate authority ca smallstep step Set "CA Name" and "DNS Names" before the first start - they are only applied while the appdata path is empty. Internet access is only needed to pull the image, not to run the CA. 2026-09-06 Initial template Apache-2.0