π‘οΈ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.
Don't see the artifact you need? Open an issue here.
step-ca uses sigstore/cosign for signing and verifying release artifacts.
Below is an example using cosign to verify a release artifact:
cosign verify-blob \
--certificate step-ca_darwin_0.26.0_amd64.tar.gz.sig.pem \
--signature step-ca_darwin_0.26.0_amd64.tar.gz.sig \
--certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
step-ca_darwin_0.26.0_amd64.tar.gz
The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.
v0.26.0 releaseThose were the changes on v0.26.0!
Come join us on Discord to ask questions, chat about PKI, or get a sneak peek at the freshest PKI memes.
For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.
Don't see the artifact you need? Open an issue here.
step-ca uses sigstore/cosign for signing and verifying release artifacts.
Below is an example using cosign to verify a release artifact:
cosign verify-blob \
--certificate step-ca_darwin_0.26.0-rc2_amd64.tar.gz.sig.pem \
--signature step-ca_darwin_0.26.0-rc2_amd64.tar.gz.sig \
--certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
step-ca_darwin_0.26.0-rc2_amd64.tar.gz
The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.
--yes to acknowledge user prompts for cosign signingThose were the changes on v0.26.0-rc2!
Come join us on Discord to ask questions, chat about PKI, or get a sneak peek at the freshest PKI memes.
For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.
Don't see the artifact you need? Open an issue here.
step-ca uses sigstore/cosign for signing and verifying release artifacts.
Below is an example using cosign to verify a release artifact:
cosign verify-blob \
--certificate step-ca_darwin_0.25.3-rc7_amd64.tar.gz.sig.pem \
--signature step-ca_darwin_0.25.3-rc7_amd64.tar.gz.sig \
--certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
step-ca_darwin_0.25.3-rc7_amd64.tar.gz
The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.
smallstep/assert
userid packageclient shadowing and e2e request ID test caseX-Request-Id header valueX-Request-Id reflectionX-Request-Id response headerX-Request-Id to all requests made by our CA clientsX-Request-Id as canonical request identifier (if available)Sign without contextsmallstep/assert and pkg/errors from webhook testsstretchr/testify instead of smallstep/assert for testsExpires header to CRL responsename in DPoP tokensmallstep/assert with stretchr/testify for ACME provisionerSign in mocksSignWithContext in the critical pathsSignWithContext method to authority and mocksDo methodThose were the changes on v0.25.3-rc7!
Come join us on Discord to ask questions, chat about PKI, or get a sneak peak at the freshest PKI memes.
For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.
Don't see the artifact you need? Open an issue here.
step-ca uses sigstore/cosign for signing and verifying release artifacts.
Below is an example using cosign to verify a release artifact:
cosign verify-blob \
--certificate step-ca_darwin_0.25.3-rc6_amd64.tar.gz.sig.pem \
--signature step-ca_darwin_0.25.3-rc6_amd64.tar.gz.sig \
--certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
step-ca_darwin_0.25.3-rc6_amd64.tar.gz
The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.
Sign without contextsmallstep/assert and pkg/errors from webhook testsstretchr/testify instead of smallstep/assert for testsExpires header to CRL responseSign in mocksSignWithContext in the critical pathsSignWithContext method to authority and mocksDo methodThose were the changes on v0.25.3-rc6!
Come join us on Discord to ask questions, chat about PKI, or get a sneak peak at the freshest PKI memes.
For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.
Don't see the artifact you need? Open an issue here.
step-ca uses sigstore/cosign for signing and verifying release artifacts.
Below is an example using cosign to verify a release artifact:
cosign verify-blob \
--certificate step-ca_darwin_0.25.3-rc5_amd64.tar.gz.sig.pem \
--signature step-ca_darwin_0.25.3-rc5_amd64.tar.gz.sig \
--certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
step-ca_darwin_0.25.3-rc5_amd64.tar.gz
The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.
Those were the changes on v0.25.3-rc5!
Come join us on Discord to ask questions, chat about PKI, or get a sneak peak at the freshest PKI memes.
For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.
Don't see the artifact you need? Open an issue here.
step-ca uses sigstore/cosign for signing and verifying release artifacts.
Below is an example using cosign to verify a release artifact:
cosign verify-blob \
--certificate step-ca_darwin_0.25.3-rc4_amd64.tar.gz.sig.pem \
--signature step-ca_darwin_0.25.3-rc4_amd64.tar.gz.sig \
--certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
step-ca_darwin_0.25.3-rc4_amd64.tar.gz
The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.
UserID and DeviceID
Those were the changes on v0.25.3-rc4!
Come join us on Discord to ask questions, chat about PKI, or get a sneak peak at the freshest PKI memes.
For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.
Don't see the artifact you need? Open an issue here.
step-ca uses sigstore/cosign for signing and verifying release artifacts.
Below is an example using cosign to verify a release artifact:
cosign verify-blob \
--certificate step-ca_darwin_0.25.3-rc3_amd64.tar.gz.sig.pem \
--signature step-ca_darwin_0.25.3-rc3_amd64.tar.gz.sig \
--certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
step-ca_darwin_0.25.3-rc3_amd64.tar.gz
The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.
Those were the changes on v0.25.3-rc3!
Come join us on Discord to ask questions, chat about PKI, or get a sneak peak at the freshest PKI memes.
For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.
Don't see the artifact you need? Open an issue here.
step-ca uses sigstore/cosign for signing and verifying release artifacts.
Below is an example using cosign to verify a release artifact:
cosign verify-blob \
--certificate step-ca_darwin_0.25.2_amd64.tar.gz.sig.pem \
--signature step-ca_darwin_0.25.2_amd64.tar.gz.sig \
--certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
step-ca_darwin_0.25.2_amd64.tar.gz
The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.
Those were the changes on v0.25.2!
Come join us on Discord to ask questions, chat about PKI, or get a sneak peak at the freshest PKI memes.
For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.
Don't see the artifact you need? Open an issue here.
step-ca uses sigstore/cosign for signing and verifying release artifacts.
Below is an example using cosign to verify a release artifact:
cosign verify-blob \
--certificate ~/Downloads/step-ca_darwin_0.25.0_amd64.tar.gz.sig.pem \
--signature ~/Downloads/step-ca_darwin_0.25.0_amd64.tar.gz.sig \
--certificate-identity-regexp "https://github\.com/smallstep/certificates/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
~/Downloads/step-ca_darwin_0.25.0_amd64.tar.gz
The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.
Those were the changes on v0.25.0!
Come join us on Discord to ask questions, chat about PKI, or get a sneak peak at the freshest PKI memes.