Step CA v0.28.4 (25-07-14)

Official Release Artifacts

Linux

• 📦 step-ca_linux_0.28.4_amd64.tar.gz
• 📦 step-ca_0.28.4-1_amd64.deb
• 📦 step-ca-0.28.4-1.x86_64.rpm
• 📦 step-ca_0.28.4-1_arm64.deb
• 📦 step-ca-0.28.4-1.aarch64.rpm

OSX Darwin

• 📦 step-ca_darwin_0.28.4_amd64.tar.gz
• 📦 step-ca_darwin_0.28.4_arm64.tar.gz

Windows

• 📦 step-ca_windows_0.28.4_amd64.zip

For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.

Don't see the artifact you need? Open an issue here.

Signatures and Checksums

step-ca uses sigstore/cosign for signing and verifying release artifacts.

Below is an example using cosign to verify a release artifact:

cosign verify-blob \
  --certificate step-ca_darwin_0.28.4_amd64.tar.gz.pem \
  --signature step-ca_darwin_0.28.4_amd64.tar.gz.sig \
  --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  step-ca_darwin_0.28.4_amd64.tar.gz

The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.

Changelog

• 2c61c44 Update changelog (#2332)
• c86cf07 Merge pull request #2331 from smallstep/mariano/fix-tests
• 831d005 Fix gcp unit tests
• bc09e46 Merge pull request #2133 from ericnorris/feat-gcp-enable-organization-checking
• 0d9f051 Merge branch 'master' into feat-gcp-enable-organization-checking
• 197d0d3 Changelog updates (#2330)
• 2932225 Merge pull request #2329 from smallstep/dependabot/go_modules/google.golang.org/api-0.240.0
• b1dd5a6 Bump google.golang.org/api from 0.239.0 to 0.240.0
• 8b9bd89 refactor: make projectIDs authoritative
• a3db8de feat(gcp): enable organization checking

Thanks!

Those were the changes on v0.28.4!

Come join us on Discord to ask questions, chat about PKI, or get a sneak peek at the freshest PKI memes.

Step CA v0.28.4-rc2 (25-07-13)

Official Release Artifacts

Linux

• 📦 step-ca_linux_0.28.4-rc2_amd64.tar.gz
• 📦 step-ca_0.28.4.rc2-1_amd64.deb
• 📦 step-ca-0.28.4.rc2-1.x86_64.rpm
• 📦 step-ca_0.28.4.rc2-1_arm64.deb
• 📦 step-ca-0.28.4.rc2-1.aarch64.rpm

OSX Darwin

• 📦 step-ca_darwin_0.28.4-rc2_amd64.tar.gz
• 📦 step-ca_darwin_0.28.4-rc2_arm64.tar.gz

Windows

• 📦 step-ca_windows_0.28.4-rc2_amd64.zip

For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.

Don't see the artifact you need? Open an issue here.

Signatures and Checksums

step-ca uses sigstore/cosign for signing and verifying release artifacts.

Below is an example using cosign to verify a release artifact:

cosign verify-blob \
  --certificate step-ca_darwin_0.28.4-rc2_amd64.tar.gz.pem \
  --signature step-ca_darwin_0.28.4-rc2_amd64.tar.gz.sig \
  --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  step-ca_darwin_0.28.4-rc2_amd64.tar.gz

The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.

Changelog

• 7d645e7 Fix a few revive linter issues

Thanks!

Those were the changes on v0.28.4-rc2!

Come join us on Discord to ask questions, chat about PKI, or get a sneak peek at the freshest PKI memes.

Step CA v0.28.4-rc1 (25-07-10)

Official Release Artifacts

Linux

• 📦 step-ca_linux_0.28.4-rc1_amd64.tar.gz
• 📦 step-ca_0.28.4.rc1-1_amd64.deb
• 📦 step-ca-0.28.4.rc1-1.x86_64.rpm
• 📦 step-ca_0.28.4.rc1-1_arm64.deb
• 📦 step-ca-0.28.4.rc1-1.aarch64.rpm

OSX Darwin

• 📦 step-ca_darwin_0.28.4-rc1_amd64.tar.gz
• 📦 step-ca_darwin_0.28.4-rc1_arm64.tar.gz

Windows

• 📦 step-ca_windows_0.28.4-rc1_amd64.zip

For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.

Don't see the artifact you need? Open an issue here.

Signatures and Checksums

step-ca uses sigstore/cosign for signing and verifying release artifacts.

Below is an example using cosign to verify a release artifact:

cosign verify-blob \
  --certificate step-ca_darwin_0.28.4-rc1_amd64.tar.gz.pem \
  --signature step-ca_darwin_0.28.4-rc1_amd64.tar.gz.sig \
  --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  step-ca_darwin_0.28.4-rc1_amd64.tar.gz

The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.

Changelog

• 45643ac Update changelog
• c86cf07 Merge pull request #2331 from smallstep/mariano/fix-tests
• 831d005 Fix gcp unit tests
• bc09e46 Merge pull request #2133 from ericnorris/feat-gcp-enable-organization-checking
• 0d9f051 Merge branch 'master' into feat-gcp-enable-organization-checking
• 197d0d3 Changelog updates (#2330)
• 2932225 Merge pull request #2329 from smallstep/dependabot/go_modules/google.golang.org/api-0.240.0
• b1dd5a6 Bump google.golang.org/api from 0.239.0 to 0.240.0
• 8b9bd89 refactor: make projectIDs authoritative
• a3db8de feat(gcp): enable organization checking

Thanks!

Those were the changes on v0.28.4-rc1!

Come join us on Discord to ask questions, chat about PKI, or get a sneak peek at the freshest PKI memes.

Step CA v0.28.3-rc2 (25-07-07)

Official Release Artifacts

Linux

• 📦 step-ca_linux_0.28.3-rc2_amd64.tar.gz
• 📦 step-ca_0.28.3.rc2-1_amd64.deb
• 📦 step-ca-0.28.3.rc2-1.x86_64.rpm
• 📦 step-ca_0.28.3.rc2-1_arm64.deb
• 📦 step-ca-0.28.3.rc2-1.aarch64.rpm

OSX Darwin

• 📦 step-ca_darwin_0.28.3-rc2_amd64.tar.gz
• 📦 step-ca_darwin_0.28.3-rc2_arm64.tar.gz

Windows

• 📦 step-ca_windows_0.28.3-rc2_amd64.zip

For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.

Don't see the artifact you need? Open an issue here.

Signatures and Checksums

step-ca uses sigstore/cosign for signing and verifying release artifacts.

Below is an example using cosign to verify a release artifact:

cosign verify-blob \
  --certificate step-ca_darwin_0.28.3-rc2_amd64.tar.gz.pem \
  --signature step-ca_darwin_0.28.3-rc2_amd64.tar.gz.sig \
  --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  step-ca_darwin_0.28.3-rc2_amd64.tar.gz

The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.

Changelog

• 312d1a2 Merge pull request #2325 from smallstep/mariano/httpclient
• 244e610 Merge pull request #2326 from smallstep/mariano/fix-2323
• 1ae78b8 Make poolhttp thread safe.
• 2b13b82 Apply suggestions from code review
• d647ba3 Allow to specify audience when generating JWK provisioner tokens
• b690e12 Remove commented code
• f3c2e94 Address linter errors
• d4fd467 Memory improvements
• a1067ca Merge pull request #2324 from smallstep/dependabot/go_modules/google.golang.org/api-0.239.0
• 8c66606 Bump google.golang.org/api from 0.238.0 to 0.239.0
• 46b1c4c Merge pull request #2315 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.67.0
• 7fcdbac Bump go.step.sm/crypto from 0.66.0 to 0.67.0
• cea37d4 Merge pull request #2316 from smallstep/dependabot/go_modules/google.golang.org/api-0.238.0
• aea6f93 Bump google.golang.org/api from 0.236.0 to 0.238.0
• f8f2768 Merge pull request #2317 from smallstep/dependabot/go_modules/golang.org/x/net-0.41.0
• 3e449b8 Merge pull request #2314 from smallstep/dependabot/go_modules/github.com/urfave/cli-1.22.17
• eb8a126 Bump golang.org/x/net from 0.40.0 to 0.41.0
• ef3684c Bump github.com/urfave/cli from 1.22.16 to 1.22.17
• c6902d1 Merge pull request #2313 from smallstep/dependabot/go_modules/github.com/go-chi/chi/v5-5.2.2
• 7ada4cd Bump github.com/go-chi/chi/v5 from 5.2.1 to 5.2.2
• 915767b Merge pull request #2309 from smallstep/dependabot/github_actions/softprops/action-gh-release-2.3.2
• 60faccd Bump softprops/action-gh-release from 2.2.2 to 2.3.2
• 0603831 Merge pull request #2294 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.39.0
• e2f06c1 Merge branch 'master' into dependabot/go_modules/golang.org/x/crypto-0.39.0
• d9aaa75 Merge pull request #2300 from smallstep/mariano/sans
• c4f2b36 Add the certificate sans to the logs
• 5c2059a Ignore ssh.InsecureKeyAlgoDSA usage from staticcheck linter
• ac2f214 Merge pull request #2293 from smallstep/dependabot/go_modules/github.com/hashicorp/vault/api/auth/aws-0.10.0
• df7fa41 Bump golang.org/x/crypto from 0.38.0 to 0.39.0
• 547322f Bump github.com/hashicorp/vault/api/auth/aws from 0.9.0 to 0.10.0
• 437dc1f Merge pull request #2298 from smallstep/dependabot/go_modules/google.golang.org/api-0.236.0
• 66a32d2 Merge pull request #2299 from smallstep/dependabot/go_modules/github.com/hashicorp/vault/api/auth/approle-0.10.0
• ba5a7ff Bump github.com/hashicorp/vault/api/auth/approle from 0.9.0 to 0.10.0
• 247733d Bump google.golang.org/api from 0.235.0 to 0.236.0
• e8c9c98 Merge pull request #2297 from smallstep/dependabot/go_modules/github.com/hashicorp/vault/api/auth/kubernetes-0.10.0
• 909700f Bump github.com/hashicorp/vault/api/auth/kubernetes from 0.9.0 to 0.10.0
• 3efe7ee Merge pull request #2295 from smallstep/dependabot/go_modules/google.golang.org/grpc-1.73.0
• 675e2a5 Merge pull request #2296 from smallstep/dependabot/go_modules/github.com/hashicorp/vault/api-1.20.0
• 37899f0 Bump github.com/hashicorp/vault/api from 1.16.0 to 1.20.0
• a97d348 Bump google.golang.org/grpc from 1.72.2 to 1.73.0
• a7b4e75 Merge pull request #2290 from smallstep/mariano/metrics
• c26c8d7 Add SSH certificate type to metrics
• 4f5c524 Merge pull request #2287 from smallstep/dependabot/go_modules/google.golang.org/api-0.235.0
• 3007039 Bump google.golang.org/api from 0.234.0 to 0.235.0
• 1a33394 Merge pull request #2286 from smallstep/mariano/csr-templates
• 332aa4b Fix unit tests
• 35bade1 Update go.step.sm/crypto with template improvements
• b0c479a Merge pull request #2283 from smallstep/dependabot/go_modules/google.golang.org/grpc-1.72.2
• 3cf9688 Bump google.golang.org/grpc from 1.72.1 to 1.72.2
• 1949cb0 Merge pull request #2282 from smallstep/dependabot/go_modules/google.golang.org/api-0.234.0
• ed9c0d5 Merge pull request #2281 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.64.0
• b3b1c93 Bump google.golang.org/api from 0.233.0 to 0.234.0
• b22130a Bump go.step.sm/crypto from 0.63.0 to 0.64.0
• 0b0f351 Merge pull request #2277 from smallstep/herman/golangci-lint-v2-and-upgrades
• dd80264 Upgrade github.com/googleapis/gax-go/v2 to v2.14.2
• 2d03c70 Upgrade google.golang.org/grpc to v1.72.1
• acf4387 Fix new golangci-lint v2 linter issues
• 3367a61 Bump google.golang.org/api from 0.232.0 to 0.233.0
• 30e79a2 Merge pull request #2265 from smallstep/dependabot/go_modules/golang.org/x/net-0.40.0
• cde1e01 Bump golang.org/x/net from 0.39.0 to 0.40.0
• c3fddeb Merge pull request #2266 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.38.0
• f6f2151 Bump golang.org/x/crypto from 0.37.0 to 0.38.0
• 2b28391 Merge pull request #2267 from smallstep/dependabot/go_modules/github.com/newrelic/go-agent/v3-3.39.0
• 277cdcc Merge pull request #2269 from smallstep/dependabot/go_modules/google.golang.org/api-0.232.0
• 938a4da Merge pull request #2268 from smallstep/dependabot/go_modules/github.com/google/go-tpm-0.9.5
• 05944ad Bump google.golang.org/api from 0.231.0 to 0.232.0
• 19f3ad9 Bump github.com/google/go-tpm from 0.9.4 to 0.9.5
• 6a9345a Bump github.com/newrelic/go-agent/v3 from 3.38.0 to 3.39.0
• 10933e3 Merge pull request #2257 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.63.0
• b21c307 Bump go.step.sm/crypto from 0.61.0 to 0.63.0
• 9e735b2 Merge pull request #2258 from smallstep/dependabot/go_modules...

Step CA v0.28.3 (25-03-18)

Official Release Artifacts

Linux

• 📦 step-ca_linux_0.28.3_amd64.tar.gz
• 📦 step-ca_0.28.3-1_amd64.deb
• 📦 step-ca-0.28.3-1.x86_64.rpm
• 📦 step-ca_0.28.3-1_arm64.deb
• 📦 step-ca-0.28.3-1.aarch64.rpm

OSX Darwin

• 📦 step-ca_darwin_0.28.3_amd64.tar.gz
• 📦 step-ca_darwin_0.28.3_arm64.tar.gz

Windows

• 📦 step-ca_windows_0.28.3_amd64.zip

For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.

Don't see the artifact you need? Open an issue here.

Signatures and Checksums

step-ca uses sigstore/cosign for signing and verifying release artifacts.

Below is an example using cosign to verify a release artifact:

cosign verify-blob \
  --certificate step-ca_darwin_0.28.3_amd64.tar.gz.sig.pem \
  --signature step-ca_darwin_0.28.3_amd64.tar.gz.sig \
  --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  step-ca_darwin_0.28.3_amd64.tar.gz

The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.

Changelog

• 0cf1c56 empty commit
• 78745ba empty commit (#2216)

Thanks!

Those were the changes on v0.28.3!

Come join us on Discord to ask questions, chat about PKI, or get a sneak peek at the freshest PKI memes.

Step CA v0.28.3-rc1 (25-03-18)

Official Release Artifacts

Linux

• 📦 step-ca_linux_0.28.3-rc1_amd64.tar.gz
• 📦 step-ca_0.28.3.rc1-1_amd64.deb
• 📦 step-ca-0.28.3.rc1-1.x86_64.rpm
• 📦 step-ca_0.28.3.rc1-1_arm64.deb
• 📦 step-ca-0.28.3.rc1-1.aarch64.rpm

OSX Darwin

• 📦 step-ca_darwin_0.28.3-rc1_amd64.tar.gz
• 📦 step-ca_darwin_0.28.3-rc1_arm64.tar.gz

Windows

• 📦 step-ca_windows_0.28.3-rc1_amd64.zip

For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.

Don't see the artifact you need? Open an issue here.

Signatures and Checksums

step-ca uses sigstore/cosign for signing and verifying release artifacts.

Below is an example using cosign to verify a release artifact:

cosign verify-blob \
  --certificate step-ca_darwin_0.28.3-rc1_amd64.tar.gz.sig.pem \
  --signature step-ca_darwin_0.28.3-rc1_amd64.tar.gz.sig \
  --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  step-ca_darwin_0.28.3-rc1_amd64.tar.gz

The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.

Changelog

• dfdb779 Changelog for v0.28.3 (#2215)
• d17e2c5 Merge pull request #2214 from smallstep/dependabot/go_modules/github.com/ccoveille/go-safecast-1.6.0
• 4865fdb Bump github.com/ccoveille/go-safecast from 1.5.0 to 1.6.0
• ac9048d Merge pull request #2212 from smallstep/dependabot/go_modules/cloud.google.com/go/security-1.18.4
• 450a350 Bump cloud.google.com/go/security from 1.18.3 to 1.18.4
• 7afff07 Merge pull request #2213 from smallstep/dependabot/go_modules/github.com/coreos/go-oidc/v3-3.13.0
• fa6fd96 Merge pull request #2210 from smallstep/dependabot/go_modules/cloud.google.com/go/longrunning-0.6.6
• 67aaded Bump github.com/coreos/go-oidc/v3 from 3.12.0 to 3.13.0
• 9b7e611 Bump cloud.google.com/go/longrunning from 0.6.5 to 0.6.6
• 6ce27d3 Merge pull request #2205 from smallstep/dependabot/go_modules/golang.org/x/net-0.37.0
• e26f891 Bump golang.org/x/net from 0.35.0 to 0.37.0
• 0cae1f7 Merge pull request #2202 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.59.1
• 8e5db6a Merge pull request #2203 from smallstep/dependabot/go_modules/google.golang.org/api-0.224.0
• 02197ad Bump go.step.sm/crypto from 0.59.0 to 0.59.1
• c3f6a17 Bump google.golang.org/api from 0.223.0 to 0.224.0
• ed2c62d Merge pull request #2204 from smallstep/dependabot/go_modules/github.com/prometheus/client_golang-1.21.1
• 4d44e8c Merge pull request #2206 from smallstep/dependabot/go_modules/cloud.google.com/go/longrunning-0.6.5
• 0644a50 Bump cloud.google.com/go/longrunning from 0.6.4 to 0.6.5
• 32178ed Bump github.com/prometheus/client_golang from 1.21.0 to 1.21.1
• 9b241ec Merge pull request #2196 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.59.0
• f289a00 Bump go.step.sm/crypto from 0.58.0 to 0.59.0
• e782f36 Merge pull request #2197 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.35.0
• b3c3d89 Bump golang.org/x/crypto from 0.34.0 to 0.35.0
• bfc8b0c Merge pull request #2195 from smallstep/dependabot/go_modules/google.golang.org/api-0.223.0
• 69eca5c Merge pull request #2194 from smallstep/dependabot/go_modules/github.com/smallstep/cli-utils-0.12.1
• 7ae7157 Merge pull request #2198 from smallstep/dependabot/go_modules/github.com/newrelic/go-agent/v3-3.37.0
• cfc43f8 Bump github.com/newrelic/go-agent/v3 from 3.36.0 to 3.37.0
• ad635f9 Bump google.golang.org/api from 0.222.0 to 0.223.0
• 4523a13 Bump github.com/smallstep/cli-utils from 0.11.0 to 0.12.1
• 1ef0e4b Merge pull request #2192 from smallstep/dependabot/go_modules/github.com/go-jose/go-jose/v3-3.0.4
• 3f840bd Bump github.com/go-jose/go-jose/v3 from 3.0.3 to 3.0.4
• b5d7f59 Merge pull request #2190 from smallstep/herman/fix-cast-test-32bit
• 8609012 Fix cast package tests on linux/arm32
• 7efdfe5 Merge pull request #2189 from smallstep/dependabot/go_modules/github.com/go-jose/go-jose/v4-4.0.5
• c22889d Bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.5
• b02df4f Merge pull request #2188 from smallstep/dependabot/go_modules/github.com/smallstep/cli-utils-0.11.0
• c3f701f Merge pull request #2184 from smallstep/dependabot/go_modules/google.golang.org/api-0.222.0
• e9dbc98 Bump github.com/smallstep/cli-utils from 0.10.0 to 0.11.0
• 8b6b973 Bump google.golang.org/api from 0.221.0 to 0.222.0
• 37ee518 Merge pull request #2187 from smallstep/herman/fix-ci
• 3c4af2e Use Go 1.23.6 and run go mod tidy
• 87fe3c1 Bump golang.org/x/crypto from 0.33.0 to 0.34.0
• b077a19 Merge pull request #2183 from smallstep/dependabot/go_modules/github.com/google/go-cmp-0.7.0
• 0979b30 Merge pull request #2182 from smallstep/dependabot/go_modules/github.com/prometheus/client_golang-1.21.0
• 1f43c3d Merge pull request #2186 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.58.0
• f30913c Bump go.step.sm/crypto from 0.57.1 to 0.58.0
• 64bfbfd Bump github.com/google/go-cmp from 0.6.0 to 0.7.0
• aec4c80 Bump github.com/prometheus/client_golang from 1.20.5 to 1.21.0

Thanks!

Those were the changes on v0.28.3-rc1!

Come join us on Discord to ask questions, chat about PKI, or get a sneak peek at the freshest PKI memes.

Step CA v0.28.2 (25-02-21)

Official Release Artifacts

Linux

• 📦 step-ca_linux_0.28.2_amd64.tar.gz
• 📦 step-ca_0.28.2-1_amd64.deb
• 📦 step-ca-0.28.2-1.x86_64.rpm
• 📦 step-ca_0.28.2-1_arm64.deb
• 📦 step-ca-0.28.2-1.aarch64.rpm

OSX Darwin

• 📦 step-ca_darwin_0.28.2_amd64.tar.gz
• 📦 step-ca_darwin_0.28.2_arm64.tar.gz

Windows

• 📦 step-ca_windows_0.28.2_amd64.zip

For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.

Don't see the artifact you need? Open an issue here.

Signatures and Checksums

step-ca uses sigstore/cosign for signing and verifying release artifacts.

Below is an example using cosign to verify a release artifact:

cosign verify-blob \
  --certificate step-ca_darwin_0.28.2_amd64.tar.gz.sig.pem \
  --signature step-ca_darwin_0.28.2_amd64.tar.gz.sig \
  --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  step-ca_darwin_0.28.2_amd64.tar.gz

The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.

Changelog

• d21e756 Add changelog for v0.28.2 (#2178)
• d4960a1 Merge pull request #2179 from smallstep/carl/linked-ca-init
• 3e4393e Update copy for linked CA init
• b22e186 Merge pull request #2171 from smallstep/dependabot/go_modules/github.com/smallstep/pkcs7-0.2.1
• 8debf5b Bump github.com/smallstep/pkcs7 from 0.1.1 to 0.2.1
• 8610bf6 Merge pull request #2175 from smallstep/dependabot/go_modules/google.golang.org/api-0.221.0
• f59221b Bump google.golang.org/api from 0.220.0 to 0.221.0
• 3d94255 Merge pull request #2172 from smallstep/dependabot/go_modules/github.com/hashicorp/vault/api/auth/aws-0.9.0
• 0ce1ecd Bump github.com/hashicorp/vault/api/auth/aws from 0.8.0 to 0.9.0
• 497cb20 Merge pull request #2174 from smallstep/dependabot/go_modules/github.com/hashicorp/vault/api/auth/approle-0.9.0
• 9e717d7 Bump github.com/hashicorp/vault/api/auth/approle from 0.8.0 to 0.9.0
• 3db57f7 Merge pull request #2173 from smallstep/dependabot/go_modules/github.com/hashicorp/vault/api/auth/kubernetes-0.9.0
• ed2c5ca Bump github.com/hashicorp/vault/api/auth/kubernetes from 0.8.0 to 0.9.0
• e38dec9 Merge pull request #2167 from smallstep/herman/upgrade-linter
• 27944b4 Fix linter issues
• 86c04f0 Merge pull request #2166 from smallstep/dependabot/go_modules/google.golang.org/api-0.220.0
• e236934 Bump to Go v1.22.12
• dca1c6b Bump google.golang.org/api from 0.219.0 to 0.220.0
• 726e0dc Merge pull request #2164 from smallstep/dependabot/go_modules/github.com/go-chi/chi/v5-5.2.1
• d48c5a1 Merge pull request #2165 from smallstep/dependabot/go_modules/google.golang.org/protobuf-1.36.5
• e0ffc47 Merge pull request #2163 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.33.0
• b3f7349 Bump google.golang.org/protobuf from 1.36.4 to 1.36.5
• 791e2af Bump github.com/go-chi/chi/v5 from 5.2.0 to 5.2.1
• 52a4a1b Bump golang.org/x/crypto from 0.32.0 to 0.33.0
• 3159a74 Merge pull request #2153 from smallstep/dependabot/go_modules/google.golang.org/api-0.219.0
• 1f78066 Merge pull request #2154 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.57.1
• 14b6f61 Bump go.step.sm/crypto from 0.57.0 to 0.57.1
• 9dabb19 Bump google.golang.org/api from 0.218.0 to 0.219.0
• cf1ef2a Merge pull request #2151 from smallstep/dependabot/go_modules/github.com/golang/glog-1.2.4
• f879d10 Bump github.com/golang/glog from 1.2.3 to 1.2.4
• 4ff06cf Merge pull request #2149 from smallstep/dependabot/go_modules/google.golang.org/api-0.218.0
• b4cddb4 Bump google.golang.org/api from 0.217.0 to 0.218.0
• 1df134e Merge pull request #2147 from smallstep/dependabot/go_modules/google.golang.org/protobuf-1.36.4
• c70a072 Bump google.golang.org/protobuf from 1.36.3 to 1.36.4
• 58dca0f Merge pull request #2148 from smallstep/dependabot/go_modules/google.golang.org/grpc-1.70.0
• b0c0344 Bump google.golang.org/grpc from 1.69.4 to 1.70.0
• 93cd8fc Merge pull request #2141 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.57.0
• 6b1a82d Merge pull request #2144 from smallstep/dependabot/go_modules/github.com/newrelic/go-agent/v3-3.36.0
• 775071a Merge pull request #2142 from smallstep/dependabot/go_modules/google.golang.org/api-0.217.0
• 54ea865 Bump google.golang.org/api from 0.216.0 to 0.217.0
• 565cab2 Merge pull request #2143 from smallstep/dependabot/go_modules/google.golang.org/protobuf-1.36.3
• 78979c6 Bump github.com/newrelic/go-agent/v3 from 3.35.1 to 3.36.0
• 9d90fb8 Bump google.golang.org/protobuf from 1.36.2 to 1.36.3
• a291fee Bump go.step.sm/crypto from 0.56.0 to 0.57.0
• a729f1f Merge pull request #2140 from smallstep/herman/fix-download-urls
• d1cfae0 Fix download URLs that were pointing to cli
• 41820c8 Merge pull request #2138 from smallstep/dependabot/go_modules/google.golang.org/grpc-1.69.4
• e76ae73 Bump google.golang.org/grpc from 1.69.2 to 1.69.4
• c5a0249 Merge pull request #2137 from smallstep/dependabot/go_modules/google.golang.org/protobuf-1.36.2
• 97d1692 Merge pull request #2136 from smallstep/dependabot/go_modules/golang.org/x/net-0.34.0
• a7f7a15 Bump golang.org/x/net from 0.33.0 to 0.34.0
• 7a180e4 Bump google.golang.org/protobuf from 1.36.1 to 1.36.2
• b1195f2 Merge pull request #2135 from smallstep/dependabot/github_actions/softprops/action-gh-release-2.2.1
• 57b0378 Merge pull request #2139 from smallstep/dependabot/go_modules/google.golang.org/api-0.216.0
• 6283fe6 Bump google.golang.org/api from 0.214.0 to 0.216.0
• 9f50dd9 Bump softprops/action-gh-release from 2.2.0 to 2.2.1
• 47c08d5 Merge pull request #2131 from smallstep/herman/unflake-request-id-integration-test
• b3fb927 Add comment to requireCAServerToBeAvailable
• c2a6b5b Wait till a connection to the CA host/port can be made
• cda0eec Merge pull request #2129 from smallstep/dependabot/go_modules/cloud.google.com/go/security-1.18.3
• 6796e4f Bump cloud.google.com/go/security from 1.18.2 to 1.18.3
• 98ddef5 Merge pull request #2127 from smallstep/dependabot/go_modules/github.com/coreos/go-oidc/v3-3.12.0
• 1d965aa Merge pull request #2130 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.32.0
• f7cd3ba Bump github.com/coreos/go-oidc/v3 from 3.11.0 to 3.12.0
• 2dd29b1 Merge pull request #2128 from smallstep/dependabot/go_modules/cloud.google.com/go/longrunning-0.6.4
• 1ecf556 Bump golang.org/x/crypto from 0.31.0 to 0.32.0
• 164f9a9 Bump cloud.google.com/go/longrunning from 0.6.3 to 0.6.4
• e57a3ca Merge pull request #2126 from smallstep/herman/upgrade-linkedca-v0.23.0
• f473632 Use github.com/smallstep/linkedca @ v0.23.0
• ...

Step CA v0.28.1 (24-11-20)

Official Release Artifacts

Linux

• 📦 step-ca_linux_0.28.1_amd64.tar.gz
• 📦 step-ca_0.28.1-1_amd64.deb
• 📦 step-ca-0.28.1-1.x86_64.rpm
• 📦 step-ca_0.28.1-1_arm64.deb
• 📦 step-ca-0.28.1-1.aarch64.rpm

OSX Darwin

• 📦 step-ca_darwin_0.28.1_amd64.tar.gz
• 📦 step-ca_darwin_0.28.1_arm64.tar.gz

Windows

• 📦 step-ca_windows_0.28.1_amd64.zip

For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.

Don't see the artifact you need? Open an issue here.

Signatures and Checksums

step-ca uses sigstore/cosign for signing and verifying release artifacts.

Below is an example using cosign to verify a release artifact:

cosign verify-blob \
  --certificate step-ca_darwin_0.28.1_amd64.tar.gz.sig.pem \
  --signature step-ca_darwin_0.28.1_amd64.tar.gz.sig \
  --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  step-ca_darwin_0.28.1_amd64.tar.gz

The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.

Changelog

• d327203 Add a few PRs to the 0.28.1 changelog (#2079)
• f5b45d8 Changelog for 0.28.1 (#2078)
• f88a136 Merge pull request #2076 from smallstep/jdoss/repos
• 354af7f Merge branch 'master' into jdoss/repos
• c0d41d7 Add p11-kit package.
• cd57b50 Add in PKCS11 packages.
• 7c9e3ff Merge pull request #2077 from smallstep/jdoss/HSM_container_packages
• ae54b5a Add p11-kit package.
• e63b649 Make script +x.
• 0851563 Add in PKCS11 packages.
• 330b28f Merge branch 'master' into jdoss/repos
• b1c3d18 Merge pull request #2072 from smallstep/dependabot/go_modules/google.golang.org/api-0.206.0
• e0196e4 Bump google.golang.org/api from 0.205.0 to 0.206.0
• 61af4c3 Merge pull request #2074 from smallstep/dependabot/go_modules/google.golang.org/protobuf-1.35.2
• 2847fbd Merge pull request #2073 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.54.2
• b9296c1 Merge pull request #2075 from smallstep/dependabot/go_modules/github.com/googleapis/gax-go/v2-2.14.0
• 2b4894a Configure GitHub Actions to publish RPMs and Debs to packages.smallstep.com.
• a0048b4 Bump github.com/googleapis/gax-go/v2 from 2.13.0 to 2.14.0
• e9a1a7b Bump google.golang.org/protobuf from 1.35.1 to 1.35.2
• 35bc30b Bump go.step.sm/crypto from 0.54.0 to 0.54.2
• 707f537 Merge pull request #2071 from smallstep/dependabot/github_actions/softprops/action-gh-release-2.1.0
• fc007df Bump softprops/action-gh-release from 2.0.9 to 2.1.0
• 7eccbc5 Merge pull request #2069 from smallstep/mariano/urn
• 1a2e647 Change URN for acme errors
• 73f97e2 Ignore non-constant format string linting error (#2068)
• fdaa665 Merge pull request #2066 from smallstep/mariano/webhook-errors
• 05295d9 Propagate human errors from webhooks
• 2f7690c Merge pull request #2065 from smallstep/mariano/challenge-webhook
• ff37bf1 Add unit tests for scepchallenge webhooks
• f2663dd Add data support on SCEPCHALLENGE webhooks
• 295892e Merge pull request #2060 from smallstep/dependabot/go_modules/google.golang.org/api-0.205.0
• 15e9041 Bump google.golang.org/api from 0.204.0 to 0.205.0
• 8465db8 Merge pull request #2062 from smallstep/dependabot/go_modules/golang.org/x/net-0.31.0
• 8313e47 Bump golang.org/x/net from 0.30.0 to 0.31.0
• c4c0d92 Merge pull request #2061 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.29.0
• 6dda3c1 Bump golang.org/x/crypto from 0.28.0 to 0.29.0
• e82c228 Merge pull request #2057 from smallstep/dependabot/github_actions/softprops/action-gh-release-2.0.9
• 59deaa5 Merge pull request #2058 from smallstep/dependabot/go_modules/google.golang.org/api-0.204.0
• 1ab27b1 Bump google.golang.org/api from 0.203.0 to 0.204.0
• 0a0dfc0 Bump softprops/action-gh-release from 2.0.8 to 2.0.9

Thanks!

Those were the changes on v0.28.1!

Come join us on Discord to ask questions, chat about PKI, or get a sneak peek at the freshest PKI memes.

Step CA v0.28.1-rc2 (24-11-19)

Official Release Artifacts

Linux

• 📦 step-ca_linux_0.28.1-rc2_amd64.tar.gz
• 📦 step-ca_0.28.1.rc2-1_amd64.deb
• 📦 step-ca-0.28.1.rc2-1.x86_64.rpm
• 📦 step-ca_0.28.1.rc2-1_arm64.deb
• 📦 step-ca-0.28.1.rc2-1.aarch64.rpm

OSX Darwin

• 📦 step-ca_darwin_0.28.1-rc2_amd64.tar.gz
• 📦 step-ca_darwin_0.28.1-rc2_arm64.tar.gz

Windows

• 📦 step-ca_windows_0.28.1-rc2_amd64.zip

For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.

Don't see the artifact you need? Open an issue here.

Signatures and Checksums

step-ca uses sigstore/cosign for signing and verifying release artifacts.

Below is an example using cosign to verify a release artifact:

cosign verify-blob \
  --certificate step-ca_darwin_0.28.1-rc2_amd64.tar.gz.sig.pem \
  --signature step-ca_darwin_0.28.1-rc2_amd64.tar.gz.sig \
  --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  step-ca_darwin_0.28.1-rc2_amd64.tar.gz

The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.

Changelog

• 35c1054 Testing
• e63b649 Make script +x.
• 330b28f Merge branch 'master' into jdoss/repos
• b1c3d18 Merge pull request #2072 from smallstep/dependabot/go_modules/google.golang.org/api-0.206.0
• e0196e4 Bump google.golang.org/api from 0.205.0 to 0.206.0
• 61af4c3 Merge pull request #2074 from smallstep/dependabot/go_modules/google.golang.org/protobuf-1.35.2
• 2847fbd Merge pull request #2073 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.54.2
• b9296c1 Merge pull request #2075 from smallstep/dependabot/go_modules/github.com/googleapis/gax-go/v2-2.14.0
• 2b4894a Configure GitHub Actions to publish RPMs and Debs to packages.smallstep.com.
• a0048b4 Bump github.com/googleapis/gax-go/v2 from 2.13.0 to 2.14.0
• e9a1a7b Bump google.golang.org/protobuf from 1.35.1 to 1.35.2
• 35bc30b Bump go.step.sm/crypto from 0.54.0 to 0.54.2
• 707f537 Merge pull request #2071 from smallstep/dependabot/github_actions/softprops/action-gh-release-2.1.0
• fc007df Bump softprops/action-gh-release from 2.0.9 to 2.1.0
• 7eccbc5 Merge pull request #2069 from smallstep/mariano/urn
• 1a2e647 Change URN for acme errors
• 73f97e2 Ignore non-constant format string linting error (#2068)
• fdaa665 Merge pull request #2066 from smallstep/mariano/webhook-errors
• 05295d9 Propagate human errors from webhooks
• 2f7690c Merge pull request #2065 from smallstep/mariano/challenge-webhook
• ff37bf1 Add unit tests for scepchallenge webhooks
• f2663dd Add data support on SCEPCHALLENGE webhooks
• 295892e Merge pull request #2060 from smallstep/dependabot/go_modules/google.golang.org/api-0.205.0
• 15e9041 Bump google.golang.org/api from 0.204.0 to 0.205.0
• 8465db8 Merge pull request #2062 from smallstep/dependabot/go_modules/golang.org/x/net-0.31.0
• 8313e47 Bump golang.org/x/net from 0.30.0 to 0.31.0
• c4c0d92 Merge pull request #2061 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.29.0
• 6dda3c1 Bump golang.org/x/crypto from 0.28.0 to 0.29.0
• e82c228 Merge pull request #2057 from smallstep/dependabot/github_actions/softprops/action-gh-release-2.0.9
• 59deaa5 Merge pull request #2058 from smallstep/dependabot/go_modules/google.golang.org/api-0.204.0
• 1ab27b1 Bump google.golang.org/api from 0.203.0 to 0.204.0
• 0a0dfc0 Bump softprops/action-gh-release from 2.0.8 to 2.0.9

Thanks!

Those were the changes on v0.28.1-rc2!

Come join us on Discord to ask questions, chat about PKI, or get a sneak peek at the freshest PKI memes.

Release v0.28.1-rc1

Testing