smallstep/certificates v0.28.3-rc2

Step CA v0.28.3-rc2 (25-07-07)

on GitHub

Official Release Artifacts

Linux

• 📦 step-ca_linux_0.28.3-rc2_amd64.tar.gz
• 📦 step-ca_0.28.3.rc2-1_amd64.deb
• 📦 step-ca-0.28.3.rc2-1.x86_64.rpm
• 📦 step-ca_0.28.3.rc2-1_arm64.deb
• 📦 step-ca-0.28.3.rc2-1.aarch64.rpm

OSX Darwin

• 📦 step-ca_darwin_0.28.3-rc2_amd64.tar.gz
• 📦 step-ca_darwin_0.28.3-rc2_arm64.tar.gz

Windows

• 📦 step-ca_windows_0.28.3-rc2_amd64.zip

For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.

Don't see the artifact you need? Open an issue here.

Signatures and Checksums

step-ca uses sigstore/cosign for signing and verifying release artifacts.

Below is an example using cosign to verify a release artifact:

cosign verify-blob \
  --certificate step-ca_darwin_0.28.3-rc2_amd64.tar.gz.pem \
  --signature step-ca_darwin_0.28.3-rc2_amd64.tar.gz.sig \
  --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  step-ca_darwin_0.28.3-rc2_amd64.tar.gz

The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.

Changelog

• 312d1a2 Merge pull request #2325 from smallstep/mariano/httpclient
• 244e610 Merge pull request #2326 from smallstep/mariano/fix-2323
• 1ae78b8 Make poolhttp thread safe.
• 2b13b82 Apply suggestions from code review
• d647ba3 Allow to specify audience when generating JWK provisioner tokens
• b690e12 Remove commented code
• f3c2e94 Address linter errors
• d4fd467 Memory improvements
• a1067ca Merge pull request #2324 from smallstep/dependabot/go_modules/google.golang.org/api-0.239.0
• 8c66606 Bump google.golang.org/api from 0.238.0 to 0.239.0
• 46b1c4c Merge pull request #2315 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.67.0
• 7fcdbac Bump go.step.sm/crypto from 0.66.0 to 0.67.0
• cea37d4 Merge pull request #2316 from smallstep/dependabot/go_modules/google.golang.org/api-0.238.0
• aea6f93 Bump google.golang.org/api from 0.236.0 to 0.238.0
• f8f2768 Merge pull request #2317 from smallstep/dependabot/go_modules/golang.org/x/net-0.41.0
• 3e449b8 Merge pull request #2314 from smallstep/dependabot/go_modules/github.com/urfave/cli-1.22.17
• eb8a126 Bump golang.org/x/net from 0.40.0 to 0.41.0
• ef3684c Bump github.com/urfave/cli from 1.22.16 to 1.22.17
• c6902d1 Merge pull request #2313 from smallstep/dependabot/go_modules/github.com/go-chi/chi/v5-5.2.2
• 7ada4cd Bump github.com/go-chi/chi/v5 from 5.2.1 to 5.2.2
• 915767b Merge pull request #2309 from smallstep/dependabot/github_actions/softprops/action-gh-release-2.3.2
• 60faccd Bump softprops/action-gh-release from 2.2.2 to 2.3.2
• 0603831 Merge pull request #2294 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.39.0
• e2f06c1 Merge branch 'master' into dependabot/go_modules/golang.org/x/crypto-0.39.0
• d9aaa75 Merge pull request #2300 from smallstep/mariano/sans
• c4f2b36 Add the certificate sans to the logs
• 5c2059a Ignore ssh.InsecureKeyAlgoDSA usage from staticcheck linter
• ac2f214 Merge pull request #2293 from smallstep/dependabot/go_modules/github.com/hashicorp/vault/api/auth/aws-0.10.0
• df7fa41 Bump golang.org/x/crypto from 0.38.0 to 0.39.0
• 547322f Bump github.com/hashicorp/vault/api/auth/aws from 0.9.0 to 0.10.0
• 437dc1f Merge pull request #2298 from smallstep/dependabot/go_modules/google.golang.org/api-0.236.0
• 66a32d2 Merge pull request #2299 from smallstep/dependabot/go_modules/github.com/hashicorp/vault/api/auth/approle-0.10.0
• ba5a7ff Bump github.com/hashicorp/vault/api/auth/approle from 0.9.0 to 0.10.0
• 247733d Bump google.golang.org/api from 0.235.0 to 0.236.0
• e8c9c98 Merge pull request #2297 from smallstep/dependabot/go_modules/github.com/hashicorp/vault/api/auth/kubernetes-0.10.0
• 909700f Bump github.com/hashicorp/vault/api/auth/kubernetes from 0.9.0 to 0.10.0
• 3efe7ee Merge pull request #2295 from smallstep/dependabot/go_modules/google.golang.org/grpc-1.73.0
• 675e2a5 Merge pull request #2296 from smallstep/dependabot/go_modules/github.com/hashicorp/vault/api-1.20.0
• 37899f0 Bump github.com/hashicorp/vault/api from 1.16.0 to 1.20.0
• a97d348 Bump google.golang.org/grpc from 1.72.2 to 1.73.0
• a7b4e75 Merge pull request #2290 from smallstep/mariano/metrics
• c26c8d7 Add SSH certificate type to metrics
• 4f5c524 Merge pull request #2287 from smallstep/dependabot/go_modules/google.golang.org/api-0.235.0
• 3007039 Bump google.golang.org/api from 0.234.0 to 0.235.0
• 1a33394 Merge pull request #2286 from smallstep/mariano/csr-templates
• 332aa4b Fix unit tests
• 35bade1 Update go.step.sm/crypto with template improvements
• b0c479a Merge pull request #2283 from smallstep/dependabot/go_modules/google.golang.org/grpc-1.72.2
• 3cf9688 Bump google.golang.org/grpc from 1.72.1 to 1.72.2
• 1949cb0 Merge pull request #2282 from smallstep/dependabot/go_modules/google.golang.org/api-0.234.0
• ed9c0d5 Merge pull request #2281 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.64.0
• b3b1c93 Bump google.golang.org/api from 0.233.0 to 0.234.0
• b22130a Bump go.step.sm/crypto from 0.63.0 to 0.64.0
• 0b0f351 Merge pull request #2277 from smallstep/herman/golangci-lint-v2-and-upgrades
• dd80264 Upgrade github.com/googleapis/gax-go/v2 to v2.14.2
• 2d03c70 Upgrade google.golang.org/grpc to v1.72.1
• acf4387 Fix new golangci-lint v2 linter issues
• 3367a61 Bump google.golang.org/api from 0.232.0 to 0.233.0
• 30e79a2 Merge pull request #2265 from smallstep/dependabot/go_modules/golang.org/x/net-0.40.0
• cde1e01 Bump golang.org/x/net from 0.39.0 to 0.40.0
• c3fddeb Merge pull request #2266 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.38.0
• f6f2151 Bump golang.org/x/crypto from 0.37.0 to 0.38.0
• 2b28391 Merge pull request #2267 from smallstep/dependabot/go_modules/github.com/newrelic/go-agent/v3-3.39.0
• 277cdcc Merge pull request #2269 from smallstep/dependabot/go_modules/google.golang.org/api-0.232.0
• 938a4da Merge pull request #2268 from smallstep/dependabot/go_modules/github.com/google/go-tpm-0.9.5
• 05944ad Bump google.golang.org/api from 0.231.0 to 0.232.0
• 19f3ad9 Bump github.com/google/go-tpm from 0.9.4 to 0.9.5
• 6a9345a Bump github.com/newrelic/go-agent/v3 from 3.38.0 to 3.39.0
• 10933e3 Merge pull request #2257 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.63.0
• b21c307 Bump go.step.sm/crypto from 0.61.0 to 0.63.0
• 9e735b2 Merge pull request #2258 from smallstep/dependabot/go_modules/go.uber.org/mock-0.5.2
• e9b9bcb Merge pull request #2259 from smallstep/dependabot/go_modules/github.com/google/go-tpm-0.9.4
• 33d8553 Merge pull request #2256 from smallstep/dependabot/go_modules/google.golang.org/api-0.231.0
• d33f35c Bump github.com/google/go-tpm from 0.9.3 to 0.9.4
• 5762a91 Bump go.uber.org/mock from 0.5.1 to 0.5.2
• e6d4f4d Bump google.golang.org/api from 0.230.0 to 0.231.0
• 78cb7cc Merge pull request #2252 from smallstep/dependabot/go_modules/google.golang.org/api-0.230.0
• 9974558 Bump google.golang.org/api from 0.229.0 to 0.230.0
• 4b7e539 Merge pull request #2249 from smallstep/dependabot/go_modules/go.step.sm/crypto-0.61.0
• bde672c Merge pull request #2245 from smallstep/dependabot/go_modules/cloud.google.com/go/longrunning-0.6.7
• 0303970 Bump go.step.sm/crypto from 0.60.0 to 0.61.0
• ea54eee Bump cloud.google.com/go/longrunning from 0.6.6 to 0.6.7
• 4fa1a84 Merge pull request #2246 from smallstep/dependabot/go_modules/cloud.google.com/go/security-1.18.5
• de07504 Bump cloud.google.com/go/security from 1.18.4 to 1.18.5
• 92cb7a8 Merge pull request #2248 from smallstep/dependabot/go_modules/google.golang.org/grpc-1.72.0
• e336388 Merge pull request #2244 from smallstep/dependabot/github_actions/softprops/action-gh-release-2.2.2
• a6d2de5 Bump google.golang.org/grpc from 1.71.1 to 1.72.0
• d61c3d9 Bump softprops/action-gh-release from 2.2.1 to 2.2.2
• 0103877 Merge pull request #2243 from smallstep/dependabot/go_modules/golang.org/x/net-0.39.0
• 46839fe Bump golang.org/x/net from 0.38.0 to 0.39.0
• 7d7b4ee Merge pull request #2242 from smallstep/dependabot/go_modules/go.uber.org/mock-0.5.1
• 62e5da4 Merge pull request #2241 from smallstep/dependabot/go_modules/github.com/prometheus/client_golang-1.22.0
• 6f6b090 Bump go.uber.org/mock from 0.5.0 to 0.5.1
• 18ac9f6 Bump github.com/prometheus/client_golang from 1.21.1 to 1.22.0
• e21461d Merge pull request #2239 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.37.0
• e40adee Bump golang.org/x/crypto from 0.36.0 to 0.37.0
• 85fbb41 Merge pull request #2240 from smallstep/dependabot/go_modules/github.com/coreos/go-oidc/v3-3.14.1
• 1d9909f Merge pull request #2238 from smallstep/dependabot/go_modules/google.golang.org/grpc-1.71.1
• 7c32a58 Bump github.com/coreos/go-oidc/v3 from 3.13.0 to 3.14.1
• 7ee4e66 Bump google.golang.org/grpc from 1.71.0 to 1.71.1
• 534e049 Merge pull request #2038 from psiman-wandera/wire_subject_test_coverage
• 78b8f50 Merge pull request #2235 from smallstep/herman/fix-flaky-client-timeout-test
• 8815e60 Fix flaky client timeout test
• 44f505c Add wire subject test coverage
• 60c0b0a Merge pull request #2191 from smallstep/mariano/timeout
• 3135a2c Add default timeout to CA and Admin client
• d8993ac Add option to specify a client timeout
• dd8376c Merge pull request #2233 from smallstep/herman/upgrade-dependencies
• c25c149 Upgrade depenencies
• f94cc2c Merge pull request #2232 from smallstep/dependabot/go_modules/golang.org/x/net-0.38.0
• 7f073dd Remove toolchain and use Go 1.23.7
• 7aebdc2 Bump golang.org/x/net from 0.37.0 to 0.38.0
• 7198f1f Merge pull request #2225 from smallstep/dependabot/go_modules/google.golang.org/api-0.227.0
• f8cfc06 Bump google.golang.org/api from 0.224.0 to 0.227.0
• b5fb1f9 Merge pull request #2224 from smallstep/dependabot/go_modules/github.com/newrelic/go-agent/v3-3.38.0
• 05d25f6 Merge pull request #2223 from smallstep/dependabot/go_modules/google.golang.org/protobuf-1.36.6
• 485b8c8 Merge pull request #2222 from smallstep/dependabot/go_modules/github.com/ccoveille/go-safecast-1.6.1
• 28cbf8c Bump github.com/newrelic/go-agent/v3 from 3.37.0 to 3.38.0
• a8016fe Bump google.golang.org/protobuf from 1.36.5 to 1.36.6
• 1a6d6ce Bump github.com/ccoveille/go-safecast from 1.6.0 to 1.6.1
• 344dfe6 Merge pull request #2220 from smallstep/dependabot/go_modules/github.com/golang-jwt/jwt/v5-5.2.2
• 5e6209a Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2
• 28e9053 Merge pull request #2209 from scop/patch-1
• 78745ba empty commit (#2216)
• f3b9409 Fix cosign cert filename in verify instructions

Thanks!

Those were the changes on v0.28.3-rc2!

Come join us on Discord to ask questions, chat about PKI, or get a sneak peek at the freshest PKI memes.