CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

security/step-certificates 0.30.2_7

Smallstep step_ca certificates server

0
unaddressed
0
VuXML only
1
fixed
2
open problem reports

Port info

Maintainer
mw@wipp.bayern
Packages
latest: 0.30.2_7
Upstream
up to date
Last update
to 0.30.2_7 · d81b7ba3c3
Quarterly
2026Q4: 0.30.2_7 · last MFH 60647eff54
WWW
https://smallstep.com/certificates/
Links
cgit · VuXML

Install

Package
# pkg install step-certificates
installs 0.30.2_7 from latest; from quarterly (2026Q4) 0.30.2_7
Port
# cd /usr/ports/security/step-certificates && make install clean
Size
12 MiB download · 48 MiB installed
Depends on
devel/pcsc-lite 2.5.2_1,2, security/step-cli 0.30.2_7
License
APACHE20
Creates
user step, group step
pkg-message
Shown after installing
================================================================================
Step Certificates requires additional configuration:

The simple way is via the service start script step_ca with:
service step_ca configure
When there is no configuration it will be created. User input is required!!!

The hard way would be manually via the step command.

Ensure to set the STEPPATH environment variable. This makes using the
commands much simpler.

Following are the defaults for step certificates and can be overridden by rc.conf variables::
* The service is run under user step customizable by step_ca_user
* The service is run inder group step customizable by step_ca_group
* The base directory used for storing CA information is step_ca_stepdir (%%PREFIX%%/etc/step)
* The CA informations is held under step_ca_steppath (%%PREFIX%%/etc/step/ca)
* The password required for automatic startup is in step_ca_password (%%PREFIX%%/etc/step/password.txt)
* By default step certificates logs to syslog with a tag of step_ca

Due to an inconsistency between this message and the rc-script, the rc-script has been renamed from step-ca to step_ca in v0.28.1.
Please be aware of this if you call the rc-script from a custom script.
================================================================================

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 160.30.2_70.30.2_6–
FreeBSD 150.30.2_70.30.2_6–
FreeBSD 140.30.2_70.30.2_60.30.2_7

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 150.30.2_70.30.2_6–
FreeBSD 140.30.2_70.30.2_60.30.2_7

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 0.30.2_7.

Fixed (1)

Show 1 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (2) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
279583maintainer-feedback+ security/step-certificates: support various password-related startup optionsNew2026-09-20
291146maintainer-feedback? security/step-certificates: rc.d sanity check ignores portaclNew2026-06-03

Commits (80)

Dag-Erling Smørgrav (des) · 0.30.2_7 MFH 2026Q4 ✓
various: Bump Go ports for Go 1.26.10 / 1.27.3
d81b7ba3c3
Adam Weinberger (adamw) · 0.30.2_5
many: Bump go ports for 1.26.8 and 1.27.1
dd0905142a
Dag-Erling Smørgrav (des) · 0.30.2_4 MFH 2026Q3 ✓
various: Bump go ports for go-1.25.14 / 1.26.7
4867821cd6
Dag-Erling Smørgrav (des) · 0.30.2_3 MFH 2026Q3 ✓
various: Bump go ports for go-1.25.13 / 1.26.6
6d39dcf04e
Dag-Erling Smørgrav (des) · 0.30.2_2 MFH 2026Q3 ✓
various: Bump go ports for go-1.25.12 / 1.26.5
4ea3547132
Dag-Erling Smørgrav (des) · 0.30.2_1
various: Bump go ports for go-1.25.11 / go-1.26.4
dd8dc2a59d
Vladimir Druzenko (vvd) · 0.30.2
security/step-certificate: Update 0.29.0 => 0.30.2

Changelog:
https://github.com/smallstep/certificates/blob/v0.30.2/CHANGELOG.md

Improve port:
- Remove devel/pcsc-lite from BUILD_DEPENDS - LIB_DEPENDS adds it
  in BUILD_DEPENDS too.
- Replace PORTVERSION with DISTVERSION.
- Remove unnecessary MKDIR.
- Merge 4xINSTALL_MAN in single INSTALL_DATA.
- Exclude LICENSE from installation in DOCSDIR - LICENSE_FILE installs
  it too.

PR:		295798
Sponsored by:	UNIS Labs
Co-authored-by:	Vladimir Druzenko <vvd@FreeBSD.org>
606ad6a97f
Adam Weinberger (adamw) · 0.29.0_6
various: Bump ports for Go 1.25.10
4e243a83f8
Dag-Erling Smørgrav (des) · 0.29.0_5
various: Bump go ports for go-1.25.9 / 1.26.2
7507e72a84
Adam Weinberger (adamw) · 0.29.0_4
various: Bump ports for Go 1.25.8
a8d318da7c
Adam Weinberger (adamw) · 0.29.0_3
various: Bump ports for Go default 1.24->1.25
97685c1886
Adam Weinberger (adamw) · 0.29.0_2
various: Bump Go ports for 1.24.13
529df949a5
Adam Weinberger (adamw) · 0.29.0_1
various: Bump Go ports for 1.24.12
013f2d30b0
Dan Langille (dvl) · 0.29.0
security/step-certificates: Update to 0.29.0

re: https://github.com/smallstep/certificates/security/advisories/GHSA-h8cp-697h-8c8p

PR:		291741
Security:	eca46635-db51-11f0-9b8d-40a6b7c3b3b8

Approved by:	portmgr (blanket)
0c8a89f46e
Dag-Erling Smørgrav (des) · 0.28.4
many: Unpin Go ports

* Ports that were pinned to a deprecated version of Go (1.23 or older)
  have been unpinned.

* Ports that were pinned to a still-supported version of Go (1.24 or
  newer) have been converted to requesting that as their minimum Go
  version.

* Ports that had been forcibly deprecated for pinning an expired Go
  version have been undeprecated.
75d873b56a
Adam Weinberger (adamw) · 0.28.4
many: Unsupported Go dep; deprecate and schedule for removal

There are about 75 ports that depend on old, unsupported Go
versions. I've scheduled those Go versions for deletions on
2025/01/01, and so these ports are scheduled for removal on
that same day.

HOWEVER....

Likely NONE or VERY VERY FEW of these ports will actually need
to be deleted! This stems from a misunderstanding:

When go.mod says "go 1.23", it means that it requires AT LEAST
go-1.23. Locking a port to a specific go version should almost
never happen; it is reserved for when a package absolutely
cannot build with any newer version, and it almost means that
the port will only last 1 year (Go releases new minors twice a
year).

Where a port has
USES=go:1.23
maintainers should attempt build with just
USES=go

If that works, please either commit it or submit it in a PR.

Same goes go
USES=go:1.23,modules
to attempt
USES=go,modules
f45b1d07f5
Hiroki Tagato (tagattie) · 0.28.4
security/step-certificates: update to 0.28.4

Changelog: https://github.com/smallstep/certificates/releases

PR:		288288
Reported by:	Markus Wipp <mw@wipp.bayern> (maintainer)
a7699b4672
Gleb Popov (arrowd) · 0.28.1_4
security/step-certificates: Fix REQUIRE in the rc script

PR:		282139
Approved by:	Markus Wipp <mw@wipp.bayern> (maintainer)
Pull Request:	https://github.com/freebsd/freebsd-ports/pull/311
a25053963a
Adam Weinberger (adamw) · 0.28.1_3
go: Bump ports for go124 update
a4e30d4f4f
Adam Weinberger (adamw) · 0.28.1_2
Bump all go ports for yesterday's releases
d0642a6176
Ashish SHUKLA (ashish) · 0.28.1_1
all: Bump after lang/go122 update

PR:		284181
MFH:		2025Q1
39522060fe
Vladimir Druzenko (vvd) · 0.28.1
security/step-certificates: Update 0.27.5 → 0.28.1, fix issues with rc-script

- Rename rc-script from step-ca to step_ca.
- Fix permission issue in step_ca rc-script.

Changelogs:
https://github.com/smallstep/certificates/releases/tag/v0.28.0
https://github.com/smallstep/certificates/releases/tag/v0.28.1

PR:	283894 282633
7bf02d3f9f
Ashish SHUKLA (ashish) · 0.27.5_1
all: Bump after lang/go122 update

PR:		281842
79271d5381
Vladimir Druzenko (vvd) · 0.27.5
security/step-certificates: Update 0.27.2 → 0.27.5

Changelogs:
https://github.com/smallstep/certificates/releases/tag/v0.27.4
https://github.com/smallstep/certificates/releases/tag/v0.27.5

PR:	282211
320891cd55
Ashish SHUKLA (ashish) · 0.27.2_1
all: Bump after lang/go121 update
aa8c0111bf
Vladimir Druzenko (vvd) · 0.27.2
security/step-certificates: update 0.26.0 → 0.27.2

Changelogs:
https://github.com/smallstep/certificates/releases/tag/v0.26.1
https://github.com/smallstep/certificates/releases/tag/v0.26.2
https://github.com/smallstep/certificates/releases/tag/v0.27.0
https://github.com/smallstep/certificates/releases/tag/v0.27.1
https://github.com/smallstep/certificates/releases/tag/v0.27.2

PR:	280420
fb59aa8101
Ashish SHUKLA (ashish) · 0.26.0_4
all: Bump after lang/go121 update
c4b51c2028
Ashish SHUKLA (ashish) · 0.26.0_3
all: Bump after lang/go121 update

MFH:		2024Q2
746fa696a1
Ashish SHUKLA (ashish) · 0.26.0_2
all: Bump after lang/go121 update

MFH:		2024Q2
fce0cc3272
Ashish SHUKLA (ashish) · 0.26.0_1
all: Bump after lang/go121 update

MFH:		2024Q2
32b284679a
Yasuhiro Kimura (yasu) · 0.26.0
security/step-certificates: Update to version 0.26.0

* Add configure target to rc script
* Adjusted pkg-message
* Pet portclippy

PR:		278035
2a67a2fe3a
Muhammad Moinur Rahman (bofh) · 0.25.2_2
lang/go: Change DEFAULT to 1.21

PR:		277776
Approved by:	portmgr (exp-run)
a5a000df3b
Ashish SHUKLA (ashish) · 0.25.2_1
all: Bump PORTREVISION after lang/go* update

PR:		276530
7e5aa2085f
Koichiro Iwao (meta) · 0.25.2
security/step-certificates: Update to 0.25.2

PR:		275475
af3bf55686
Ashish SHUKLA (ashish) · 0.23.2_4
all: Bump PORTREVISION after lang/go* update

PR:		274405
0505b712df
Dmitri Goutnik (dmgk) · 0.23.2_3
all: Bump PORTREVISION after lang/go* update
8e4bc57934
Dmitri Goutnik (dmgk) · 0.23.2_2
all: Bump PORTREVISION after lang/go{119,120} update
09b993031a
Dmitri Goutnik (dmgk) · 0.23.2_1
all: Bump PORTREVISION after lang/go{119,120} update
ff40d94c1d
Robert Clausecker (fuz) · 0.23.2
security/step-certificates: update to 0.23.2

This update removes the deprecated commands
step-awskms-init, step-cloudkms-init, step-pkcs11-init,
and step-yubikey-init.  step and step-kms-plugin should
be used instead.

Changelog: https://github.com/smallstep/certificates/blob/3c76834/CHANGELOG.md

PR:		270298
909857d026
Dmitri Goutnik (dmgk) · 0.23.1_3
all: Bump PORTREVISION after Go ports update
09079730e9
Dmitri Goutnik (dmgk) · 0.23.1_2
all: Bump PORTREVISION after lang/go{119,120} update
56b5ec772f
Dmitri Goutnik (dmgk) · 0.23.1_1
all: Bump PORTREVISION after GO_DEFAULT update.
2297efc51b
Fernando Apesteguía (fernape) · 0.23.1
security/step-certificates: update to 0.23.1

PR:		268959
Reported by:	mw@wipp.bayern (maintainer)
a5d8b4b185
Dmitri Goutnik (dmgk) · 0.22.0_4
all: Bump PORTVERSION after lang/go{118,119} update
3b383d833a
Dmitri Goutnik (dmgk) · 0.22.0_3
all: Bump PORTREVISION after lang/go{118,119} update
d9ad1002d5
Dmitri Goutnik (dmgk) · 0.22.0_2
all: Bump PORTREVISION after lang/go{118,119} update
bde51869ee
Dmitri Goutnik (dmgk) · 0.22.0_1
all: Bump PORTREVISION after lang/go{118,119} update
f05c98fffb
Stefan Eßer (se) · 0.22.0
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 0.22.0
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
page 1 of 2older →oldest »