install

Additional install commands

macOS

Homebrewverified · 100%

brew install certstrap

local Homebrew formula metadata

MacPortsverified · 94%

sudo port install certstrap

MacPorts ports tree · security/certstrap/Portfile · source: api.github.com

Linux

Alpine Linux apkverified · 92%

sudo apk add certstrap

Alpine Linux edge package indexes · certstrap · source: dl-cdn.alpinelinux.org

Nixverified · 92%

nix profile install nixpkgs#certstrap

nixpkgs package indexes · pkgs/by-name/ce/certstrap/package.nix · source: api.github.com

Windows

Scoopverified · 92%

scoop install main/certstrap

Scoop official bucket manifest trees · bucket/certstrap.json · source: api.github.com

overview

Package summary

Tools to bootstrap CAs, certificate requests, and signed certificates

Project links

Commands and aliases

certstrap

history

Project history and usage

certstrap is Square's Go-based CLI for bootstrapping certificate authorities, certificate requests, and signed certificates. Its README describes it as a simple certificate manager adapted from etcd-ca and intended as a friendlier alternative to hand-writing OpenSSL commands and config files.

Project history

The public repository was created in 2015 and the release history includes v1.0.0/v1.0.1 in 2016, later 1.1 and 1.2 releases, and v1.3.0 in 2022. The project documents building from source with Go and contributing through the upstream repository.

Adoption history

certstrap became a packaged PKI helper across multiple ecosystems. The supplied package facts list APK, Homebrew, MacPorts, Nix, and Scoop packages, matching its role as a small standalone executable for development and internal PKI workflows.

How it is used

Typical certstrap usage starts by initializing a CA, then generating identity keys and CSRs, and finally signing certificate requests. By default, generated keys, CSRs, certificates, and CRLs are placed in the depot directory, documented as out/.

Why package nerds care

certstrap matters in package catalogs because it turns the brittle OpenSSL local-CA bootstrap routine into a reproducible CLI. It is especially visible to developers who need throwaway or internal TLS material without adopting a larger PKI system.

Timeline

2015: Public GitHub repository created.
2016: v1.0.0 and v1.0.1 releases published.
2017: v1.1.x releases published.
2019: v1.2.0 released.
2022: v1.3.0 released.

Related projects

The README says certstrap was adapted from etcd-ca and explicitly frames itself as an alternative to direct OpenSSL configuration.

Sources

security posture

Risk level: green

narrow executable package without higher-risk signals.

Risk classifier

green risk · low confidence · appliance

Why

narrow executable package without higher-risk signals

Signals

metadata:no-higher-risk-signals

Install behavior

No Homebrew post-install hook is recorded in formula metadata.
Homebrew bottle metadata is available for 13 platform targets.
Build metadata lists 1 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

Command	Kind	Exposure	Note
`certstrap`	cli	global executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08

manager version1.3.0

manager updated

local dataok

upstreamcurrent

latest detectedv1.3.0

https://github.com/square/certstrap

infoNo package-manager update timestamp was available.low confidence

install metadata

Package metadata

Package key	brew:certstrap
Version	1.3.0
Package manager	Homebrew
Package manager page	https://formulae.brew.sh/formula/certstrap
Homepage	https://github.com/square/certstrap
Repository	https://github.com/square/certstrap
Upstream docs	https://github.com/square/certstrap#readme
License	Apache-2.0
Source archive	https://github.com/square/certstrap/archive/refs/tags/v1.3.0.tar.gz
Build dependencies	go
Bottle	available (on arm64_big_sur, arm64_linux, arm64_monterey, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, big_sur, catalina, monterey, sonoma, ventura, x86_64_linux)
Homebrew post-install	not defined
Service	none declared

registry facts

Source database details

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	certstrap
Version Scheme	0
Revision	0
Head Version	HEAD
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	head stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

certstrap

nix profile install nixpkgs#certstrap

normalized package name match
Matched by: Certstrap

nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/ce/certstrap/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

apk95%

certstrap 1.3.0-r34

Tools to bootstrap CAs, certificate requests, and signed certificates

https://github.com/square/certstrap

sudo apk add certstrap

License: Apache-2.0
Architecture: x86_64
Source Package: certstrap
1 dependencies
1 provides
normalized package name match
Matched by: Certstrap

Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: certstrap from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz

MacPorts95%

certstrap

sudo port install certstrap

normalized package name match
Matched by: Certstrap

MacPorts ports tree · api.github.com · MacPorts ports tree: security/certstrap/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

Scoop95%

main/certstrap

scoop install main/certstrap

normalized package name match
Matched by: Certstrap

Scoop official bucket manifest trees · api.github.com · Scoop official bucket manifest trees: bucket/certstrap.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/certstrap.yml

Used sources

Geiger risk classifier
Nucleus package database
av.db category and tag curation
cross-ecosystem install command graph
curated package history
external package-manager database matches
package relationship graph
package version freshness
package-page enrichment

Install certstrap with Homebrew, apk, MacPorts, Nix, scoop