fulcio

Start Fulcio server

$ fulcio serve --config [config.yaml]

$ fulcio createca --out [root.pem]

fulcio command [options]

Fulcio is a certificate authority for code signing, part of the Sigstore project. It issues short-lived certificates tied to OIDC identities (GitHub, Google, Microsoft), enabling keyless code signing.
Fulcio eliminates the need for developers to manage long-term signing keys. Certificates are logged in the transparency log (Rekor) for verification.

serve

Start Fulcio server.

Configuration file.

Server port.

Create root CA certificate.

Output file.

Show version.

Requires OIDC provider integration. Certificates are short-lived by design. Production requires proper CA management. Part of larger Sigstore ecosystem.

Fulcio is part of Sigstore, initiated by Google, Red Hat, and Purdue University in 2021 to make code signing accessible. Named after a Roman consul, it provides the CA component of the keyless signing infrastructure.

cosign(1), rekor-cli(1), sigstore(1)