Fulcio

Every certificate issued by Fulcio is valid for only 10 minutes by default. This radically short validity window eliminates the operational burden of certificate revocation lists (CRLs) and key rotation. Once the certificate expires, it becomes cryptographically useless for future signing, rendering any compromise of the underlying key pair irrelevant after the window closes.

• Default validity: 10 minutes
• No CRL infrastructure required
• Compromised keys become inert automatically

Fulcio does not operate in isolation. Every certificate it issues is immediately submitted to Rekor, Sigstore's transparency log. This creates an append-only, cryptographically verifiable record of the signing event. Verifiers can check the Rekor log to confirm that a certificate was valid at the time of signing, even if the certificate itself has since expired.

• Certificates are recorded in Rekor upon issuance
• Provides non-repudiation through public auditability
• Enables offline verification against the log

Fulcio exposes a gRPC API that clients use to request certificates. The client generates an ephemeral key pair locally, authenticates to an OIDC provider, and sends the resulting identity token to Fulcio along with a certificate signing request (CSR). Fulcio validates the token, constructs an X.509 certificate embedding the identity claims, and returns it signed by its root CA.

• API defined via Protocol Buffers
• Client never sends private key material
• Compatible with Cosign and other Sigstore clients

Fulcio operates as an intermediate CA under a root of trust managed by the Sigstore community. The Fulcio root CA is distributed through the TUF (The Update Framework) root signing ceremony, ensuring that verifiers can cryptographically chain a signing certificate back to a trusted root without relying on traditional public CA hierarchies.

• Root key material managed via TUF
• Trust root distributed out-of-band
• Eliminates dependency on commercial CAs

To prevent replay attacks, Fulcio supports a proof of possession challenge. The client must prove it controls the private key corresponding to the CSR by signing a nonce or challenge provided by Fulcio. This ensures that an attacker cannot submit a stolen OIDC token with their own key pair and obtain a fraudulent certificate.

• Prevents token replay attacks
• Client demonstrates key ownership before issuance
• Integrated into the standard signing workflow