Skip to content

Distributed Issuer releases

Learn about current and past releases of Distributed Issuer (formerly known as Firefly), which has both Standard-Term Support (STS) releases and Long-Term Support (LTS) releases. See Supported versions.

Helm charts are public, but some container images require a pull secret. See Configuring access to the NGTS registry.

The latest stable version is v1.12.3
  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-public:v1.12.3
  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer:v1.12.3
  • Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-fips:v1.12.3
  • Standard image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer:v1.12.3
  • Standard image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer:v1.12.3
  • FIPS image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-fips:v1.12.3
  • PKCS#11 base image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer-base-pkcs11:v1.12.3
  • PKCS#11 base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11:v1.12.3
  • PKCS#11 FIPS base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11-fips:v1.12.3
Download the binary

To download the Distributed Issuer PKCS#11 binary, use crane to extract it from the container image:

crane export registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer-base-pkcs11:v1.12.3 | tar --strip=1 -xf - /ko-app/distributed-issuer

Release 1.12.3

Distributed Issuer 1.12.3 was released on 6 November, 2026.

Key features

  • Distributed Issuer can now authenticate with a service account that belongs to an NGTS workspace. To use one, set the new Helm value deployment.config.bootstrap.ngts.connection.workspaceID to the workspace ID. If you create your own Connection resource, set spec.ngts.workspaceID instead.

Fixes and updates

  • Setting acceptTerms: true now accepts the Palo Alto Networks End User License Agreement instead of the CyberArk agreement.
  • The FIPS images now use a smaller base image, distroless Debian 13, instead of Red Hat Universal Base Image (UBI) 8. Container scanners report fewer vulnerabilities as a result. FIPS compliance is unchanged.

  • Updated the following dependencies:

    • github.com/cert-manager/cert-manager to v1.20.5 to address CVE-2026-62290
    • github.com/jetstack/venafi-connection-lib to v0.7.0
    • github.com/labstack/echo/v4 to v4.16.3 to address CVE-2026-118657
    • github.com/prometheus/client_golang to v1.24.1
    • Kubernetes Go libraries to v0.37.0
    • sigs.k8s.io/controller-runtime to v0.25.0

False positive CVEs

Container scanners such as Trivy report the following in all 1.12.3 images. Distributed Issuer doesn't use the affected code and is not vulnerable.

  • GO-2026-5932 in the golang.org/x/crypto Go module. It applies to the openpgp package, which Distributed Issuer doesn't import.
  • CVE-2026-118653 and CVE-2026-118651 in the github.com/labstack/echo/v4 Go module. They apply to the rate limiter and reverse proxy middleware, which Distributed Issuer doesn't use. No fixed version of echo v4 is available.

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-public:v1.12.3
  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer:v1.12.3
  • Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-fips:v1.12.3
  • Standard image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer:v1.12.3
  • Standard image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer:v1.12.3
  • FIPS image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-fips:v1.12.3
  • PKCS#11 base image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer-base-pkcs11:v1.12.3
  • PKCS#11 base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11:v1.12.3
  • PKCS#11 FIPS base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11-fips:v1.12.3

Release 1.12.2

Distributed Issuer 1.12.2 was released on 29 October, 2026.

Key features

  • This release removes trust in the compromised eMudhra certificate authority (CA). Distributed Issuer no longer trusts the emSign ECC Root CA - G3 and AAA Certificate Services root certificates, and it rejects certificate chains that pass through the compromised intermediate CA certificates.

Fixes and updates

  • Updated the base images.

  • Updated the following dependencies:

    • Go to v1.26.10 to address CVE-2026-111943 and other vulnerabilities in the Go standard library
    • github.com/go-jose/go-jose/v4 to v4.1.6
    • github.com/labstack/echo/v4 to v4.16.1
    • golang.org/x/net to v0.62.0
    • golang.org/x/sync to v0.24.0
    • golang.org/x/sys to v0.49.0

False positive CVEs

Container scanners such as Trivy report CVE-2026-62290 in the github.com/cert-manager/cert-manager Go module, and CVE-2026-97689 in the python3-urllib3 package in the FIPS images. Distributed Issuer doesn't use the affected code and is not vulnerable.

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-public:v1.12.2
  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer:v1.12.2
  • Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-fips:v1.12.2
  • Standard image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer:v1.12.2
  • Standard image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer:v1.12.2
  • FIPS image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-fips:v1.12.2
  • PKCS#11 base image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer-base-pkcs11:v1.12.2
  • PKCS#11 base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11:v1.12.2
  • PKCS#11 FIPS base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11-fips:v1.12.2

Release 1.12.1

Distributed Issuer 1.12.1 was released on 6 October, 2026.

Fixes and updates

  • Fixed a crash when the PKCS#11 driver for a hardware security module (HSM) failed to load. Distributed Issuer now stops and reports the reason, which makes a misconfigured HSM driver easier to locate.
  • Fixed a bootstrap failure when instanceNaming produced an issuing CA common name longer than 64 characters, which NGTS rejects. Distributed Issuer now shortens the common name and logs a warning.

  • Updated the following dependencies:

    • google.golang.org/grpc to v1.83.2
    • github.com/labstack/echo/v4 to v4.15.3
    • golang.org/x/sync to v0.22.0
    • golang.org/x/sys to v0.47.0

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-public:v1.12.1
  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer:v1.12.1
  • Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-fips:v1.12.1
  • Standard image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer:v1.12.1
  • Standard image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer:v1.12.1
  • FIPS image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-fips:v1.12.1
  • PKCS#11 base image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer-base-pkcs11:v1.12.1
  • PKCS#11 base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11:v1.12.1
  • PKCS#11 FIPS base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11-fips:v1.12.1

Release 1.12.0

Distributed Issuer 1.12.0 was released on 9 June, 2026.

Key features

  • Distributed Issuer can now authenticate to Next-Gen Trust Security using Workload Identity Federation (WIF). With WIF, Distributed Issuer authenticates through a Kubernetes ServiceAccount token instead of a stored private key. To learn more, see Authenticate to NGTS with Workload Identity Federation.
  • HTTPS is now required for JWKS and OIDC endpoints. The installer rejects configurations that use HTTP.

Action required for HTTP endpoints

If you currently use HTTP for JWKS or OIDC endpoints, switch to HTTPS before upgrading.

Fixes and updates

  • Updated the following dependencies:

    • venafi-connection-lib to v0.6.1
    • grpc to v1.81.1
    • Kubernetes Go libraries to v0.36.1
    • controller-runtime to v0.24.1

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-public:v1.12.0
  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer:v1.12.0
  • Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-fips:v1.12.0
  • Standard image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer:v1.12.0
  • Standard image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer:v1.12.0
  • FIPS image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-fips:v1.12.0
  • PKCS#11 base image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer-base-pkcs11:v1.12.0
  • PKCS#11 base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11:v1.12.0
  • PKCS#11 FIPS base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11-fips:v1.12.0

Release 1.11.2

Distributed Issuer 1.11.2 was released on 29 October, 2026.

Key features

  • This release removes trust in the compromised eMudhra certificate authority (CA). Distributed Issuer no longer trusts the emSign ECC Root CA - G3 and AAA Certificate Services root certificates, and it rejects certificate chains that pass through the compromised intermediate CA certificates.

Fixes and updates

  • Updated the base images.

  • Updated the following dependencies:

    • Go to v1.26.10 to address CVE-2026-111943 and other vulnerabilities in the Go standard library
    • github.com/go-jose/go-jose/v4 to v4.1.6
    • github.com/labstack/echo/v4 to v4.16.1
    • golang.org/x/net to v0.62.0
    • golang.org/x/sync to v0.24.0
    • golang.org/x/sys to v0.49.0

False positive CVEs

Container scanners such as Trivy report CVE-2026-62290 in the github.com/cert-manager/cert-manager Go module, and CVE-2026-97689 in the python3-urllib3 package in the FIPS images. Distributed Issuer doesn't use the affected code and is not vulnerable.

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-public:v1.11.2
  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer:v1.11.2
  • Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-fips:v1.11.2
  • Standard image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer:v1.11.2
  • Standard image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer:v1.11.2
  • FIPS image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-fips:v1.11.2
  • PKCS#11 base image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer-base-pkcs11:v1.11.2
  • PKCS#11 base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11:v1.11.2
  • PKCS#11 FIPS base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11-fips:v1.11.2

Release 1.11.1

Distributed Issuer 1.11.1 was released on 6 October, 2026.

Fixes and updates

  • Fixed a crash when the PKCS#11 driver for a hardware security module (HSM) failed to load. Distributed Issuer now stops and reports the reason, which makes a misconfigured HSM driver easier to locate.
  • Fixed a bootstrap failure when instanceNaming produced an issuing CA common name longer than 64 characters, which NGTS rejects. Distributed Issuer now shortens the common name and logs a warning.

  • Updated the following dependencies:

    • google.golang.org/grpc to v1.83.2
    • github.com/labstack/echo/v4 to v4.15.3
    • golang.org/x/sync to v0.22.0
    • golang.org/x/sys to v0.47.0

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-public:v1.11.1
  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer:v1.11.1
  • Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-fips:v1.11.1
  • Standard image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer:v1.11.1
  • Standard image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer:v1.11.1
  • FIPS image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-fips:v1.11.1
  • PKCS#11 base image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer-base-pkcs11:v1.11.1
  • PKCS#11 base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11:v1.11.1
  • PKCS#11 FIPS base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11-fips:v1.11.1

Release 1.11.0

Distributed Issuer 1.11.0 was released on 07 May, 2026.

Next-Gen Trust Security support

This release of Distributed Issuer adds support for Next-Gen Trust Security. To learn more, see the Next-Gen Trust Security documentation.

Key features

  • A new distributed-issuer binary and Helm chart now supports the Next-Gen Trust Security product.
  • The Helm chart can now automatically create VenafiConnection resources and associated role-based access control when connection.create is set to true.
  • You can now configure a custom container registry using the imageRegistry and imageNamespace Helm values.

Fixes and updates

  • Fixed CVE-2026-33186, a gRPC vulnerability.
  • Fixed no authenticator defined errors in certain deployment configurations.
  • The Helm chart image template helper has been renamed to avoid conflicts when Distributed Issuer is deployed as a sub-chart within an umbrella chart.
  • The tsgID field now accepts both string and numeric formats.
  • HSM and PKCS#11 initialization now run at startup, reducing latency on the first certificate request.

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-public:v1.11.0
  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer:v1.11.0
  • Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/distributed-issuer-fips:v1.11.0
  • Standard image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer:v1.11.0
  • Standard image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer:v1.11.0
  • FIPS image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-fips:v1.11.0
  • PKCS#11 base image (public): registry.ngts.paloaltonetworks.com/distributed-issuer-public/distributed-issuer-base-pkcs11:v1.11.0
  • PKCS#11 base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11:v1.11.0
  • PKCS#11 FIPS base image: registry.ngts.paloaltonetworks.com/distributed-issuer/distributed-issuer-base-pkcs11-fips:v1.11.0