Cisco and Teleport Announce Strategic Partnership
Read now
Support
LOG IN
Try for FreeContact Sales
Background image

Security at Teleport

Teleport is dedicated to trusted, contemporary security. We're thankful for the high level of trust our customers place in Teleport when they choose to secure their critical infrastructure using our products.

SECURITY TEAM

Teleport maintains a cross-functional security team dedicated to:

Corporate IT Security

Teleport Cloud Security

Teleport code, dependency, and supply chain vulnerability detection and response

Reporting a Vulnerability

If you have any questions, please contact us. We are deeply grateful to researchers and our community who report issues so that we can coordinate a fix and responsible disclosure.

Security Commitments

We make the following security commitments:

Privacy

As part of our security stance, we protect our customers’ and partners’ privacy. Find our privacy policy at https://goteleport.com/legal/privacy.

Disclosure

We notify customers of critical vulnerabilities that affect the security of their systems. Prior vulnerability disclosures are found in our Teleport Release Notes.

Response

All security issues are rapidly triaged by our security team. Critical and high severity security findings trigger a formal incident response.

Proactive Detection

We contract and publish third-party security audits of our products and platform annually. Our previous reports are available on our Trust page. Furthermore, Teleport conducts regular security vulnerability scanning of our code and infrastructure using tools like Dependabot and Trivy.

Compliance

We maintain SOC 2 Type II, ISO 27001, and HIPAA Security Rule compliance for our cloud and self-hosted products, which can be provided under NDA. Additionally, we further commit to our Security Addendum, which covers policy, security, confidentiality, access controls, management, incident response, and more to detail how we protect customer data.

Public Certificates & Encryption Keys

We use the following certificates and public keys to sign our software. Many of these keys and certificates use our legal business name “Gravitational Inc.” and our former domain “gravitational.com”. Don’t worry – Gravitational is Teleport.

 

RPM & Debian Signing Keys

We sign our APT, YUM and Zypper repositories with the following PGP key:

  • ID C87ED53A6282C411

  • Fingerprint 0C5E 8BA5 658E 320D 1B03 1179 C87E D53A 6282 C411


The key is available for download at:

See the following pages for information on using this key to verify downloaded packages:

 

Apple Signing Certificates

Our Apple packages and binaries are code signed by "Developer ID QH8AA5B8UP Gravitational Inc." with the following certificate:

  • SHA256 Fingerprint 5D 8B F7 91 14 81 F3 AE AA 13 91 EE 6A 29 30 3B C8 49 10 23 F8 68 04 E6 35 FF EB F9 FE 09 08 A2

  • SHA1 Fingerprint AD F8 C2 C3 DD 78 0C 96 08 E3 A5 23 4B 31 E2 04 31 98 90 D4


Packages published after September 14, 2021 and prior to July 31, 2026 are signed with an older certificate for the same Developer ID (QH8AA5B8UP):

  • SHA256 Fingerprint 78 2F E1 18 5F A1 AD 68 AD 25 0B A9 4D 21 DC BB 0D 8E 47 C6 E4 1D FE FB AB 05 41 33 4C 33 1D 43

  • SHA1 Fingerprint 82 B6 25 AD 32 7C 24 1B 37 8A 54 B4 B2 54 BB 08 CE 71 B5 DF


Packages published prior to September 14, 2021 are signed with an older certificate for the same Developer ID (QH8AA5B8UP):

  • SHA256 Fingerprint 78 05 14 69 20 59 21 D1 EE 96 42 01 5A 28 35 FB E1 D4 38 5E 2A 23 5D 62 73 A4 D1 27 8A 33 BA 34

  • SHA1 Fingerprint D2 70 EA 0C F2 0E CB 17 28 B2 21 E1 D5 B6 7C FE 50 FF AB 62


Verify the Developer ID and fingerprint match on package downloads with the pkgutil tool:

$ pkgutil --check-signature teleport-18.10.3.pkg
Package "teleport-18.10.3.pkg":
   Status: signed by a developer certificate issued by Apple for distribution
   Notarization: trusted by the Apple notary service
   Signed with a trusted timestamp on: 2026-07-31 22:59:07 +0000
   Certificate Chain:
    1. Developer ID Installer: Gravitational Inc. (QH8AA5B8UP)
       Expires: 2028-04-06 21:18:44 +0000
       SHA256 Fingerprint:
           5D 8B F7 91 14 81 F3 AE AA 13 91 EE 6A 29 30 3B C8 49 10 23 F8 68
           04 E6 35 FF EB F9 FE 09 08 A2
       ------------------------------------------------------------------------
    2. Developer ID Certification Authority
       Expires: 2031-09-17 00:00:00 +0000
       SHA256 Fingerprint:
           F1 6C D3 C5 4C 7F 83 CE A4 BF 1A 3E 6A 08 19 C8 AA A8 E4 A1 52 8F
           D1 44 71 5F 35 06 43 D2 DF 3A
       ------------------------------------------------------------------------
    3. Apple Root CA
       Expires: 2035-02-09 21:40:36 +0000
       SHA256 Fingerprint:
           B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C
           68 C5 BE 91 B5 A1 10 01 F0 24

The codesign tool can be used to perform the verification on individual binaries:

$ codesign --verify -d --verbose=2 tsh.app
...
Identifier=QH8AA5B8UP.com.gravitational.teleport.tsh
Authority=Developer ID Application: Gravitational Inc. (QH8AA5B8UP)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=Jul 31, 2026 at 4:33:53 PM
TeamIdentifier=QH8AA5B8UP
...

The Teleport package in Homebrew is not maintained or signed by Teleport. We recommend the use of our Teleport packages.

Windows Signing Certificates

Our Windows binaries are signed with the following certificate:
Issued to Gravitational, Inc.
Thumbprint C644BAB07912F5BD09BDB3C2D9AE6A724F9B2391

Verify the binary using the following PowerShell command:

Get-AuthenticodeSignature -FilePath .\tsh.exe

    Directory: C:\Users\ExampleUser

SignerCertificate                         Status   Path
----------------                          ------   ----
F2FBE7B8228122EB74DE2DC093DB81F8E6896253  Valid    tsh.exe

Ensure that the SignerCertificate matches the thumbprint shown above, and that the Status field is Valid.
To further inspect the certificate, run the following PowerShell command:

(Get-AuthenticodeSignature -FilePath.   sh.exe).SignerCertificate | Format-List

Subject      : CN="Gravitational, Inc.", O="Gravitational, Inc.", L=Oakland,
               S=California, C=US, SERIALNUMBER=5720258,
               OID.2.5.4.15=Private Organization,
               OID.1.3.6.1.4.1.311.60.2.1.2=Delaware,
               OID.1.3.6.1.4.1.311.60.2.1.3=US
Issuer       : CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,
               O="DigiCert, Inc.", C=US
Thumbprint   : C644BAB07912F5BD09BDB3C2D9AE6A724F9B2391
FriendlyName :
NotBefore    : 11/2/2023 12:00:00 AM
NotAfter     : 10/16/2026 11:59:59 PM
Extensions   : {System.Security.Cryptography.Oid,
                System.Security.Cryptography.Oid,
                System.Security.Cryptography.Oid,
                System.Security.Cryptography.Oid...}

Alternatively, Windows binaries may be inspected graphically via the Windows Explorer with the following steps:

  1. Right click on the binary in question, for example tsh.exe.
  2. Select “Properties”.
  3. On the resulting “tsh.exe Properties” dialog, select the “Digital Signatures” tab.
  4. Select the “Gravitational Inc.” signer from the list.
  5. Select the “Details” button.
  6. On the resulting “Digital Signature Details” dialog, ensure that the header states “This digital signature is OK.”
  7. Select the “View Certificate” button.
  8. On the resulting “Certificate” dialog, select the “Details” tab.
  9. Select the “Thumbprint” item from the list, and compare its value to the thumbprint listed above.

OCI Container Images

All of our distroless OCI container images are signed with cosign. Signatures can be validated against the Teleport OCI image signing key.

$ cosign verify --key teleport-oci-key-2023-05.pub public.ecr.aws/gravitational/teleport-distroless-debug:12.3.3

Verification for public.ecr.aws/gravitational/teleport-distroless-debug:12.3.3 --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

[{"critical":{"identity":{"docker-reference":"public.ecr.aws/gravitational/teleport-distroless-debug"},"image":{"docker-manifest-digest":"sha256:450fa0f11bbd692ce8236adbc73ed4d32c464cab799bfb32de75e0769f51181a"},"type":"cosign container image signature"},"optional":null}]

Note that for cosign versions >= 2.0 you may need to use the new --insecure-ignore-tlog option for some images. These images were signed with an older version of cosign.

Pre-releases and Custom Builds

At times, we share pre-releases or one-off custom builds with customers. Those builds are available from cdn.cloud.gravitational.io and are signed with a different set of certificates.


For Apple devices:

  • Developer ID: K497G57PDJ
  • SHA256 Fingerprint B0 34 81 61 82 B6 C6 3B 5B 4C C2 47 4E 9F EE 3F 12 AE 29 9A DE 70 BB 31 6F 2A 25 DC 23 46 7D 26


For Windows devices:

  • Issued to: Gravitational, Inc.
  • Thumbprint: 3C14BE378BE889E35B64649ED18A1EE362DA63D5

Ready to Teleport?

Contact SalesStart Free Trial