diff --git a/.gitignore b/.gitignore
index ed2ab99d..4ae6b5bd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,3 +18,8 @@
 coverage.txt
 vendor
 output
+
+# Ignore modules until switch from gopkg
+go.mod
+go.sum
+
diff --git a/.golangci.yml b/.golangci.yml
new file mode 100644
index 00000000..706a6b0b
--- /dev/null
+++ b/.golangci.yml
@@ -0,0 +1,68 @@
+linters-settings:
+  govet:
+    check-shadowing: true
+    settings:
+      printf:
+        funcs:
+          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Infof
+          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Errorf
+          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Warnf
+          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Fatalf
+  golint:
+    min-confidence: 0
+  gocyclo:
+    min-complexity: 10
+  maligned:
+    suggest-new: true
+  dupl:
+    threshold: 100
+  goconst:
+    min-len: 2
+    min-occurrences: 2
+  depguard:
+    list-type: blacklist
+    packages:
+      # logging is allowed only by logutils.Log, logrus
+      # is allowed to use only in logutils package
+      - github.com/sirupsen/logrus
+  misspell:
+    locale: US
+  lll:
+    line-length: 140
+  goimports:
+    local-prefixes: github.com/golangci/golangci-lint
+  gocritic:
+    enabled-tags:
+      - performance
+      - style
+      - experimental
+    disabled-checks:
+      - wrapperFunc
+      - dupImport # https://github.com/go-critic/go-critic/issues/845
+
+linters:
+  disable-all: true
+  enable:
+    - gofmt
+    - golint
+    - vet
+    - misspell
+    - ineffassign
+    - deadcode
+
+run:
+  skip-dirs:
+    - pkg
+
+issues:
+  exclude:
+    - can't lint
+    - declaration of "err" shadows declaration at line
+    - should have a package comment, unless it's in another file for this package
+    - error strings should not be capitalized or end with punctuation or a newline
+# golangci.com configuration
+# https://github.com/golangci/golangci/wiki/Configuration
+service:
+  golangci-lint-version: 1.17.x # use the fixed version to not introduce new linters unexpectedly
+  prepare:
+    - echo "here I can run custom commands, but no preparation needed for this repo"
diff --git a/Gopkg.lock b/Gopkg.lock
index ead1da09..dc947d29 100644
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -9,13 +9,6 @@
   pruneopts = "UT"
   revision = "e2d15f34fcf99d5dbb871c820ec73f710fca9815"
 
-[[projects]]
-  digest = "1:304cb78c285eaf02ab529ad02a257cad9b4845022915e6c82f87860ac53222d8"
-  name = "github.com/alecthomas/gometalinter"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "bae2f1293d092fd8167939d5108d1b025eaef9de"
-
 [[projects]]
   branch = "master"
   digest = "1:c198fdc381e898e8fb62b8eb62758195091c313ad18e52a3067366e1dda2fb3c"
@@ -32,17 +25,6 @@
   pruneopts = "UT"
   revision = "2972be24d48e78746da79ba8e24e8b488c9880de"
 
-[[projects]]
-  digest = "1:848ef40f818e59905140552cc49ff3dc1a15f955e4b56d1c5c2cc4b54dbadf0c"
-  name = "github.com/client9/misspell"
-  packages = [
-    ".",
-    "cmd/misspell",
-  ]
-  pruneopts = "UT"
-  revision = "b90dc15cfd220ecf8bbc9043ecb928cef381f011"
-  version = "v0.3.4"
-
 [[projects]]
   digest = "1:21ac9938fb1098b3a7b0dd909fb30878d33231177fac11a2821114eb9c1088ff"
   name = "github.com/dgraph-io/badger"
@@ -82,13 +64,6 @@
   revision = "72cd26f257d44c1114970e19afddcd812016007e"
   version = "v1.4.1"
 
-[[projects]]
-  digest = "1:4ee452f8994700dcab9e816aef1cb9eb2317218734c6ccf5135746e6c19f3dce"
-  name = "github.com/golang/lint"
-  packages = ["golint"]
-  pruneopts = "UT"
-  revision = "06c8688daad7faa9da5a0c2f163a3d14aac986ca"
-
 [[projects]]
   digest = "1:97df918963298c287643883209a2c3f642e6593379f97ab400c2a2e219ab647d"
   name = "github.com/golang/protobuf"
@@ -105,14 +80,6 @@
   pruneopts = "UT"
   revision = "6f45313302b9c56850fc17f99e40caebce98c716"
 
-[[projects]]
-  branch = "master"
-  digest = "1:824d147914b40e56e9e1eebd602bc6bb9761989d52fd8e4a498428467980eb17"
-  name = "github.com/gordonklaus/ineffassign"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "1003c8bd00dc2869cb5ca5282e6ce33834fed514"
-
 [[projects]]
   branch = "master"
   digest = "1:e51f40f0c19b39c1825eadd07d5c0a98a2ad5942b166d9fc4f54750ce9a04810"
@@ -314,14 +281,6 @@
   pruneopts = "UT"
   revision = "a0934e12468769d8cbede3ed316c47a4b88de4ca"
 
-[[projects]]
-  branch = "master"
-  digest = "1:ba52e5a5fb800ce55108b7a5f181bb809aab71c16736051312b0aa969f82ad39"
-  name = "github.com/tsenart/deadcode"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "210d2dc333e90c7e3eedf4f2242507a8e83ed4ab"
-
 [[projects]]
   branch = "master"
   digest = "1:6743b69de0d73e91004e4e201cf4965b59a0fa5caf6f0ffbe0cb9ee8807738a7"
@@ -472,11 +431,7 @@
   analyzer-name = "dep"
   analyzer-version = 1
   input-imports = [
-    "github.com/alecthomas/gometalinter",
-    "github.com/client9/misspell/cmd/misspell",
     "github.com/go-chi/chi",
-    "github.com/golang/lint/golint",
-    "github.com/gordonklaus/ineffassign",
     "github.com/newrelic/go-agent",
     "github.com/pkg/errors",
     "github.com/rs/xid",
@@ -495,7 +450,6 @@
     "github.com/smallstep/cli/usage",
     "github.com/smallstep/nosql",
     "github.com/smallstep/nosql/database",
-    "github.com/tsenart/deadcode",
     "github.com/urfave/cli",
     "golang.org/x/crypto/ocsp",
     "golang.org/x/net/http2",
diff --git a/Gopkg.toml b/Gopkg.toml
index 944ed32a..8937374b 100644
--- a/Gopkg.toml
+++ b/Gopkg.toml
@@ -23,23 +23,6 @@
 #   non-go = false
 #   go-tests = true
 #   unused-packages = true
-
-required = [
-  "github.com/alecthomas/gometalinter",
-  "github.com/golang/lint/golint",
-  "github.com/client9/misspell/cmd/misspell",
-  "github.com/gordonklaus/ineffassign",
-  "github.com/tsenart/deadcode",
-]
-
-[[constraint]]
-  name = "github.com/golang/lint"
-  revision = "06c8688daad7faa9da5a0c2f163a3d14aac986ca"
-
-[[constraint]]
-  name = "github.com/alecthomas/gometalinter"
-  revision = "bae2f1293d092fd8167939d5108d1b025eaef9de"
-
 [[override]]
   name = "gopkg.in/alecthomas/kingpin.v3-unstable"
   revision = "63abe20a23e29e80bbef8089bd3dee3ac25e5306"
diff --git a/Makefile b/Makefile
index 8b116ddd..164cab35 100644
--- a/Makefile
+++ b/Makefile
@@ -22,25 +22,18 @@ all: build test lint
 bootstra%:
 	$Q which dep || go get github.com/golang/dep/cmd/dep
 	$Q dep ensure
+	$Q GO111MODULE=on go get github.com/golangci/golangci-lint/cmd/golangci-lint@v1.17.1
+
 
 vendor: Gopkg.lock
 	$Q dep ensure
 
-BOOTSTRAP=\
-	github.com/golang/lint/golint \
-	github.com/client9/misspell/cmd/misspell \
-	github.com/gordonklaus/ineffassign \
-	github.com/tsenart/deadcode \
-	github.com/alecthomas/gometalinter
-
 define VENDOR_BIN_TMPL
 vendor/bin/$(notdir $(1)): vendor
 	$Q go build -o $$@ ./vendor/$(1)
 VENDOR_BINS += vendor/bin/$(notdir $(1))
 endef
 
-$(foreach pkg,$(BOOTSTRAP),$(eval $(call VENDOR_BIN_TMPL,$(pkg))))
-
 .PHONY: bootstra% vendor
 
 #################################################
@@ -126,24 +119,11 @@ integration: bin/$(BINNAME)
 # Linting
 #########################################
 
-LINTERS=\
-	gofmt \
-	golint \
-	vet \
-	misspell \
-	ineffassign \
-	deadcode
-
-$(patsubst %,%-bin,$(filter-out gofmt vet,$(LINTERS))): %-bin: vendor/bin/%
-gofmt-bin vet-bin:
-
-$(LINTERS): %: vendor/bin/gometalinter %-bin vendor
-	$Q PATH=`pwd`/vendor/bin:$$PATH gometalinter --tests --disable-all --vendor \
-	     --deadline=5m -s data -s pkg --enable $@ ./...
 fmt:
 	$Q gofmt -l -w $(SRC)
 
-lint: $(LINTERS)
+lint:
+	$Q LOG_LEVEL=error golangci-lint run
 
 .PHONY: $(LINTERS) lint fmt
 
diff --git a/authority/authority_test.go b/authority/authority_test.go
index 30ee3121..ee517517 100644
--- a/authority/authority_test.go
+++ b/authority/authority_test.go
@@ -124,11 +124,14 @@ func TestAuthorityNew(t *testing.T) {
 					assert.True(t, auth.initOnce)
 					assert.NotNil(t, auth.intermediateIdentity)
 					for _, p := range tc.config.AuthorityConfig.Provisioners {
-						_p, ok := auth.provisioners.Load(p.GetID())
+						var _p provisioner.Interface
+						_p, ok = auth.provisioners.Load(p.GetID())
 						assert.True(t, ok)
 						assert.Equals(t, p, _p)
-						if kid, encryptedKey, ok := p.GetEncryptedKey(); ok {
-							key, ok := auth.provisioners.LoadEncryptedKey(kid)
+						var kid, encryptedKey string
+						if kid, encryptedKey, ok = p.GetEncryptedKey(); ok {
+							var key string
+							key, ok = auth.provisioners.LoadEncryptedKey(kid)
 							assert.True(t, ok)
 							assert.Equals(t, encryptedKey, key)
 						}