deleteonerror/tinypki

A tiny PKI for Home, Lab and Dev usage.

tiny PKI

A tiny PKI for Home, Lab and Dev usage.

• setup documentation here
• usage documentation here

security considerations

The private key of the Certificate Authority

• is chacha20poly1305 encrypted
• is stored on the filesystem with 0600 permissions

The configuration

• is signed by the ca, manual changes to the config files will result in a broken ca

External Dependencies you have to TRUST

only golang.org/x modules are used

maybe feature

• decoding ASN.1 of csr's
• file system watcher for the sub ca fsnotify
• passphrase file
• docker image
  • docker secret files support
• revocation reasons
• publish to LDAP
• Yubikey as Hardware Key Storage

Out of scope for this project

• HSM integration
• CA renewal with new name
• CA renewal with same key
• Root private key export
• Server Generated keys other than CA keys
• Key recovery
• RSA support

tinypki's Issues

Docker Named Volume for shared data (work) does not work

It is currently not possible to use the same named volume on both containers because the local driver uses umask and it's not possible to set 0775 as permissions, the group permissions will be ignored