This repository implements `step-ca`, a production-grade online Certificate Authority (CA) server written in Go. It issues X.509 and SSH certificates via multiple protocols including ACME (RFC 8555), SCEP, and JWT-based provisioners. The architecture separates authorization (via pluggable provisioners: JWK, OIDC, AWS, Azure, GCP, Kubernetes, Nebula, X5C, and more) from certificate signing (via CAS backends: softcas, stepcas, cloudcas, vaultcas). The server exposes REST APIs for certificate lifecycle (sign, renew, revoke), SSH certificate management, CRLs, and an admin API for managing provisioners, policies, and webhooks. It supports external key management (AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault) and can run in RA (Registration Authority) mode proxying to an upstream step-ca. The codebase is extensively tested with unit and integration tests, uses a functional options pattern for configuration, and includes a client library for bootstrapping TLS connections. Notable reusable components include a custom error type with HTTP status codes, a policy engine for name constraints, webhook integration framework, request ID middleware, and template rendering engine.
https-localhost is a developer tool that runs an HTTPS server on localhost using locally-trusted SSL certificates. It downloads the mkcert binary appropriate for the host OS/architecture, executes it to install a local CA into system/browser trust stores, and generates per-host certificates. The resulting HTTPS server can either serve static files from a directory or act as a reverse proxy to an existing HTTP/HTTPS server, with optional HTTP-to-HTTPS redirection. It ships as both a global CLI (the `serve` binary) and a programmatic API (`createServer()`, `getCerts()`). Architecturally it is a small, well-separated set of ES modules built directly on Node's built-in http/https servers with no framework dependency. The router dispatches between a static file handler and a proxy handler; CORS headers are applied globally; environment/CLI configuration is validated through a zod schema where CLI flags take precedence over environment variables. External runtime dependencies are deliberately minimal: only `mrmime` for MIME lookup and `zod` for config validation, plus the downloaded mkcert binary. The static handler is the strongest piece: it implements path-traversal sanitization, ETag/Last-Modified conditional requests, byte-range responses (206/416), HEAD/OPTIONS support, directory index serving with query-preserving trailing-slash redirects, and custom 404.html lookup. The proxy handler strips hop-by-hop headers, injects X-Forwarded-* headers, tunnels WebSocket upgrades, and cleanly returns 502 when upstreams fail or die mid-response. Test coverage is comprehensive and genuinely exercises real sockets: unit tests for env parsing and certificate lifecycle, integration tests for static serving and proxying, CLI spawn tests, and edge-case tests for malformed percent-encoding, CORS preflight without upstream contact, and client hang prevention. CI runs a matrix across Ubuntu/macOS and Node 24/26 with strict type-aware linting, dead-code detection (knip), and formatting checks. Minor weaknesses: synchronous fs calls in the static handler (fine for a dev tool), a `process.exit()` call inside library code for unsupported platforms, minimal error handling in the mkcert download routine (only follows 302s, ignores non-2xx statuses), and no Windows CI coverage despite Windows-specific code paths.
This is the Dogtag PKI (Red Hat Certificate System) codebase, a comprehensive enterprise-grade Public Key Infrastructure server suite. It provides multiple subsystems: Certificate Authority (CA) for certificate lifecycle management, Key Recovery Authority (KRA) for key archival and recovery, Online Certificate Status Protocol (OCSP) responder, Token Key Service (TKS) for smart card key handling, Token Processing System (TPS) for token management, and ACME/EST responders for automated certificate enrollment. The system exposes REST APIs (both JAX-RS v1 and servlet-based v2), a rich CLI toolset (Java and Python), and a legacy Swing admin console (deprecated). Backend storage primarily uses LDAP (389 Directory Server) for certificates, requests, and configuration, with PostgreSQL optionally used for ACME realms. The architecture follows a modular monolith pattern: each PKI subsystem runs as a separate Java web application deployed on Apache Tomcat, sharing common libraries from base/common and base/server. Cryptographic operations are handled via NSS (Network Security Services) and JSS (Java Security Services). Key patterns include a ConfigStore hierarchy for type-safe configuration access, a JSONSerializer interface for consistent data serialization, a CommandCLI base class for building CLI commands, and a policy/profile framework for certificate issuance rules. The codebase demonstrates strong engineering with extensive test coverage (unit, integration, CI workflows), Docker support, and versioned upgrade scripts. While the codebase is actively maintained with frequent commits and a comprehensive CI pipeline, it shows signs of technical drift: a large volume of deprecated Swing console code marked for removal, persistent use of legacy com.netscape package names alongside newer org.dogtagpki packages, and a polyglot codebase (Java, Python, native C++ for TPS client) that increases maintenance complexity. The quality is solid overall with well-separated concerns and reusable patterns, though the sheer scale and historical accumulation of components prevent it from being considered exceptional.