This repository implements `step-ca`, a production-grade online Certificate Authority (CA) server written in Go. It issues X.509 and SSH certificates via multiple protocols including ACME (RFC 8555), SCEP, and JWT-based provisioners. The architecture separates authorization (via pluggable provisioners: JWK, OIDC, AWS, Azure, GCP, Kubernetes, Nebula, X5C, and more) from certificate signing (via CAS backends: softcas, stepcas, cloudcas, vaultcas). The server exposes REST APIs for certificate lifecycle (sign, renew, revoke), SSH certificate management, CRLs, and an admin API for managing provisioners, policies, and webhooks. It supports external key management (AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault) and can run in RA (Registration Authority) mode proxying to an upstream step-ca. The codebase is extensively tested with unit and integration tests, uses a functional options pattern for configuration, and includes a client library for bootstrapping TLS connections. Notable reusable components include a custom error type with HTTP status codes, a policy engine for name constraints, webhook integration framework, request ID middleware, and template rendering engine.
rcgen is a Rust library for X.509 certificate generation, part of the rustls ecosystem. It provides a programmatic API to create self-signed certificates, CA-signed certificates, certificate signing requests (CSRs), and certificate revocation lists (CRLs) with full RFC 5280 compliance. The library supports multiple cryptographic backends (ring, aws-lc-rs), a wide range of signature algorithms (ECDSA, Ed25519, RSA, ML-DSA), and extensible extension handling. It is architected around traits like `SigningKey` and `PublicKeyData` for key abstraction, and uses `yasna` for DER encoding and `pki-types` for standard PKI types. The repository also includes a CLI tool `rustls-cert-gen` for quick certificate generation, and a verification test suite that validates generated certificates against OpenSSL, Botan, and webpki. The codebase demonstrates strong adherence to RFCs, careful error handling, and modular design.
Easy-RSA is a CLI utility for managing a Public Key Infrastructure (PKI) Certificate Authority (CA). It provides a shell-based interface to create and manage CA certificates, sign certificate requests, generate revocation lists, and produce OpenVPN inline configuration files. The core logic is implemented in a single POSIX shell script (easyrsa3/easyrsa) that wraps OpenSSL commands. It supports RSA, EC, and Edwards curve algorithms, multiple certificate types (server, client, CA, code-signing, email), and is designed for both interactive and batch operation. The tool is tightly coupled with OpenSSL and optionally OpenVPN for TLS key generation. It is a mature, actively maintained project with a comprehensive feature set and strong adherence to shell scripting standards.
Cloudflare's CFSSL is a comprehensive PKI/TLS toolkit written in Go, providing both a command-line interface and an HTTP API server for certificate lifecycle management. It handles certificate signing, chain bundling, revocation (CRL/OCSP), TLS scanning, key generation, CSR creation, and CA initialization. The system is modular, with separate packages for CLI commands, API handlers, signers (local/remote), certificate database abstraction (SQLite/MySQL/PostgreSQL), a bundler with chain optimization, an OCSP responder, a TLS scanner, and a transport layer for automated mutual TLS. It uses interface-based design for pluggable backends (signers, database accessors, key providers, trust stores) and includes features like multi-root CA support, pre-issuance linting via zlint, certificate transparency embedding, ubiquity scoring for chain selection, IP whitelisting, HMAC authentication, Prometheus metrics, and post-quantum cryptography (ML-DSA). The codebase also contains custom cryptographic implementations (MD5, SHA-1, SHA-256, SHA-512) with assembly-optimized blocks for performance. While actively maintained with CI/CD and extensive tests, some components show technical drift (pinned Go 1.27, forked TLS library, legacy algorithm support).
This is the Dogtag PKI (Red Hat Certificate System) codebase, a comprehensive enterprise-grade Public Key Infrastructure server suite. It provides multiple subsystems: Certificate Authority (CA) for certificate lifecycle management, Key Recovery Authority (KRA) for key archival and recovery, Online Certificate Status Protocol (OCSP) responder, Token Key Service (TKS) for smart card key handling, Token Processing System (TPS) for token management, and ACME/EST responders for automated certificate enrollment. The system exposes REST APIs (both JAX-RS v1 and servlet-based v2), a rich CLI toolset (Java and Python), and a legacy Swing admin console (deprecated). Backend storage primarily uses LDAP (389 Directory Server) for certificates, requests, and configuration, with PostgreSQL optionally used for ACME realms. The architecture follows a modular monolith pattern: each PKI subsystem runs as a separate Java web application deployed on Apache Tomcat, sharing common libraries from base/common and base/server. Cryptographic operations are handled via NSS (Network Security Services) and JSS (Java Security Services). Key patterns include a ConfigStore hierarchy for type-safe configuration access, a JSONSerializer interface for consistent data serialization, a CommandCLI base class for building CLI commands, and a policy/profile framework for certificate issuance rules. The codebase demonstrates strong engineering with extensive test coverage (unit, integration, CI workflows), Docker support, and versioned upgrade scripts. While the codebase is actively maintained with frequent commits and a comprehensive CI pipeline, it shows signs of technical drift: a large volume of deprecated Swing console code marked for removal, persistent use of legacy com.netscape package names alongside newer org.dogtagpki packages, and a polyglot codebase (Java, Python, native C++ for TPS client) that increases maintenance complexity. The quality is solid overall with well-separated concerns and reusable patterns, though the sheer scale and historical accumulation of components prevent it from being considered exceptional.
The Hyperledger Bevel Fabric Operator is a Kubernetes operator for managing the full lifecycle of Hyperledger Fabric networks. It provides custom resource definitions (CRDs) and controllers for Certificate Authorities (CAs), peers, ordering service nodes, chaincode (install, approve, commit), channels (main and follower), identities, network configurations, and an operator UI/API. The system also includes a kubectl plugin for CLI-based management. It supports multiple ingress controllers (Istio, Traefik, Gateway API), credential stores (Kubernetes Secrets, HashiCorp Vault), and database backends for the built-in Fabric CA. The operator vendors and patches upstream Hyperledger Fabric and Fabric CA libraries for cryptographic operations, MSP configuration, policy building, and channel configuration. The codebase is well-structured with generated client code, consistent controller patterns (finalizers, status conditions), and comprehensive integration tests. It is actively maintained under the Hyperledger Bevel project, with a large community and regular releases.