This repository implements `step-ca`, a production-grade online Certificate Authority (CA) server written in Go. It issues X.509 and SSH certificates via multiple protocols including ACME (RFC 8555), SCEP, and JWT-based provisioners. The architecture separates authorization (via pluggable provisioners: JWK, OIDC, AWS, Azure, GCP, Kubernetes, Nebula, X5C, and more) from certificate signing (via CAS backends: softcas, stepcas, cloudcas, vaultcas). The server exposes REST APIs for certificate lifecycle (sign, renew, revoke), SSH certificate management, CRLs, and an admin API for managing provisioners, policies, and webhooks. It supports external key management (AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault) and can run in RA (Registration Authority) mode proxying to an upstream step-ca. The codebase is extensively tested with unit and integration tests, uses a functional options pattern for configuration, and includes a client library for bootstrapping TLS connections. Notable reusable components include a custom error type with HTTP status codes, a policy engine for name constraints, webhook integration framework, request ID middleware, and template rendering engine.
This repository is HashiCorp Vault, a production-grade secrets management platform that secures, stores, and controls access to tokens, passwords, certificates, API keys, and other sensitive data. In production, it operates as a distributed system with a Go server backend, a RESTful HTTP API, a CLI client, and an optional Ember.js web UI. The architecture is modular: core server logic (token store, identity store, policy engine, audit brokerage, replication) is extensible via a plugin SDK for custom authentication methods (LDAP, OIDC, Kubernetes, AWS, etc.) and secrets engines (PKI, transit encryption, dynamic database credentials, SSH, etc.). Primary entry points are the `main.go` binary, the `api/` Go client library, and the `command/` CLI package. Data flows involve client requests routed through the HTTP handler to the logical backend, which uses a physical storage abstraction (Raft, Consul, file, etc.) and optionally triggers external plugins over gRPC. The system relies heavily on cryptographic primitives, a lease/expiration manager, and an event pipeline for audit logging and telemetry.
Infisical is an open-source end-to-end encrypted secrets management platform used to centralize, secure, and sync secrets across teams and infrastructure. The codebase is structured as a multi-service application with a primary Node.js/TypeScript backend (REST API using Fastify) and a newer Go backend implementing core platform services (authentication, permission evaluation, KMS, audit logging, secret manager). The frontend is a React SPA built with Vite and TanStack Router. The system supports self-hosted (Docker, Helm) and cloud-deployed modes. It provides a rich set of capabilities including dynamic secrets, secret rotation, approval workflows, machine identity federation (AWS, Azure, GCP, Kubernetes, OIDC), PKI management (internal and external CAs), privileged access management (PAM), secret scanning, audit logging, and extensive integration syncs. The architecture follows a modular service-oriented pattern with clear separation of concerns, extensive use of dependency injection and factory patterns for extensibility.
Easy-RSA is a CLI utility for managing a Public Key Infrastructure (PKI) Certificate Authority (CA). It provides a shell-based interface to create and manage CA certificates, sign certificate requests, generate revocation lists, and produce OpenVPN inline configuration files. The core logic is implemented in a single POSIX shell script (easyrsa3/easyrsa) that wraps OpenSSL commands. It supports RSA, EC, and Edwards curve algorithms, multiple certificate types (server, client, CA, code-signing, email), and is designed for both interactive and batch operation. The tool is tightly coupled with OpenSSL and optionally OpenVPN for TLS key generation. It is a mature, actively maintained project with a comprehensive feature set and strong adherence to shell scripting standards.
Bouncy Castle for .NET is a comprehensive, production-grade cryptographic library providing implementations of a vast range of symmetric and asymmetric ciphers, hash functions, message authentication codes, digital signatures, key agreement protocols, key encapsulation mechanisms (including post-quantum schemes like ML-KEM, ML-DSA, SLH-DSA), secure random number generation (NIST SP 800-90A DRBG), and ASN.1 encoding/decoding (DER, BER, DL). It supports high-level protocol implementations for TLS/DTLS (client and server, including PSK, SRP, and post-quantum key exchange), OpenPGP (RFC 4880/9580), CMS (Cryptographic Message Syntax), CMP, CRMF, OCSP, TSP, and X.509 certificate generation and validation. The library is designed as a class library with a monolithic architecture organized into namespaces (Org.BouncyCastle.Crypto, .Asn1, .Tls, .Bcpg, .Cms, etc.), exposing both low-level primitives and high-level builders. It targets multiple .NET runtimes with conditional compilation for hardware intrinsics (AES-NI, PCLMULQDQ, SSE/AVX) and Span<T> support. The codebase is actively maintained, with ongoing migration from older algorithm names (e.g., Dilithium → ML-DSA) and extensive use of factory patterns and interface-based abstractions, making it a solid foundation for secure application development.
Cloudflare's CFSSL is a comprehensive PKI/TLS toolkit written in Go, providing both a command-line interface and an HTTP API server for certificate lifecycle management. It handles certificate signing, chain bundling, revocation (CRL/OCSP), TLS scanning, key generation, CSR creation, and CA initialization. The system is modular, with separate packages for CLI commands, API handlers, signers (local/remote), certificate database abstraction (SQLite/MySQL/PostgreSQL), a bundler with chain optimization, an OCSP responder, a TLS scanner, and a transport layer for automated mutual TLS. It uses interface-based design for pluggable backends (signers, database accessors, key providers, trust stores) and includes features like multi-root CA support, pre-issuance linting via zlint, certificate transparency embedding, ubiquity scoring for chain selection, IP whitelisting, HMAC authentication, Prometheus metrics, and post-quantum cryptography (ML-DSA). The codebase also contains custom cryptographic implementations (MD5, SHA-1, SHA-256, SHA-512) with assembly-optimized blocks for performance. While actively maintained with CI/CD and extensive tests, some components show technical drift (pinned Go 1.27, forked TLS library, legacy algorithm support).
This is the Dogtag PKI (Red Hat Certificate System) codebase, a comprehensive enterprise-grade Public Key Infrastructure server suite. It provides multiple subsystems: Certificate Authority (CA) for certificate lifecycle management, Key Recovery Authority (KRA) for key archival and recovery, Online Certificate Status Protocol (OCSP) responder, Token Key Service (TKS) for smart card key handling, Token Processing System (TPS) for token management, and ACME/EST responders for automated certificate enrollment. The system exposes REST APIs (both JAX-RS v1 and servlet-based v2), a rich CLI toolset (Java and Python), and a legacy Swing admin console (deprecated). Backend storage primarily uses LDAP (389 Directory Server) for certificates, requests, and configuration, with PostgreSQL optionally used for ACME realms. The architecture follows a modular monolith pattern: each PKI subsystem runs as a separate Java web application deployed on Apache Tomcat, sharing common libraries from base/common and base/server. Cryptographic operations are handled via NSS (Network Security Services) and JSS (Java Security Services). Key patterns include a ConfigStore hierarchy for type-safe configuration access, a JSONSerializer interface for consistent data serialization, a CommandCLI base class for building CLI commands, and a policy/profile framework for certificate issuance rules. The codebase demonstrates strong engineering with extensive test coverage (unit, integration, CI workflows), Docker support, and versioned upgrade scripts. While the codebase is actively maintained with frequent commits and a comprehensive CI pipeline, it shows signs of technical drift: a large volume of deprecated Swing console code marked for removal, persistent use of legacy com.netscape package names alongside newer org.dogtagpki packages, and a polyglot codebase (Java, Python, native C++ for TPS client) that increases maintenance complexity. The quality is solid overall with well-separated concerns and reusable patterns, though the sheer scale and historical accumulation of components prevent it from being considered exceptional.