OpenSSL is a production-grade cryptographic library and toolkit that implements the TLS, DTLS, and QUIC protocols alongside a comprehensive general-purpose cryptographic library (libcrypto). The codebase is organized around a modular provider architecture: core cryptographic algorithms (ciphers, digests, key exchanges, signatures, etc.) are implemented as loadable providers (default, FIPS, legacy, base, null), with a unified EVP API that dispatches operations to the appropriate provider. The library exposes a vast public API (hundreds of functions in include/openssl/) for secure communications, certificate handling (X.509, PKCS#12, CMS, OCSP), and low-level crypto primitives. The command-line tool (apps/openssl.c) provides administrative and diagnostic commands for key generation, certificate management, encryption, and protocol testing. The architecture is layered: the BIO abstraction handles I/O (files, sockets, memory buffers), the SSL/TLS/QUIC state machines manage handshakes and record layer processing, and the provider framework isolates algorithm implementations from the core library. Key entry points include library initialization (crypto/init.c), provider loading (crypto/provider_core.c), SSL context creation (ssl/ssl_lib.c), and the EVP interface (crypto/evp/). Data flows typically start with an application calling EVP or SSL functions, which route through the provider dispatch to platform-optimized implementations (e.g., AES-NI, ARM NEON, RISC-V vector extensions). The codebase includes extensive fuzzing harnesses (fuzz/), a comprehensive test suite (test/), and demos (demos/) illustrating common use cases. External dependencies are minimal: the core library relies only on OS threading (pthreads, Windows threads) and basic system calls. Optional dependencies include compression libraries (zlib, zstd, brotli) and external test frameworks (tlsfuzzer, NSS, BoringSSL for interop testing). The project actively maintains FIPS 140-3 validation modules and supports post-quantum algorithms (ML-DSA, ML-KEM, SLH-DSA, LMS) alongside legacy algorithms. Platform-specific hardware acceleration is handled through compile-time detection and runtime capability checks (e.g., crypto/armcap.c, crypto/riscvcap.c).
This repository implements `step-ca`, a production-grade online Certificate Authority (CA) server written in Go. It issues X.509 and SSH certificates via multiple protocols including ACME (RFC 8555), SCEP, and JWT-based provisioners. The architecture separates authorization (via pluggable provisioners: JWK, OIDC, AWS, Azure, GCP, Kubernetes, Nebula, X5C, and more) from certificate signing (via CAS backends: softcas, stepcas, cloudcas, vaultcas). The server exposes REST APIs for certificate lifecycle (sign, renew, revoke), SSH certificate management, CRLs, and an admin API for managing provisioners, policies, and webhooks. It supports external key management (AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault) and can run in RA (Registration Authority) mode proxying to an upstream step-ca. The codebase is extensively tested with unit and integration tests, uses a functional options pattern for configuration, and includes a client library for bootstrapping TLS connections. Notable reusable components include a custom error type with HTTP status codes, a policy engine for name constraints, webhook integration framework, request ID middleware, and template rendering engine.
Easy-RSA is a CLI utility for managing a Public Key Infrastructure (PKI) Certificate Authority (CA). It provides a shell-based interface to create and manage CA certificates, sign certificate requests, generate revocation lists, and produce OpenVPN inline configuration files. The core logic is implemented in a single POSIX shell script (easyrsa3/easyrsa) that wraps OpenSSL commands. It supports RSA, EC, and Edwards curve algorithms, multiple certificate types (server, client, CA, code-signing, email), and is designed for both interactive and batch operation. The tool is tightly coupled with OpenSSL and optionally OpenVPN for TLS key generation. It is a mature, actively maintained project with a comprehensive feature set and strong adherence to shell scripting standards.
This is a Go library implementing the SPIFFE Workload API for workload identity management and secure communication. It provides client libraries to fetch X.509-SVIDs, JWT-SVIDs, and trust bundles from a Workload API agent (typically SPIRE). The library offers high-level TLS dial/listen functions (spiffetls) with various authentication modes (mTLS, TLS with JWT), supporting both Unix sockets and Windows named pipes. Core packages include spiffeid (SPIFFE ID parsing and matching), svid (SVID parsing and validation), bundle (trust bundle management), workloadapi (Workload API client and credential source watchers), and federation (remote trust domain bundle fetching). The architecture is modular with clear interfaces (Source, Authorizer, Logger, Backoff) that allow swapping backends. The code is well-tested with extensive unit tests and integration test helpers. Experimental features include WIT-SVIDs and a Broker API. This library is a critical component for any workload that needs SPIFFE-based identity in a zero-trust environment.