README
¶
pki-dash
A web dashboard to create and manage an internal PKI (Root CA, intermediate CAs and service certificates), built on top of Cloudflare's cfssl. Ships as a single container.
Translations: pt-BR
Status: early development. The backend, JSON API and a first web UI (setup, sign-in, vault unlock, creating and listing CAs, issuing and downloading certificates, trust instructions per OS, users and roles, the audit log, taking a Root offline, importing a Root or intermediates signed elsewhere, revoking certificates and intermediates with CRLs, including a Root list signed offline) work. Not ready for real use.
Disclaimer: pki-dash is meant for internal environments such as homelabs, labs and test machines. It is not intended for public PKI or for settings where a CA compromise would have critical impact. It does not replace an HSM, a formal key ceremony or a commercial CA.
Goals
- Root → intermediate → service certificate hierarchy, with the Root kept offline.
- Friendly UI for issuing certificates and distributing trust to hosts.
- Security first: CA keys encrypted at rest, mandatory authentication, multi-user roles, audit log, optional sign-in with Keycloak/OIDC.
Running it (development)
make build # builds the web UI (needs Node 20.19+ or 22.12+), then the Go binary into bin/
./bin/pki-dash -tls-self-signed # or -tls-cert/-tls-key, or -insecure-http for local development
Then open https://localhost:8443.
Or install a release: a .deb/.rpm package with a systemd service, a container image, or a bare binary for Linux, macOS and Windows: see Installing. Docker details (a single container, unprivileged, read-only filesystem) are in Deployment.
The server refuses to start unless you choose how it is served. On first run it prints a one-time setup token to its log; enter it in the web UI (or send it to POST /api/v1/setup) to create the first admin and the master passphrase. After every restart the vault is locked: unlock it from the UI (or POST /api/v1/vault/unlock), so CA keys never sit decrypted on disk.
Documentation
- Vision and scope
- Stack decision
- Deployment (Docker)
- Keeping the Root offline
- Revocation and CRLs
- Signing in with Keycloak (OIDC)
- Installing: packages, image, binaries
License
MIT. Bundled third-party software is listed in THIRD_PARTY_NOTICES.md, including cfssl (BSD-2-Clause).
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
pki-dash
command
Command pki-dash is a web dashboard for managing an internal PKI.
|
Command pki-dash is a web dashboard for managing an internal PKI. |
|
internal
|
|
|
api
Package api is pki-dash's HTTP interface: a JSON API under /api/v1.
|
Package api is pki-dash's HTTP interface: a JSON API under /api/v1. |
|
auth
Package auth implements local accounts, sessions and role-based access.
|
Package auth implements local accounts, sessions and role-based access. |
|
ca
Package ca isolates the cfssl library behind pki-dash's own interface.
|
Package ca isolates the cfssl library behind pki-dash's own interface. |
|
oidc
Package oidc signs users in through an external OpenID Connect provider (Keycloak and the like) using the authorization-code flow with PKCE.
|
Package oidc signs users in through an external OpenID Connect provider (Keycloak and the like) using the authorization-code flow with PKCE. |
|
oidc/oidctest
Package oidctest is a minimal OpenID provider for tests: discovery, signing keys and a token endpoint that checks PKCE, the client secret and the redirect URI the way a real one does.
|
Package oidctest is a minimal OpenID provider for tests: discovery, signing keys and a token endpoint that checks PKCE, the client secret and the redirect URI the way a real one does. |
|
service
Package service holds pki-dash's business rules.
|
Package service holds pki-dash's business rules. |
|
store
Package store persists pki-dash state in a single SQLite file.
|
Package store persists pki-dash state in a single SQLite file. |
|
vault
Package vault encrypts secrets (CA private keys) at rest.
|
Package vault encrypts secrets (CA private keys) at rest. |
|
Package web embeds the built frontend (web/dist) into the Go binary.
|
Package web embeds the built frontend (web/dist) into the Go binary. |