README
¶
pki-dash
A web dashboard to create and manage an internal PKI (Root CA, intermediate CAs and service certificates), built on top of Cloudflare's cfssl. Create a Root and keep it offline, sign intermediates and service certificates, revoke them and publish CRLs, with roles, an audit log and optional sign-in with Keycloak. Installs as a .deb/.rpm package with a systemd service, as a container image, or as a single binary.
Translations: pt-BR
Status: pre-1.0 (v0.1.0). Tested end to end against real cfssl, openssl, Keycloak and nginx, including on the author's own infrastructure, but not audited by anyone else. Behaviour may change between versions: read the release notes and back up before upgrading. There is no warranty and all risk of use is yours: see the notice below.
NO WARRANTY. USE AT YOUR OWN RISK. pki-dash is provided "as is", without warranty of any kind, express or implied, as the MIT license states. The user is solely responsible for every risk of using it, including misuse and use in unsuitable settings: the author accepts no liability for any damage, loss, outage, or compromise of keys, certificates or systems that results from it.
It is meant for internal environments such as homelabs, labs and test machines. It is not intended for public PKI or for settings where a CA compromise would have critical impact. It does not replace an HSM, a formal key ceremony or a commercial CA.
Goals
- Root → intermediate → service certificate hierarchy, with the Root kept offline.
- Friendly UI for issuing certificates and distributing trust to hosts.
- Security first: CA keys encrypted at rest, mandatory authentication, multi-user roles, audit log, optional sign-in with Keycloak/OIDC.
Getting started
Install a release (recommended): a .deb/.rpm package with a systemd service, a container image, or a bare binary for Linux, macOS and Windows. See Installing; Docker details (a single container, unprivileged, read-only filesystem) are in Deployment.
Or build from source:
make build # builds the web UI (needs Node 20.19+ or 22.12+), then the Go binary into bin/
./bin/pki-dash -tls-self-signed # or -tls-cert/-tls-key, or -insecure-http for local development
Then open https://localhost:8443.
The server refuses to start unless you choose how it is served. On first run it prints a one-time setup token to its log; enter it in the web UI (or send it to POST /api/v1/setup) to create the first admin and the master passphrase. After every restart the vault is locked: unlock it from the UI (or POST /api/v1/vault/unlock), so CA keys never sit decrypted on disk.
Documentation
- Vision and scope
- Stack decision
- Deployment (Docker)
- Keeping the Root offline
- Revocation and CRLs
- Signing in with Keycloak (OIDC)
- Installing: packages, image, binaries
License
MIT. Bundled third-party software is listed in THIRD_PARTY_NOTICES.md, including cfssl (BSD-2-Clause).
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
pki-dash
command
Command pki-dash is a web dashboard for managing an internal PKI.
|
Command pki-dash is a web dashboard for managing an internal PKI. |
|
internal
|
|
|
api
Package api is pki-dash's HTTP interface: a JSON API under /api/v1.
|
Package api is pki-dash's HTTP interface: a JSON API under /api/v1. |
|
auth
Package auth implements local accounts, sessions and role-based access.
|
Package auth implements local accounts, sessions and role-based access. |
|
ca
Package ca isolates the cfssl library behind pki-dash's own interface.
|
Package ca isolates the cfssl library behind pki-dash's own interface. |
|
oidc
Package oidc signs users in through an external OpenID Connect provider (Keycloak and the like) using the authorization-code flow with PKCE.
|
Package oidc signs users in through an external OpenID Connect provider (Keycloak and the like) using the authorization-code flow with PKCE. |
|
oidc/oidctest
Package oidctest is a minimal OpenID provider for tests: discovery, signing keys and a token endpoint that checks PKCE, the client secret and the redirect URI the way a real one does.
|
Package oidctest is a minimal OpenID provider for tests: discovery, signing keys and a token endpoint that checks PKCE, the client secret and the redirect URI the way a real one does. |
|
service
Package service holds pki-dash's business rules.
|
Package service holds pki-dash's business rules. |
|
store
Package store persists pki-dash state in a single SQLite file.
|
Package store persists pki-dash state in a single SQLite file. |
|
vault
Package vault encrypts secrets (CA private keys) at rest.
|
Package vault encrypts secrets (CA private keys) at rest. |
|
Package web embeds the built frontend (web/dist) into the Go binary.
|
Package web embeds the built frontend (web/dist) into the Go binary. |