gopki

README

gopki

Design certificate hierarchies witout pain.

Motivation

Creating lots of Certificate Authorities with lots of Subscribers can be a lot of trouble in testing environments. There is usually extensive configuration necessary and the generation involves a multi-step-process including Key Generation, CSR generation and Certificate issuance. And while this may fit production environments, test environment needs to be flexible allowing for a wide range of manipulations.

This is what gopki is for.

How it works

For each entity you supply a config file. Gopki then goes through these config files and generates the appropriate certificates/keys in one single step.

Getting started

Creating a minimal config for a root certificate may looks like this:

version: 1
subject: CN=My Root CA
validity:
    duration: 25y
extensions:
    - basicConstraints:
        critical: yes
        content:
            ca: true
    - keyUsage:
        critical: yes
        content:
            - keyCertSign

Assuming this file is located in foo/root.yaml, you can then generate your certificate with

gopki sign foo/

and have your certificate and private key generated under foo/root.pem.

More sophisticated examples can be found in the examples folder.

Features

Generic certificate profiles

When a lot of subscribers need similar certificates, you can define certificate profiles that pre-set your extensions and allow validation against the subject DN.

Define arbitrary extensions

To really test your edge-cases you can define custom extensions like this:

extensions:
    - custom:
        critical: yes
        oid: 1.2.2.4
        raw: "!binary:AQIDBA=="

Disclaimer

This software must not be used for certificates in production environments. It makes no effort to generate/store/wipe secrets in a secure way.

Documentation

Overview

gopki by David Vogels

This is the main package that initializes the command line interface. For more information about this project, see the README.