boulder - An ACME-based CA, written in Go.

•    Go

---

This is an implementation of an ACME-based CA. The ACME protocol allows the CA to automatically verify that an applicant for a certificate actually controls an identifier, and allows domain holders to issue and revoke certificates for their domains.Boulder has a Dockerfile to make it easy to install and set up all its dependencies. This is how the maintainers work on Boulder, and is our main recommended way to run it.

boulder acme certificate-authority tls lets-encrypt ca pki certificate security

docker-openvpn - 🔒 OpenVPN server in a Docker container complete with an EasyRSA PKI CA

•    Shell

---

OpenVPN server in a Docker container complete with an EasyRSA PKI CA.Extensively tested on Digital Ocean $5/mo node and has a corresponding Digital Ocean Community Tutorial.

openvpn-server docker-container docker-openvpn pki docker openvpn easyrsa-pki

forge - A native implementation of TLS in Javascript and tools to write crypto-based and network-heavy webapps

•    Javascript

---

A native implementation of TLS (and various other cryptographic tools) in JavaScript. The Forge software is a fully native implementation of the TLS protocol in JavaScript, a set of cryptography utilities, and a set of tools for developing Web Apps that utilize many network resources.

crypto cryptography x509 message-digest aes asn1 cipher pkcs tls certificate pkcs7 pkcs1 pkcs12 pbkdf2 csr hmac sha1 sha256 md5 asn asn.1 cbc des gcm http https network pki prng rc2 rsa sha384 sha512 ssh x.509

Python-gnupg - Python API which wraps the GNU Privacy Guard

•    Python

---

The gnupg module allows Python programs to make use of the functionality provided by the GNU Privacy Guard (abbreviated GPG or GnuPG). Using this module, Python programs can encrypt and decrypt data, digitally sign documents and verify digital signatures, manage (generate, list and delete) encryption keys, using proven Public Key Infrastructure (PKI) encryption technology based on OpenPGP.

gnupg cryptography encryption openpgp pki public-key-infrastructure security

Ejbca - PKI Certificate Authority software

•    Java

---

EJBCA is an enterprise class PKI Certificate Authority software. It supports SSL/TLS, Smart card logon to Windows and/or Linux, Signing and encrypting email (SMIME), Mobile PKI, Secure mobile networks and lot more.

certificate-authority certificate s-mime pki cryptography security ssl

Dogtag - Certificate System

•    Java

---

The Dogtag Certificate System is an enterprise-class open source Certificate Authority (CA). It is a full-featured system, and has been hardened by real-world deployments. It supports all aspects of certificate lifecycle management, including key archival, OCSP and smartcard management, and much more. It supports Certificate issuance, revocation, and retrieval, Certificate Revocation List (CRL) generation and publishing, Encryption key archival and recovery and lot more.

certificate-authority certificate certificate-management pki cryptography security

OpenCA - PKI Management Software

•    Javascript

---

The OpenCA PKI Development Project is a collaborative effort to develop a robust, full-featured and Open Source out-of-the-box Certification Authority implementing the most used protocols with full-strength cryptography world-wide. The project development is divided in two main tasks: studying and refining the security scheme that guarantees the best model to be used in a CA and developing software to easily setup and manage a Certification Authority.

certificate-authority certificate pki cryptography digital-signature security

AutomatedLab - AutomatedLab is a provisioning solution and framework that lets you deploy complex labs on HyperV and Azure with simple PowerShell scripts

•    PowerShell

---

AutomatedLab (AL) enables you to setup test and lab environments on Hyper-v or Azure with multiple products or just a single VM in a very short time. There are only two requirements you need to make sure: You need the DVD ISO images and a Hyper-V host or Azure subscription machine.

powershell deployment active directory pki exchange scripted active-directory domain-controller automated-deployment scripted-deployment lab-machine azure hyperv hyper

certificates - 🛡️ An online certificate authority and related tools for secure automated certificate management, so you can use TLS everywhere

•    Go

---

An online certificate authority and related tools for secure automated certificate management, so you can use TLS everywhere. For more information and docs see the Step website and the blog post announcing Step Certificate Authority.

tls x509 certificates security security-tools certificate-authority pki ca

Public Key Infrastructure PowerShell module

•    

---

This module is intended to simplify certain PKI management tasks by using automation with Windows PowerShell.

ad-cs adcs certificate-services pki powershell

Certificate Request (PKCS#10) Generator

•    

---

A .NET application that can create PKCS#10 Certificate Requests, either by generating a new key or reusing a preexisting one. Minimum requirement : Windows Vista and above. .NET 2.0.

certificate-request certificates cryptography pfx pkcs10 pkcs12 pki

sharkey - Sharkey is a service for managing certificates for use by OpenSSH

•    Go

---

Sharkey is a service for managing certificates for use by OpenSSH.Sharkey has a client component and a server component. The server is responsible for issuing signed host certificates, the client is responsible for installing host certificates on machines. Sharkey builds on the trust relationships of your existing X.509 PKI to manage trusted SSH certificates. Existing X.509 certificates can be minted into SSH certificates, so you don't have to maintain two separate PKI hierarchies.

openssh certificate enterprise-software trust-on-first-use tofu crypto ssh certificates pki

Openxpki - Manage Keys and Certificate

•    Perl

---

The OpenXPKI project has the vision to publish a software stack that provides all necessary components to manage keys and certificates primarily based on the X509v3 cryptography standard.

certificate-store certificate-management key-management secure-store pki

KadNode - P2P DNS with content key, crypto key and PKI support. DynDNS alternative.

•    C

---

KadNode is a small and decentralized DNS resolver that can use existing public key infrastructures. It utilizes the BitTorrent P2P network and mbedtls for TLS/crypto support. KadNode can intercept .p2p domain queries on the systems level and resolve them using a decentralized DHT network. TLS authentication can be used to make sure the correct IP address was found. If successful, the IP address is passed to the application making the request.

p2p dns dht tls decentralized pki dyndns

debops - DebOps - Your Debian-based data center in a box

•    Shell

---

The DebOps project provides a set of general-purpose Ansible roles that can be used to manage Debian or Ubuntu hosts. In addition, a default set of Ansible playbooks can be used to apply the provided roles in a controlled way, using Ansible inventory groups. The roles are written with a high customization in mind, which can be done using Ansible inventory. This way the role and playbook code can be shared between multiple environments, with different configuration in to each one.

ansible debian self-hosted ubuntu data-center sysadmin-tool sysadmin pki

crypto - A native library implementing of cryptography, ciphers, PKI and the formats that are used in PKI applications

•    C++

---

A native library implementing of cryptography, ciphers, PKI and the formats that are used in PKI applications.

pki cryptography signing encryption csp crypto trusted cms

node-acme

•    Javascript

---

The module provides both client and server implementations. For full details of the protocol, see the ACME protocol specification. An ACME client represents a certificate subject, such as a web server. For example, you might use ACME to acquire a certificate when a new web server instance starts up. This module provides both a fine-grained client interface and a simple one-line call to get a certificate.

certificate pki x.509 https

django-x509 - Reusable django app implementing x509 PKI certificates management

•    Python

---

Simple reusable django app implementing x509 PKI certificates management. Want to help OpenWISP? Find out how to help us grow here.

x509 pki django certificate-authority certificate-revocation-lists crypto

vault-openvpn - Small wrapper utility to manage OpenVPN configuration combined with a Vault PKI

•    Go

---

vault-openvpn is a small wrapper utility to manage OpenVPN configuration combined with a Vault PKI. It enables administrators with Vault access to create client / server configurations with only one command. No more hazzle to manage that easyrsa PKI, just some few commands to set up a Vault PKI and you're done. That's all you need to do to set up a whole PKI for your OpenVPN.

vault openvpn pki certificate

certgen - Wraps openssl utility to dynamically create signed certificates.

•    Javascript

---

A wrapper around the openssl utility for programatically generating signed certificates. All underlying I/O operations are asynchronous, so this is safe to use in a latency-sensitive server program. The main function is generate_cert_buf. Given a signing key and cert, and an 'info' object containing the desired subject distinguished name information, the function creates a certificate, signs it, and opens buffers to the certificate. The buffers can then be supplied to https.createServer().

ssl certificate pki openssl