Skip to content

Command-line utility for managing PKI infrastructure

License

Notifications You must be signed in to change notification settings

lstellway/acert

Repository files navigation

acert

Command-line utility for managing PKI certificates written in Go.


Features


🔐 Manage Your Public Key Infrastructure

Perform many common tasks necessary for setting up your PKI infrastructure.

  • Generate signing requests
  • Generate authority certificates
  • Generate client certificates
  • Build certificate chains
  • Verify certificate root, chain & hosts
  • Trust certificates

✨ Simple, Intuitive API

A goal of this project is to make PKI simple and approachable.

Please don't hesitate to submit an issue or open a pull request with your suggestions


📈 ECDSA Elliptic Curve Support

Certificates can be signed using ECDSA Elliptic Curves:

Standard Description
P-224 Uses a curve which "implements NIST P-224 (FIPS 186-3, section D.2.2)"
P-256 Uses a curve which "implements NIST P-256 (FIPS 186-3, section D.2.3)"
P-384 Uses a curve which "implements NIST P-384 (FIPS 186-3, section D.2.4)"
P-521 Uses a curve which "implements NIST P-521 (FIPS 186-3, section D.2.5)"

Be sure to check if the chosen elliptic curve is supported for your use case
For example: Chrome 42.x does not support P-521


📉 ED25519 Support

A certificate can be signed with a key using the ED25519 signature algorithm.

Be sure to check if your use case supports ED25519 (good reference).


Installation


Prebuilt Binaries

You can download pre-built binaries for your operating system on the Releases page.


Homebrew

The acert package is included in the lstellway/formulae tap.
To install with homebrew, tap the tap:

brew tap lstellway/formulae

Update taps and install the formula:

brew update \
    && brew install lstellway/formulae/acert

Optionally test the installation:

brew test lstellway/formulae/acert

...and enjoy the brew 🍻


Build From Source

To build from source:

  1. install and configure Go on the system.
  2. Download the repository
  3. Run make build to build the binary:
git clone https://github.com/lstellway/acert.git \
    && cd acert \
    && make build

This will output the acert binary in the directory.
Be sure to move it into a directory included in your PATH environment variable.


Usage


# Build a self-signed certificate authority with "local-root" as the subject alternative name
acert authority -san 'local-root'

# Use ECDSA elliptic curves 
acert authority -ecdsa -san 'local-root'

# Trust the authority certificate
acert trust local-root.ca.cert.pem

# Create a certificate chain by signing another authority
acert authority -parent local-root.ca.cert.pem -key local-root.ca.key.pem -san 'local-intermediate'

# Sign a client certificate with the intermediate certificate
acert client -parent local-intermediate.ca.cert.pem -key local-intermediate.ca.key.pem -san 'test.com,*.test.com'

# Verify that the certificate is setup as expected
acert verify -root local-root.ca.cert.pem -intermediate local-intermediate.ca.cert.pem -hosts 'test.com,*.test.com' test.com.cert.pem

If you ever need help with a command, simply run the help subcommand:

# Main help page
acert help

# Authority help page
acert authority help

A test/ directory has also been added with an example for testing your certificate with NGINX on Docker.

More help documentation coming soon...


Versioning


To show the current version of acert, run:

acert version

Format

Versions will be in the year.month[.revision][-stage] format. Examples:

2021.09.1
2021.10.1-alpha
2021.10.1-beta
2021.10.1-rc
...

Resources

About

Command-line utility for managing PKI infrastructure

Resources

License

Stars

Watchers

Forks

Packages

No packages published