AD-PKI

Open-source PKI management platform for private and internal certificate infrastructures.

🇬🇧 English · 🇩🇪 Deutsch

AD-PKI is an open-source platform for operating a private or internal Public Key Infrastructure (PKI). It provides certificate issuance, management, and revocation, an ACME server, and CRL, OCSP, and timestamping services for your infrastructure.

This repository is the project's central overview and documentation hub. It contains no application code and serves as the entry point for architecture documentation and the independently maintained component repositories.

Installation documentation

For Debian 13 system requirements, package installation, CA preparation, and first-time configuration, see the AD-PKI installation guide.

Features

• Root and intermediate CA management, including import and chain validation
• TLS, client-auth, and code-signing certificate issuance
• CSR upload or server-side CSR and key generation
• ACME v2 server (RFC 8555)
• HTTP-01 and DNS-01 challenge validation
• Wildcard certificate issuance via DNS-01
• Certificate Revocation Lists (CRL)
• OCSP responder
• RFC 3161 Timestamp Authority (TSA)
• Role-based access control (RBAC) with granular permissions
• Teams and tenant separation
• Audit logging of security-relevant actions
• Notifications via mail, webhook, and Telegram
• Real-time updates via WebSocket (Reverb)
• Public documentation for each component

Architecture

AD-PKI separates responsibilities across its components: the frontend renders the user interface and communicates with the API, the backend owns policy and metadata, and the CA service is the only component that handles private key material.

                         ┌────────────────────┐
        Browser  ──────► │  AD-PKI Frontend   │
                         │  (Vue 3 SPA)       │
                         └─────────┬──────────┘
                                   │ REST + WebSocket
                                   ▼
        ACME Clients  ──────► ┌────────────────────┐
        (certbot, acme.sh)    │  AD-PKI Backend    │
                              │  (Laravel API)     │
                              └─────────┬──────────┘
                                   │           │
                                   ▼           ▼
                          ┌──────────────┐ ┌─────────────────┐
                          │ PostgreSQL   │ │  AD-PKI CA      │
                          │ (metadata,   │ │  (Go service)   │
                          │  RBAC, audit)│ │                 │
                          └──────────────┘ │  X.509 signing  │
                                           │  ACME (RFC 8555)│
                                           │  CRL / OCSP     │
                                           │  TSA (RFC 3161) │
                                           └─────────────────┘

• AD-PKI Frontend is a pure UI layer without business logic or cryptographic operations.
• AD-PKI Backend owns authentication, RBAC, policy decisions, audit logging, and notifications. It brokers communication between the frontend, ACME clients, and the CA service, but performs no signing itself.
• AD-PKI CA is the only component that holds CA private key material. It signs certificates and serves ACME, CRL, OCSP, and RFC 3161 endpoints.
• PostgreSQL stores users, roles and permissions, teams, certificate metadata, audit logs, and settings.
• ACME clients such as certbot and acme.sh use the CA service's standard ACME v2 endpoints for automated issuance.
• CRL, OCSP, and TSA protocols are served by the CA service and typically proxied through the backend.

Components

AD-PKI Frontend

Vue 3 web interface for certificates, CAs, ACME, users, and audit logs.

• Vue 3 with Composition API
• TypeScript in strict mode
• Vite
• Certificate management and CA administration
• ACME account and domain management
• Users, roles, teams, and audit logs
• Real-time updates via WebSocket using Laravel Echo and Reverb
• Multi-language support

View AD-PKI Frontend →

AD-PKI Backend

Laravel 13 API for authentication, RBAC, certificate workflows, auditing, and notifications.

• Laravel 13, PHP 8.4, and PostgreSQL
• REST API and authentication with Sanctum
• RBAC, audit logging, and settings management
• ACME account and domain management
• CRL, OCSP, and TSA proxying
• Notifications via mail, webhook, and Telegram
• Real-time broadcasting with Reverb
• Delegation of all cryptographic operations to the CA service

View AD-PKI Backend →

AD-PKI CA

Go service for X.509 signing, ACME, OCSP, CRL, and RFC 3161 timestamping.

• X.509 certificate signing for TLS, client authentication, and code signing
• ACME v2 server (RFC 8555) with HTTP-01 and DNS-01 challenge support
• OCSP responder and CRL generation
• RFC 3161 Timestamp Authority
• Stateless policy handling, relying on the backend for issuance settings and revocation data

View AD-PKI CA →

Repositories

Repository	Purpose	Version	Status
AD-PKI	Central overview and documentation		Active
AD-PKI-Frontend	Vue 3 web UI		Active
AD-PKI-Backend	Laravel API and management layer		Active
AD-PKI-CA	Go-based Certification Authority service		Active
AD-PKI-Debian-Installer	Debian-based installer for the full stack		Active

Security

Warning

AD-PKI handles security-critical infrastructure, including private keys, certificate issuance, and revocation. Review the code and your deployment configuration carefully before using it in production.

• Never commit .env files or private key material to any repository.
• Always set CA_TOKEN in production. Without it, administrative endpoints on the CA service are unauthenticated.
• Protect CA private key material on disk with restrictive filesystem permissions and access controls.
• The backend does not sign certificates directly. All cryptographic operations are delegated to the CA service.
• Run any public-facing deployment behind TLS and a trusted reverse proxy.

Report security-relevant findings responsibly to the maintainers rather than through a public issue.

Project status

AD-PKI is publicly released. The current version is .

The core PKI components are implemented, including ACME certificate issuance, OCSP responder, CRL generation, and RFC 3161 timestamping. AD-PKI is intended for self-hosted internal PKI deployments, lab environments, homelabs, and small-to-medium infrastructure setups.

Before production use, review the deployment model, key storage, backup strategy, access controls, and certificate lifecycle processes carefully.

Initiative	Status
First public release	Available
Core PKI functionality	Available
ACME certificate issuance	Available
OCSP responder	Available
CRL generation	Available
RFC 3161 timestamping	Available
Debian installer for simplified deployment	Available
Production hardening documentation	Planned

Contributions, issues, and feedback are welcome in the individual component repositories.

License

AD-PKI and all core components are licensed under the GNU Affero General Public License v3.0 (AGPLv3). See LICENSE for the full license text.