czertainly/czertainly-core repository overview

⁠CZERTAINLY Core

Core provides the basic functionality for the CZERTAINLY platform. It implements the logic for the certificate lifecycle management and handles all related tasks. You can think about it as a brain of the CZERTAINLY platform.

There are 2 types of communication that the Core is responsible for:

• client requesting management operations on top of certificates and related objects
• Connector that provides with the functionality for specific technologies

The management of certificates and cryptographic keys is abstracted through CZERTAINLY objects called Profiles, such as:

• RA Profile - configuration of the service for certificate lifecycle management
• Token Profile - configuration of the cryptographic service and management of the keys
• Compliance Profile - compliance requirements for the certificates and related objects

For more information, refer to the CZERTAINLY documentation⁠.

⁠Access Control

Core access control requires the following to run:

• CZERTAINLY-Auth⁠ service to manage users, roles, permission. The URL of the Auth service can be configured using AUTH_SERVICE_BASE_URL environment variable.
• OPA (Open Policy Agent) evaluating policies and providing decisions about authorization. The OPA service URL can be confgiured using OPA_BASE_URL environment variable.
• OPA policies bundles that are loaded into OPA service and define the rules to be evaluated. The policies are defined in CZERTAINLY-Auth-OPA-Policies⁠

⁠Certificate inventory

Certificate inventory contains all Certificates that were discovered or were imported to the platform. Each Certificate provides comprehensive and consistent information which can be managed.

⁠Lifecycle operations

The following basic lifecycle operations are supported for each Certificate:

• create (request)
• issue
• renew
• rekey
• revoke

Operations can be automated by the Core, but also can be performed manually by the user.

⁠Cryptographic key inventory

Key inventory contains all Keys that are available for usage. Each Key provides comprehensive and consistent information which can be managed through the Token Profile.

⁠Experimental support for PQC algorithms

Core supports the following PQC algorithms: FALCON, CRYSTALS-Dilithium, SPHINCS+. The support is experimental and it is not recommended to use it in production as the PQC algorithms are still in the development and not fully standardized.

⁠Protocol support

Core support the following protocols for certificate management:

• ACME
• SCEP (with optional Intune support)
• CMP

⁠Message brokers support

Application supports two types of message brokers:

• RabbitMQ - uses JmsPoolConnectionFactory with configurable connection pool settings
• Azure Service Bus - uses JmsConnectionFactory with two authentication options:
  • SAS (Shared Access Signature) - uses connection string with policy name and key
  • AAD (Azure Active Directory / Entra ID) - uses OAuth2 with Service Principal credentials

⁠Authentication configuration

⁠Docker container

Core is provided as a Docker container. Use the czertainly/czertainly-core:tagname to pull the required image from the repository. It can be configured using the following environment variables:

⁠OpenTelemetry settings

Core supports OpenTelemetry for producing signals (metrics, traces, logs) to the observability system. The following environment variables can be used to configure OpenTelemetry:

⁠Proxy settings

You may need to configure proxy to allow Core to communicate with external systems. To enable proxy, use the following environment variables for docker container:

Example values:

• HTTP_PROXY=http://user:[email protected]:3128
• HTTPS_PROXY=http://user:[email protected]:3128
• NO_PROXY=localhost,127.0.0.1,0.0.0.0,10.0.0.0/8,cattle-system.svc,.svc,.cluster.local,my-domain.local