nbmaiti/certstrap repository overview

Repo certstrap-multi-platform-docker⁠

⁠certstrap

A simple certificate manager written in Go, to bootstrap your own certificate authority and public key infrastructure. Adapted from etcd-ca.

certstrap is a very convenient app if you don't feel like dealing with openssl, its myriad of options or config files.

Dockerhub built images support linux/386,linux/amd64,linux/arm/v7,linux/arm/v6,linux/arm64,linux/ppc64le platforms

⁠Common Uses

certstrap allows you to build your own certificate system:

1. Initialize certificate authorities
2. Create identities and certificate signature requests for hosts
3. Sign and generate certificates

⁠Certificate architecture

certstrap can init multiple certificate authorities to sign certificates with. Users can make arbitrarily long certificate chains by using signed hosts to sign later certificate requests, as well.

⁠Examples

⁠Getting Started

⁠Building

certstrap must be built with Go 1.13+. Can build certstarp image locally as below. Or can use docker hub image⁠. You can build certstrap from source:

$ docker build .

This will generate a binary called certstrap under project root folder.

⁠Initialize a new certificate authority:

From Dockerhub image

$ docker run  nbmaiti/certstrap certstrap -h

Initialize CA

$ docker run -v ${PWD}/certificates:/certs -it  nbmaiti/certstrap --depot-path /certs  init --common-name "CertAuth"
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Created /certs/CertAuth.key
Created /certs/CertAuth.crt
Created /certs/CertAuth.crl

Note that the -common-name flag is required, and will be used to name output files.

Moreover, this will also generate a new keypair for the Certificate Authority, though you can use a pre-existing private PEM key with the -key flag.

If the CN contains spaces, certstrap will change them to underscores in the filename for easier use. The spaces will be preserved inside the fields of the generated files:

$ docker run -v ${PWD}/certificates:/certs -it  nbmaiti/certstrap --depot-path /certs  init --common-name "Cert Auth"
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Created /certs/Cert_Auth.key
Created /certs/Cert_Auth.crt
Created /certs/Cert_Auth.crl

⁠Request a certificate, including keypair:

$ docker run -v ${PWD}/certificates:/certs -it  nbmaiti/certstrap --depot-path /certs  request-cert --common-name "Alice" 
./certstrap request-cert --common-name Alice
Enter passphrase (empty for no passphrase): 
Enter same passphrase again:
Created /certs/Alice.key
Created /certs/Alice.csr

certstrap requires either -common-name or -domain flag to be set in order to generate a certificate signing request. The CN for the certificate will be found from these fields.

If your server has mutiple ip addresses or domains, use comma seperated ip/domain/uri list. eg: ./certstrap request-cert -ip $ip1,$ip2 -domain $domain1,$domain2 -uri $uri1,$uri2

If you do not wish to generate a new keypair, you can use a pre-existing private PEM key with the -key flag

⁠Sign certificate request of host and generate the certificate:

$ docker run -v ${PWD}/certificates:/certs -it  nbmaiti/certstrap --depot-path /certs sign Alice --CA CertAuth
Created /certs/Alice.crt from /certs/Alice.csr signed by /certs/CertAuth.key

⁠PKCS Format:

If you'd like to convert your certificate and key to PKCS12 format, simply run:

$ openssl pkcs12 -export -out outputCert.p12 -inkey inputKey.key -in inputCert.crt -certfile CA.crt

inputKey.key and inputCert.crt make up the leaf private key and certificate pair of your choosing (generated by a sign command), with CA.crt being the certificate authority certificate that was used to sign it. The output PKCS12 file is outputCert.p12

⁠Key Algorithms:

Certstrap supports curves P-224, P-256, P-384, P-521, and Ed25519. Curve names can be specified by name as part of the init and request_cert commands:

$ docker run -v ${PWD}/certificates:/certs -it  nbmaiti/certstrap --depot-path /certs  init --common-name CertAuth --curve P-256
Created certs/CertAuth.key
Created certs/CertAuth.crt
Created certs/CertAuth.crl

$ docker run -v ${PWD}/certificates:/certs -it  nbmaiti/certstrap --depot-path /certs request-cert --common-name Alice --curve P-256
Created certs/Alice.key
Created certs/Alice.csr

⁠Retrieving Files

Outputted key, request, and certificate files can be found in the depot directory. By default, this is in out/ Docker images using mapped 'certificates' folder as output. Change the name as per your convenience.

⁠Project Details

This is just docker image for multiple type of architechture. Original golang certstrap project https://github.com/square/certstrap⁠

⁠Contributing

Welcome for any CR/PR

⁠License

certstrap is under the Apache 2.0 license. See the LICENSE⁠ file for details.