A simple certificate manager written in Go, to bootstrap your own certificate authority and public key infrastructure. Adapted from etcd-ca.
certstrap is a very convenient app if you don't feel like dealing with openssl, its myriad of options or config files.
certstrap allows you to build your own certificate system:
- Initialize certificate authorities
- Create identities and certificate signature requests for hosts
- Sign and generate certificates
certstrap can init multiple certificate authorities to sign certificates with. Users can make arbitrarily long certificate chains by using signed hosts to sign later certificate requests, as well.
certstrap must be built with Go 1.13+. You can build certstrap from source:
$ git clone https://github.com/square/certstrap $ cd certstrap $ go build
This will generate a binary called
certstrap under project root folder.
Initialize a new certificate authority:
$ ./certstrap init --common-name "CertAuth" Created out/CertAuth.key Created out/CertAuth.crt Created out/CertAuth.crl
Note that the
-common-name flag is required, and will be used to name output files.
Moreover, this will also generate a new keypair for the Certificate Authority, though you can use a pre-existing private PEM key with the
If the CN contains spaces, certstrap will change them to underscores in the filename for easier use. The spaces will be preserved inside the fields of the generated files:
$ ./certstrap init --common-name "Cert Auth" Created out/Cert_Auth.key Created out/Cert_Auth.crt Created out/Cert_Auth.crl
Request a certificate, including keypair:
$ ./certstrap request-cert --common-name Alice Created out/Alice.key Created out/Alice.csr
certstrap requires either
-domain flag to be set in order to generate a certificate signing request. The CN for the certificate will be found from these fields.
If your server has mutiple ip addresses or domains, use comma seperated ip/domain/uri list. eg:
./certstrap request-cert -ip $ip1,$ip2 -domain $domain1,$domain2 -uri $uri1,$uri2
If you do not wish to generate a new keypair, you can use a pre-existing private PEM key with the
Sign certificate request of host and generate the certificate:
$ ./certstrap sign Alice --CA CertAuth Created out/Alice.crt from out/Alice.csr signed by out/CertAuth.key
If you'd like to convert your certificate and key to PKCS12 format, simply run:
$ openssl pkcs12 -export -out outputCert.p12 -inkey inputKey.key -in inputCert.crt -certfile CA.crt
inputCert.crt make up the leaf private key and certificate pair of your choosing (generated by a
sign command), with
CA.crt being the certificate authority certificate that was used to sign it. The output PKCS12 file is
Certstrap supports curves P-224, P-256, P-384, P-521, and Ed25519. Curve names can be specified by name as part of the
$ ./certstrap init --common-name CertAuth --curve P-256 Created out/CertAuth.key Created out/CertAuth.crt Created out/CertAuth.crl $ ./certstrap request-cert --common-name Alice --curve P-256 Created out/Alice.key Created out/Alice.csr
Outputted key, request, and certificate files can be found in the depot directory. By default, this is in
See CONTRIBUTING for details on submitting patches.
certstrap is under the Apache 2.0 license. See the LICENSE file for details.