homepki

Creates a root CA, intermediate CAs, and server or client TLS certificates on your workstation. One command per tier.

Get started Documentation

Free and MIT licensed. macOS and Linux. One binary, no OpenSSL needed.

Install

With Homebrew, or download a binary from the latest release.

$ brew tap bcollard/homepki
$ brew install --cask homepki

Three tiers, four commands

Each command writes its key and certificate and returns. The intermediate also gets a chain file to hand to clients as a CA bundle.

Root CAhomepki root-ca -d runlocal.dev
Intermediatehomepki intermediate-ca -d runlocal.dev -n bu1
Server leafhomepki server-cert -d runlocal.dev -i bu1 -s kong-gateway
Client leafhomepki client-cert -d runlocal.dev -i bu1 -c my-client

Chains verified

Every list checks the chain, the key usage and revocation, with JSON output for scripts.

System, Firefox and Java trust

Installs the root into the macOS or Linux system store, Firefox profiles and the JDK.

Name constraints

Limit a root to your own domains. Leaves outside them are refused at issue time.

Revocation

Revoke a leaf and get CRL files for nginx and OpenSSL.

Server and client leaves

Separate EKUs for mTLS, SANs, RSA, ECDSA or Ed25519 keys, custom validity, PKCS#12.

Agent Skill

Ships a skill so AI coding tools issue certificates with homepki instead of raw OpenSSL.