homepki documentation
homepki builds a three-tier PKI on your workstation: a self-signed root CA, intermediate CAs under it, and server or client certificates under each intermediate. It is a single Go binary for macOS and Linux with no OpenSSL dependency.
$ homepki root-ca -d runlocal.dev
$ homepki intermediate-ca -d runlocal.dev -n bu1
$ homepki server-cert -d runlocal.dev -i bu1 -s kong-gateway
$ homepki client-cert -d runlocal.dev -i bu1 -c my-clientNew to homepki? Start with Getting started.
Introduction
Getting started
Install homepki and issue a root CA, an intermediate and a leaf.
vs. other tools
How homepki compares with mkcert, step, cfssl, easy-rsa, minica and certstrap.
FAQ
Production use, OpenSSL, re-running commands, starting over.
Issuing certificates
Certificate hierarchy
The three tiers, derived subjects, chain files and the file layout.
Server and client certificates
SANs, key types, validity, PKCS#12 bundles and re-issuing.
Signing external CSRs
Issue a certificate for a key generated elsewhere.
Listing and verification
Expiry, chain checks, revocation status and JSON output.
Using the certificates
Kubernetes, nginx, curl, OpenSSL, Java and Go.
Security
Name constraints
Limit which names a CA may issue for, enforced at issue time.
Revocation
Revoke leaves and publish CRLs for servers that check them.
Trusting the root CA
System store on macOS and Linux, Firefox/NSS and Java.