homepki vs. other tools
How homepki 0.8.0 compares with other command line tools that create local certificates. The comparison is about local development and test use.
Feature matrix
| Feature | homepki | mkcert | step | cfssl | easy-rsa | minica | certstrap |
|---|---|---|---|---|---|---|---|
| Intermediate CAs | Yes | No | Yes | Yes | separate PKI | No | Yes |
| Several intermediates per root | Yes | No | Yes | Yes | manual | No | Yes |
| Client (mTLS) certificates | Yes | Yes | Yes | Yes | Yes | No | Yes |
| Name constraints | Yes | No | templates | policy config | OpenSSL config | No | DNS only |
| Constraints checked before writing | Yes | No | No | No | No | No | No |
| Key types | RSA, ECDSA, Ed25519 | RSA, ECDSA | RSA, ECDSA, Ed25519 | RSA, ECDSA | RSA, ECDSA, EdDSA | RSA, ECDSA | RSA, ECDSA |
| Custom validity | Yes | No | Yes | Yes | Yes | No | Yes |
| Sign an external CSR | Yes | Yes | Yes | Yes | Yes | No | Yes |
| PKCS#12 output | Yes | Yes | Yes | No | Yes | No | No |
| Revocation (CRL) | Yes | No | with step-ca | Yes | Yes | No | Yes |
| OCSP, ACME or an online CA | No | No | step-ca: ACME, no OCSP | API server, OCSP | No | No | No |
| Chain check of the whole tree | Yes | No | per file | per file | No | No | No |
| Trust install: macOS, Linux | Yes | Yes | Yes | No | No | No | No |
| Trust install: Windows | No | Yes | Yes | No | No | No | No |
| Trust install: Firefox/NSS, Java | Yes | Yes | Yes | No | No | No | No |
| Encrypted private keys | No | No | Yes | No | Yes | No | Yes |
| Needs OpenSSL | No | No | No | No | Yes | No | No |
"step" is the step CLI; online features come from step-ca, its companion server. Entries for the other tools describe their documented behaviour, not a test run.
When to use which
| Need | Best fit |
|---|---|
Make https://localhost work in a browser, on any OS including Windows | mkcert |
| mTLS or multi-tenant demos with CA bundles, client certificates and CRLs, on macOS or Linux | homepki |
| A CA that constrains which names it can sign, checked before a certificate is written | homepki |
| An online CA with ACME, short-lived certificates on demand, SSH certificates | step-ca |
| A CA behind an HTTP API, with OCSP | cfssl |
| A long-lived OpenVPN PKI with encrypted keys | easy-rsa |
| Certificates issued inside Kubernetes | cert-manager, with a homepki intermediate as its CA issuer |
mkcert
mkcert creates one local root and signs leaves directly with it. Its strength is trust installation: the system store on macOS, Linux and Windows, Firefox/NSS and Java, in one command. It has no intermediates, no name constraints, fixed validity and no revocation. Its root can vouch for any name once trusted. homepki covers the same trust stores except Windows, and adds the hierarchy, client certificates under separate intermediates, name constraints and CRLs.
step and step-ca
step certificate create can build the same three tiers with profiles, and templates allow name constraints. You choose file names and layout yourself. step-ca adds an online CA with ACME, provisioners and SSH certificates. homepki fixes the layout per domain and intermediate, derives the subjects, verifies every chain in list, and needs no server.
cfssl
cfssl is configured with JSON: CSR definitions, signing profiles and policies. It can run as an HTTP API, generate CRLs and serve OCSP. It does not install trust. It fits a CA used by services and CI over an API more than a workstation.
easy-rsa
easy-rsa is a set of shell scripts around OpenSSL, known from OpenVPN. One PKI directory holds one CA; a sub-CA is a second PKI signed by the first. It supports revocation with CRLs, encrypted keys and PKCS#12 export. It needs OpenSSL and does not install trust.
minica
minica creates a root and leaves signed by it, one directory per name. It has no intermediates, no client-certificate mode, no revocation and no trust installation. It is the smallest option when a test only needs a leaf and a CA file.
certstrap
certstrap has an init, request-cert, sign workflow, supports intermediates, CRLs and passphrase-protected keys, and can restrict a CA to DNS names. It does not install trust or produce PKCS#12.
OpenSSL
openssl req, x509 and ca can do everything above and more, with configuration files you write. homepki issued certificates with openssl before 0.7.0; it now uses Go's crypto/x509, and OpenSSL is only useful for inspecting results.
What homepki does not do
- No Windows binary and no Windows trust store.
- No online CA: no ACME, no OCSP, no API server.
- Private keys are never encrypted.
- Certificates carry no CRL distribution point; CRL files are handed to servers directly.
- Intermediate CAs cannot be revoked, only replaced with
--force. - Subject names are derived and cannot be set, except through signed CSRs.