Secsy PKI
HSM-backed SSH and X.509 Certificate Authority with OIDC authentication, publicly auditable signing logs, and a web UI.
📖 Documentation ·
Quick start ·
Console walkthrough ·
Examples ·
Architecture
Every page of docs/ is published there — searchable and
cross-linked — by the documentation-site workflow;
make docs-serve renders the same tree locally.
See it first: a walkthrough of the operator console — 22 steps and 27 screenshots, from sign-in to the raw PKCS#11 view of the token.
Secsy PKI manages a public key infrastructure where CA private keys are stored on hardware security modules (HSMs) via PKCS#11. Users authenticate through OpenID Connect and request SSH or X.509 certificates signed by the HSM. Every signing operation is recorded in a cryptographically verifiable audit log backed by the YubiHSM's hardware hash chain.
Enterprise Edition
The enterprise edition (this repository) extends the base CA into a full HSM-backed enterprise PKI and secret-management platform. On top of per-key SSH/X.509 signing it adds:
- Backend-agnostic key provider — one abstraction (
internal/keyprovider) routes every key operation to a PKCS#11 HSM (YubiHSM, network HSM), SoftHSM for dev/CI, or an on-disk software keystore. Keys are generated on the device and never exported.
- X.509 CA lifecycle — bootstrap root and intermediate CAs, then issue, renew, and revoke end-entity certificates from CSRs using named profiles. All signing (leaves, CRLs, OCSP) happens on the HSM.
- Revocation services — signed CRLs (RFC 5280 CRL numbers) and a public OCSP responder.
- HSM-backed secret encryption — envelope-encrypt passwords and small secrets under an RSA KEK whose private half stays on the HSM.
- RBAC — organization-wide roles (
admin, issuer, auditor) layered over the existing per-CA permission matrix.
- Tamper-evident audit log — an append-only, hash-chained event log recording who did what, when, and with what result — including denied attempts, with RFC 3161 anchoring and SIEM export.
- Centralized configuration — RBAC assignments, issuance policy guardrails, and custom certificate profiles in one YAML file.
- Automated enrollment — ACME (RFC 8555, with ARI, client-selectable Profiles, http-01/dns-01/tls-alpn-01, EAB), SCEP, EST, CMP (RFC 9483), and BRSKI (RFC 8995) zero-touch onboarding, plus a host auto-enrollment agent.
- SSH certificate authority — HSM-backed OpenSSH user/host certificates with KRL revocation, and DANE TLSA / SSHFP DNS pinning-record generation.
- Governance & strong auth — four-eyes/maker-checker approvals for sensitive operations, OIDC SSO + mTLS + WebAuthn step-up, native scoped API tokens/service accounts, and multi-tenant isolation with per-tenant quotas.
- Assurance & compliance — pre-issuance CA/B-Forum linting (hand-rolled + optional zlint), Certificate Transparency (SCT embedding + inclusion-proof monitoring), CAA (RFC 8659/8657), Name Constraints & certificate policies, FIPS 140-3 build mode, and PQC/hybrid (ML-DSA) certificates.
- Operations — Prometheus metrics + Grafana/alerts, OpenTelemetry tracing, expiry monitoring + auto-renewal, an issuance canary, external certificate discovery, scheduled encrypted backups with restore-verification, and leader-elected background jobs for multi-replica HA.
See the architecture overview and the full guide index in docs/ for everything below.
Enterprise documentation
Comprehensive deployment and operations guides live in docs/,
grouped into twelve sections. Each links to its own index; the
documentation map lists every page. The same pages are
published — with search and navigation — at
https://blechschmidt.github.io/secsy-pki/ (how).
This is the beginning of the README. Read the rest at the original. Read the full README ↗
