A production-ready Certificate Authority system designed for Kubernetes environments with X.509 and SSH certificate support.
- Root CA creation with YubiKey support (air-gapped security)
- Intermediate CA management
- Certificate issuance with predefined profiles
- Certificate revocation and CRL generation
- REST API for automated certificate management
- Pretty-printed certificate viewing
- HashiCorp Vault integration for key storage
- Go 1.22+
- Task (task runner):
go install github.com/go-task/task/v3/cmd/task@latest - Docker and Docker Compose (for development environment)
# Build CLI and server
task build
# Run CLI
./bin/eca --help
# Run server
./bin/eca-serverStart the development environment with PostgreSQL, Vault, and MinIO:
# Start services
task compose:up
# View logs
task compose:logs
# Stop services
task compose:downtask --listKey tasks:
| Task | Description |
|---|---|
task build |
Build CLI and server binaries |
task test |
Run all tests |
task lint |
Run linters |
task compose:up |
Start dev environment |
task docker:build |
Build Docker images |
eca/
├── cmd/
│ ├── eca/ # CLI entrypoint
│ └── eca-server/ # API server entrypoint
├── pkg/
│ ├── ca/ # Core CA operations
│ ├── storage/ # Storage backends
│ ├── crypto/ # Cryptographic operations
│ ├── config/ # Configuration management
│ └── ui/ # Terminal UI utilities
├── internal/
│ ├── cli/ # CLI commands
│ └── server/ # API server
├── configs/
│ └── profiles/ # Certificate profiles
├── deployments/ # Docker and K8s configs
└── docs/ # Documentation
Configuration can be provided via:
- YAML config file (
~/.eca/config.yamlor/etc/eca/config.yaml) - Environment variables (prefixed with
ECA_) - CLI flags
See configs/config.example.yaml for all options.
- Specification - Complete technical specification
- Getting Started - First steps tutorial
- CLI Reference - Command documentation
- API Reference - REST API documentation
MIT License - see LICENSE file for details.