anavpdel/pki-management repository overview

⁠PKI Management System

A Public Key Infrastructure (PKI) Management System designed for corporate offices. This system integrates with HashiCorp Vault to automate and secure certificate lifecycle management, including Root CA and Intermediate CA setup, role management, and certificate issuance for users and servers.

⁠Features

⁠1. Root Engines and Internal CA Certificate

• Enable and configure Root Engines and Internal CA certificates.

⁠2. Intermediate Engine and Internal Intermediate CA Certificate

• Enable Intermediate Engine and automatically sign an Internal Intermediate CA certificate with the Root CA.
• The system automatically manages CSR (Certificate Signing Request) and signing.

⁠3. Role Management

• Create Intermediate Engine Roles to define permissions for certificate issuance.

⁠4. Department Management

• Create Departments and link them with roles.
• The Intermediate CA, based on defined roles, will generate certificates for users and servers within the department.

⁠Certificate Generation Process

The system allows the generation of two types of certificates:

⁠1. User Certificate

• Generates a PFX file with a random password for secure storage and usage.

⁠2. Server Certificate

• Generates:
  • CA chain
  • Certificate
  • Private key
• The generated files are easily shareable with server administrators.

⁠Environment Variables

Ensure the following environment variables are set before running the application:

NEXT_PUBLIC_APP_NAME="PKI"

NEXTAUTH_URL=https://hashicorp.127-0-0-1.nip.io:3000/
NEXT_PUBLIC_API_URL=https://hashicorp.127-0-0-1.nip.io:3000/
NEXTAUTH_SECRET=D6aTsXXqfmxXcPCj/sfckQRR34oWzvsy/ToIO3KlFcuU

AZURE_AD_CLIENT_ID=xxxx-xxxx-xxxx
AZURE_AD_CLIENT_SECRET=xxxx-xxxx-xxxx
AZURE_AD_TENANT_ID=xxxx-xxxx-xxxx

DATABASE_URL="postgresql://root:S3cret@postgres:5432/pki?schema=public"
DIRECT_DATABASE_URL="postgresql://root:S3cret@postgres:5432/pki?schema=public"

⁠Running with Docker

To run the PKI Management System as a Docker container, follow these steps:

1. Run the Docker container with an interactive shell:

   docker run -it -p 3000:3000 --env-file .env --network pki_postgres_network anavpdel/pki-management /bin/bash
   

   Copy

2. Apply database migrations:

   npx prisma migrate deploy
   

   Copy

3. Start the application:

   npm start
   

   Copy

4. Alternatively, restart the container without an interactive shell:

   docker run -it -p 3000:3000 --env-file .env --network pki_postgres_network anavpdel/pki-management
   

   Copy

⁠Environment Variables Handling

Instead of using --env-file .env, you can directly pass environment variables to the container using the -e flag:

docker run -it -p 3000:3000 \
  -e NEXT_PUBLIC_APP_NAME="PKI" \
  -e NEXTAUTH_URL="https://hashicorp.127-0-0-1.nip.io:3000/" \
  -e NEXT_PUBLIC_API_URL="https://hashicorp.127-0-0-1.nip.io:3000/" \
  -e NEXTAUTH_SECRET="D6aTsXXqfmxXcPCj/sfckQRR34oWzvsy/ToIO3KlFcuU" \
  -e AZURE_AD_CLIENT_ID="xxxx-xxxx-xxxx" \
  -e AZURE_AD_CLIENT_SECRET="xxxx-xxxx-xxxx" \
  -e AZURE_AD_TENANT_ID="xxxx-xxxx-xxxx" \
  -e DATABASE_URL="postgresql://root:S3cret@postgres:5432/pki?schema=public" \
  -e DIRECT_DATABASE_URL="postgresql://root:S3cret@postgres:5432/pki?schema=public" \
  --network pki_postgres_network anavpdel/pki-management

⁠Usage

1. Log in as an Admin.
2. Enable Root Engines and configure the Internal CA certificate.
3. Enable Intermediate Engine and sign the Internal Intermediate CA certificate.
4. Create Roles for Intermediate Engines.
5. Create Departments and link them to roles.
6. Generate Certificates for users and servers as needed.
7. Settings to setup hashicorp URL and Token and other values.

⁠Acknowledgments

• This project leverages HashiCorp Vault for secure certificate management.
• Thanks to the open-source community for contributions to PKI and security tools.