Pure Rust Certificate Authority for post-quantum cryptography migration. Enterprise PKI without C dependencies.
| Guide | Description | Time |
|---|
| How It Works | Architecture, PKI hierarchy, protocols, security model | 15 min |
| Install Guide | Download, verify, and install any SPORK package | 5 min |
| Quick Start | Initialize a CA, issue a certificate, set up revocation | 10 min |
| ACME Install Guide | Full install guide for the standalone ACME server | 15 min |
| ACME Server Setup | Run your own Let's Encrypt-compatible CA with certbot | 10 min |
| Configuration Reference | CLI flags, environment variables, config file, mTLS | Reference |
| Upgrade Guide | Upgrade from a previous version | 5 min |
| Guide | Description |
|---|
| Overview | ACME server architecture and capabilities |
| Installation | Standalone ACME server deployment |
| Quick Start | Get ACME running in minutes |
| Integration | certbot, win-acme, IIS, Apache, nginx integration |
| Operations | Monitoring, backup, scaling, troubleshooting |
| Security | TLS configuration, access control, key management |
| PQC Guide | Post-quantum cryptography with ACME |
| Windows CA | Cross-certification and subordination with AD CS |
| WebUI | Admin dashboard configuration |
| Troubleshooting | Common issues and solutions |
| Package | Description | License |
|---|
| spork-client | CLI tool for PKI operations (probe, inspect, ACME client, TLS verify) | Apache-2.0 |
| spork-ca | Full CA server suite: shell, ACME, EST, SCEP, CMP, OCSP, CRL, API, TUI, WebUI, Sign, TSA | BSL-1.1 |
| spork-acme-server | Standalone ACME/Let's Encrypt server with built-in CA and WebUI | BSL-1.1 |
| spork-est-server | RFC 7030/8295 EST enrollment server | BSL-1.1 |
| spork-scep-server | RFC 8894 SCEP enrollment server for MDM/device enrollment | BSL-1.1 |
| spork-sign | Code signing service (CMS/PKCS#7, Authenticode) | BSL-1.1 |
| spork-tsa-server | RFC 3161 time-stamp authority server | BSL-1.1 |
| spork-update | In-place binary update for existing CA installations | BSL-1.1 |
All packages are statically linked (musl). No runtime dependencies.
All pure Rust. No OpenSSL. No liboqs. FIPS 140-3 enabled by default (aws-lc-rs, NIST Cert #4816). Non-FIPS pure Rust mode via runtime toggle.