Enterprise PKI tools built entirely in Rust. Certificate inspection (PKI Client), certificate issuance (ACME + EST + SCEP), code signing (Authenticode, CMS, PowerShell), and timestamping (RFC 3161). No OpenSSL. Static binaries.
| Guide | Description |
|---|
| Overview | ACME server architecture and capabilities |
| Installation | Standalone ACME server deployment |
| Quick Start | Get ACME running in minutes |
| Integration | certbot, win-acme, IIS, Apache, nginx integration |
| Operations | Monitoring, backup, scaling, troubleshooting |
| Security | TLS configuration, access control, key management |
| PQC Guide | Post-quantum cryptography with ACME |
| Windows CA | Cross-certification and subordination with AD CS |
| WebUI | Admin dashboard configuration |
| Troubleshooting | Common issues and solutions |
| Guide | Description |
|---|
| Overview & Quick Start | Full guide: CLI signing, web service, TSA server, architecture |
| Overview | Signing service architecture and capabilities |
| Installation | Download, build, and deploy the signing binary |
| Quick Start | Sign your first file in 2 minutes |
| API Reference | REST API endpoints, request/response formats |
| Configuration | TOML config, auth modes, certificate groups |
| Security | Crypto stack, auth modes, audit logging, hardening |
| Operations | Certificate rotation, monitoring, troubleshooting |
| Troubleshooting | Common issues and solutions |
| Feature | Description |
|---|
| 20 Subcommands | show, cert, key, csr, chain, crl, revoke, probe, diff, convert, compliance, dane, acme, est, scep, pki, batch, shell, completions, manpages |
| Auto-Detect | Automatically identifies certs, keys, CSRs, CRLs, PKCS#7, PKCS#12 |
| Hierarchy Builder | Build entire CA hierarchies from declarative TOML configuration |
| TLS Probing | Probe live servers with security grading, chain fetch, certificate linting |
| Post-Quantum | ML-DSA-44/65/87 certificate display with NIST Security Level |
| 4 Output Formats | text (human), json (scripting), compact (dashboards), forensic (hex dumps) |
| Compliance | FIPS 140-3, NIST SP 800-57, Federal Bridge validation |
| Interactive Shell | Tab completion, history, paste PEM directly |
| 2,137+ Tests | Unit tests + cross-validation interop suite against python3 cryptography |
| Static Binary | Single musl binary, no runtime dependencies, no OpenSSL |
| Feature | Description |
|---|
| Three Protocols | ACME (RFC 8555), EST (RFC 7030), SCEP (RFC 8894) -- all on a single port |
| Certbot Compatible | Works with certbot, acme.sh, win-acme, and any RFC 8555 ACME client |
| FIPS 140-3 | Enabled by default via aws-lc-rs (NIST Cert #4816) |
| Post-Quantum | ML-DSA (FIPS 204), SLH-DSA (FIPS 205), hybrid composites |
| Encrypted Lockbox | CA private keys protected with AES-256-GCM + Argon2id key derivation |
| Domain Policy | Glob-pattern domain restrictions via domain-policy.toml, deny-by-default |
| Admin Dashboard | Web UI at /admin with Basic Auth + session cookies |
| Three Signers | Micro-CA (local), Windows CA (WinRM bridge), NDES (SCEP bridge) |
| Rate Limiting | Per-IP (600/min) and per-account (300/min) rate limits |
| Zero Dependencies | Single static binary (musl), 256 MB RAM, no runtime deps |
| Feature | Description |
|---|
| PE Authenticode | Sign EXE, DLL, SYS, OCX, SCR, CPL, DRV with embedded PKCS#7 |
| Detached CMS | Sign any file with a .p7s detached PKCS#7 signature |
| PowerShell Signing | PS1 scripts with Base64-encoded PKCS#7 signature blocks |
| RFC 3161 TSA | Built-in Time-Stamp Authority server (port 3318) and TSA client with failover |
| Post-Quantum | ML-DSA (FIPS 204), SLH-DSA (FIPS 205) signature algorithms |
| REST API | Code Signing as a Service with LDAP auth, audit logging, cert hot-reload |
| No OpenSSL | Pure Rust crypto stack. cargo-deny blocks OpenSSL at build time. |
| No signtool | Replaces Microsoft signtool.exe entirely on Linux |
| 531 Tests | Comprehensive unit tests with CI on every push |
| Static Binary | Single musl binary, no runtime dependencies |
All tools ship as single statically linked binaries (musl). No runtime dependencies.
All pure Rust. No OpenSSL. No liboqs. FIPS 140-3 enabled by default (aws-lc-rs, NIST Cert #4816). Non-FIPS pure Rust mode via runtime toggle.