This project is a public key infrastructure management system designed to automate the issuance, renewal, and revocation of X.509, TLS, and SSH certificates. It functions as a machine identity provider and certificate authority, enabling the establishment of private PKI to secure inter-service communication and remote access.
The system distinguishes itself through hardware-bound identity attestation, which ties cryptographic keys to physical device silicon or TPMs to prevent credential exfiltration. It supports a wide array of identity verification mechanisms, including OIDC, cloud-provider instance documents, Kubernetes service account tokens, and ACMEv2 compliant challenge mechanisms.
Broad capabilities cover the full certificate lifecycle, from automated enrollment via background agents to the management of short-lived SSH certificates. The platform also includes device inventory tracking, mutual TLS network security, and template-based certificate generation with custom extensions.
Operational management is provided through a dedicated command-line interface for PKI lifecycle tasks and metadata inspection.