XiPKI on Ubuntu 24.04 LTS by cloudimg

XiPKI is a high performance Certificate Authority and Public Key Infrastructure server. It issues, renews and revokes X.509 certificates for the services, devices and people inside your organisation, and it answers certificate status queries so relying parties can check whether a certificate is still valid. This image delivers a complete, self contained PKI, with the certificate authority, the enrolment protocol gateway and the OCSP responder all installed, configured and running as hardened system services within minutes of launch.

The certificate authority is the heart of the image. It holds your signing key, issues certificates against a set of certificate profiles for TLS servers, TLS clients, S/MIME and OCSP signing, maintains revocation state and publishes certificate revocation lists. The protocol gateway puts standard enrolment protocols in front of it, so your existing tooling can request certificates using CMP, EST or a straightforward REST interface without being rewritten. The OCSP responder reads the certificate database directly and answers status queries with signed responses, reporting good for a live certificate and revoked for one you have withdrawn.

On its first boot every instance generates its own certificate authority. A new signing key is created locally on that machine, a new self issued certificate authority certificate is produced, a new database password is set and a new enrolment credential is generated. No key material is shared between instances and none ships inside the image, so certificates issued by your instance are trusted only by the trust store you choose to place that certificate authority into. You can choose the certificate authority name and your organisation name before first boot, or let the instance derive them automatically.

First boot does not simply declare success. Before it marks the instance as ready it runs a full self test that takes a certificate signing request, enrols it through the gateway, and cryptographically verifies that the certificate returned chains to this instance's own certificate authority. The same self test is available to you at any time, and it also confirms that an unauthenticated request is refused and that an unrelated certificate authority cannot verify the certificate, so you can satisfy yourself that verification is genuinely discriminating.

The PKI is closed by default. The certificate authority management interface, the enrolment gateway and the OCSP responder all listen on the loopback interface only, and the management interface additionally requires the client certificate generated on that instance. This matters because an openly reachable certificate authority management interface would let anyone issue certificates your organisation trusts. The certificate database runs on PostgreSQL, bound to the local machine, and holds every certificate issued and all revocation state.

Connect over SSH and the PKI is already running. Read the welcome notes for your certificate authority details, run the self test to watch a certificate issued and verified, then enrol your own certificates through REST, EST or CMP. Extend outward when you are ready by placing a reverse proxy in front of the gateway and opening the OCSP responder so relying parties can check status.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them. cloudimg provides packaging, the secure by default configuration, per instance certificate authority generation, security patching, and 24/7 support with a guaranteed 24 hour response SLA.