Open Source · Self-Hosted · ACME RFC 8555

Your own Certificate Authority on your own server.

AD-PKI is a complete, self-hosted PKI for automated certificate management. Full ACME compatibility, RFC 3161 timestamping, team access control — and zero cloud dependency.

View on GitHub Explore the platform

8555ACME RFC

3161TSA RFC

AGPL-3.0License

Go · Laravel · VueStack

Certificate AuthorityProduction Root CA

Active

100%

Infrastructure healthAll systems operationalACME · OCSP · TSA

Active certificates1,284+24 this week

Renewal rate99.8%Automated

✓

api.internalCertificate renewed

now

↻

vpn.internalACME challenge verified

✓

OCSP statusGood

↻

Auto-renewalEnabled

Features

Everything a modern PKI needs

Built for real infrastructure teams who need reliability, compliance, and control — without the cloud subscription.

RFC 8555

ACME Protocol (RFC 8555)

Drop-in compatible with Certbot, acme.sh, and win-acme. Fully automated certificate issuance and renewal — no manual steps.

Automated

Automated Certificate Lifecycle

Issue, renew, and revoke certificates automatically. Schedule-based rotation with configurable lead time before expiry.

RFC 3161

RFC 3161 Timestamping (TSA)

Built-in Timestamp Authority for trusted, verifiable timestamps on documents and artifacts. Fully RFC 3161 compliant.

3 Roles

Team-Based Access Control

Three-tier permission model: Admins, Managers, and Users. Granular control over who can issue, revoke, or configure.

CRL + OCSP

Revocation & Validation

CRL distribution points and OCSP responder included out of the box. Real-time certificate status checks for all relying parties.

Configurable

Flexible Security Policies

Configure key types (RSA/ECDSA), sizes, validity periods, wildcard rules, SAN requirements, and email constraints per CA.

AGPL-3.0

Self-Hosted & Open Source

Deploy on your own infrastructure. Full data sovereignty, no vendor lock-in, no telemetry. AGPL-3.0 licensed.

Root + Int.

Multi-CA Hierarchy

Create Root CAs and Intermediate CAs with independent policies. Supports air-gapped offline root CA workflows.

Architecture

How it all fits together

A clean, layered architecture where every component has a single responsibility.

Clients

Certbot

Linux / macOS

acme.sh

Shell script

win-acme

Windows

Browser

Admin UI

Core Services

Go CA Service

Certificate Authority Core

ACME (RFC 8555)CRLOCSPTSA (RFC 3161)

Laravel 13 Backend

API · Auth · Business Logic

REST APIAuth (Sanctum)QueuesScheduler

Vue 3 Frontend

Admin Dashboard · SPA

PiniaVue RouterViteTailwind

Data & Infra

PostgreSQL

Primary datastore

File System

CA keys & certs

OpenSSL

Crypto operations

Nginx

Reverse proxy

Request Flow

Client→ ACME / HTTPS →Go CA→ REST API →Laravel→ ORM →PostgreSQL

Tech Stack

Built on battle-tested technology

No experimental dependencies. Every component chosen for reliability, performance, and long-term maintainability.

Go 1.22+

CA Service · ACME · OCSP · TSA

Laravel 13 / PHP 8.4

REST API · Auth · Business Logic

Vue 3 Composition API

Admin Dashboard · SPA · Islands

PostgreSQL 15+

Primary Datastore · Full ACID

Docker Compose

Container Orchestration · Deploy

OpenSSL 3.x

Crypto Operations · Key Gen · CA