NOTE: This repo is soon to be archived and replaced. // A small-business or organizational PKI / CA web-based CMS, used for generating SSL/TLS Certificates. In essence, a "certificate factory", complete with CRL management/updating. Can generate both RSA and EC type certificates! Easy to manage and very simple to learn. Detailed, very informative built-in help pages. - Your Local PKI and Certificate Solution!

( Inspired by the original "PHPki" project on SourceForge, by: William E. Roadcap. )

AUTHOR: Jim S. Smith

LICENSE: GNU GENERAL PUBLIC LICENSE, Ver: 2 > ( with some attribution, please )

VERSION: 1.01.05, Updated: 2025/07/13

USE: To create your own certificate authority ("CA"), and issue and sign SSL certificates.

DESCRIPTION:

This is a web-accessible CMS, giving you the ability to set up your own CA.
Designed to be accessible via a web-browser, and includes several security features to limit
access, validate user input, and to create the start of a local CA.
This CMS-application helps simplify the task of generating, signing, issuing, re-issuing, and
otherwise, validating SSL certificates within a local network system.
This CA system also creates and maintains an up-to-date Certificate Revocation List ("CRL"),
which is automated to the point of simplicity! The generated CRLs can even be read by most
of today's email clients and many other applications.

NOTE: Pay very close attention to the "requirements" section.

REQUIREMENTS:

PHP version 7.4 or newer. ( Tested up to PHP 8.2 ),
PHP-Openssl library, installed and enabled,
The OpenSSL OS package and library, installed.
Must have at least V1.1.1f or newer version OpenSSL package installed in the system, ( Tested up to OpenSSL version 3.1.5 ),
PHP Sodium library is highly recommended, as this provides the "Argon2ID" password-hashing capability,
Ability to use the "system()" function,
PHP hash-functions library, (mandatory),
File-system functions: 'file_get_contents()' and 'file_put_contents()' must also be usable,
PHP Zip-class library, installed and enabled. (Soon to implement "download as zip-file" feature),

OTHER NOTES:

When you first set up, you will need to execute "Makefile" from the command line first.
Make sure to set which hosts and ip-addresses will be allowed to log in to admin features!
*This script can function even within sub-folders of the document-root, BTW.*

ORIGINAL NOTES:

``INTRODUCTION:

Open PKI-Admin is a web-application ("web-app") which is designed to basically become what some may
think of, as a "certificate factory", capable of generating different kinds of certificates for different
uses. It can even generate "intermediate CA certificates", which of course, can be used to sign other
certificates!
This CA system can be run under "mod_php", or even better - PHP-FPM ( *which is very commonly used today* ).
Running Open PKI-Admin under PHP-FPM is actually preferred, as this allows it to be run under a separate user
and group from those of the web-server.
Better security for the system is also added to, when it is setup under its own virtual host. This also adds
another "layer of separation" from other web-accessible products, and could also be run under a different user
and group ID from other virtual host containers. ( *Ahh! The magic of PHP-FPM.* )
As far as setting up,
This is one of the simplest web-apps for that task! Just simply run "Makefile" from the command line (*especially
something that should be no problem from Linux/BSD users*). Then, just navigate your browser to the host-name
(and path, if you chose to install to a sub-directory) where Open PKI-Admin resides.
This CA system has its own built-in, on-line "Help Pages" rendered in HTML (*with pictures/screenshots*) to help
you learn just what this web-app can do.
The whole aim of this project, was to try to make one of the most useful and advanced opensource, PHP-based CA apps
around. Please be mindful, that this IS still a work-in-progress - and - I am the only one working on this project.
As usual,
Please (nicely) report any bugs you may experience when running this CA script. (*The more detailed the reports,
the quicker I can find and "squash" those nasty bugs.*) ;-)
Bug reports can be received at:
https://codeberg.org/AFWS/Open-PKI-Admin (*My project repository*).

``Legal Disclaimer:

As with all things in life,

There are bound to be some situations that users of this software may encounter or experience. Being that NO ONE
can account for every possible situation that MAY arise in the future, I make this solemn but plain statement:
1. I can NOT, and will NOT be held liable for ANY consequential damages which MAY result from your use of this
   application. Therefore, you assume ALL risk of loss or misfortune arising from your use of this application.
2. I will also NOT be held liable for ANY acts or usage of this program, by YOU or any others under your authority
   or "jurisdiction" which may be in violation of any and all applicable laws, regulations, rules, etc.
3. This software IS considered cryptographic in nature, function, and purpose. Therefore, it is YOUR responsiblity
   to determine if you are legally able to use this application, with respect to whatever export restrictions or
   controls you are legally bound by, in your country of region of jurisdiction.
4. To the best of my knowledge (*being that I do NOT know everything*), this application, and all of its parts,
   are under a very liberal "license". Being that I have made sure to state in plain English, that this application
   was derived (*IE: "forked", as today's code-hacker parlance goes*) from a previous project (*which was also under a
   very liberal license*), I am not aware of any license-related violations. Therefore, until I actually receive some
   form of "*official notice of violations to that effect*", this application is VERY LIBERALLY-LICENSED, and YES - if
   someone out there believes they can contribute to it, or even improve upon it from what I have already done -- Be My
   Guest! (Or, as my Dad always used to say: "*Have a nut.*") ;-)
   **Just PLEASE leave me, and "William" at least some credit for OUR contributions to it.** :-)