Dogtag PKI is an enterprise-class open source Certificate Authority suite, written in Java and licensed under GPL-2.0, for administrators who need to run their own certificate lifecycle infrastructure rather than buy it as a hosted service.

What it is

Dogtag PKI is a full-featured Public Key Infrastructure suite that has been hardened by real-world deployments. It ships as a set of cooperating subsystems rather than a single daemon: a Certificate Authority (CA), a Key Recovery Authority (KRA), an Online Certificate Status Protocol (OCSP) Responder, a Token Key Service (TKS), a Token Processing System (TPS), and an Automatic Certificate Management Environment (ACME) Responder. The project lives in the Java ecosystem on Fedora, CentOS and RHEL, and it replaces a hand-rolled OpenSSL signing setup or a closed commercial CA product with a managed, policy-driven service.

The concrete problem it solves is the operational side of running a CA. Issuing a certificate is easy; tracking which certificates exist, revoking them, publishing their revocation status, archiving keys so they can be recovered, and answering relying parties that ask whether a certificate is still valid are not. Dogtag supports all aspects of certificate lifecycle management, including key archival, OCSP and smartcard management, and it exposes standards-based interfaces so that clients and enrolled devices can talk to it without custom integration.

Key capabilities

• Six subsystems in one suite: Certificate Authority (CA), Key Recovery Authority (KRA), OCSP Responder, Token Key Service (TKS), Token Processing System (TPS), and ACME Responder.
• An ACME Responder for automated issuance to modern clients, with EST deployment documented alongside it.
• Key archival and recovery through the Key Recovery Authority.
• OCSP revocation checking served by a dedicated OCSP Responder.
• Smartcard and token management through TKS and TPS.
• Hardware Security Module support, covered in the Installation Guide together with sub-CA and clone deployments.
• Separate installable packages, so a site can run only the subsystems it needs: dogtag-pki-ca, dogtag-pki-kra, and the dogtag-pki-theme theme package.

Who uses it and how

• Administrators who must retain control of issuing keys and signing policy instead of delegating them to an external authority.
• Smartcard and token programmes, where the Token Processing System issues and manages certificates on tokens and the Token Key Service supplies the shared secrets behind them.
• Sites that need availability beyond a single instance, using CA clone deployments exercised by the dedicated CA Clone Tests workflow.
• Teams running certificate services in containers, covered by the CA Container Tests workflow.
• Clients that speak ACME or EST, which are served directly by their own responders rather than through custom integration.

Getting started

On Fedora, the full suite installs with sudo dnf install dogtag-pki, individual subsystems with sudo dnf install dogtag-pki-ca dogtag-pki-kra, and the theme package with sudo dnf install dogtag-pki-theme. After installation, each subsystem is deployed by following its own guide under docs/installation/, covering CA, KRA, OCSP, TKS, TPS, ACME and EST.

How it compares

The facts provided here name no comparable certificate authority products and no paid products that Dogtag PKI replaces, so it stands alone in this registry. Evaluation therefore has to rest on the wiki and the installation guides rather than on a feature comparison against named alternatives.

When to use it — and when not to

A self-hoster operates the chosen subsystems and their supporting infrastructure, and the README documents installation on Fedora only, so other platforms require a source build against Fedora, CentOS or RHEL dependencies using ./build.sh rpm. Anyone who wants a managed CA with no servers to run should not pick it. Documentation lives mainly on the wiki rather than in the repository, so a prospective adopter should read the wiki before committing.

$ sudo dnf install dogtag-pki

$ sudo dnf install dogtag-pki-ca dogtag-pki-kra

$ sudo dnf install dogtag-pki-theme

$ sudo dnf install dnf-plugins-core rpm-build git

## NOTE: Use the intendended branch name instead of "master" to pull right dependency version
$ sudo dnf copr -y enable @pki/master

$ sudo dnf builddep -y --spec pki.spec

$ ./build.sh rpm