ReactorCA is a powerful command-line tool written in Go, designed for managing a self-signed Certificate Authority (CA) tailored for homelab and small office environments. This solution enables users to create and manage X.509 certificates for internal devices and services, ensuring secure TLS communication without unnecessary warnings.

Key Features

• Self-Signed Certificate Authority Management: Easily create, renew, and manage a CA as well as generate and renew certificates for hosts and services within a local network.
• Secure Key Encryption: Utilizes robust encryption mechanisms with the age encryption format for private keys, offering protection through various methods:
  • Password-based encryption using scrypt derived keys.
  • SSH key-based encryption leveraging existing SSH identities.
  • Hardware token encryption with support for devices like YubiKey and Secure Enclave plugins.
• Easy Certificate Tracking: Keep track of certificate inventories and expiry dates, helping users avoid unexpected outages due to expired certificates.
• Simple Deployment Mechanism: Straightforward shell scripts for deploying certificates to various environments such as FritzBox, Proxmox, or NixOS, ensuring that integration into existing setups is seamless and efficient.
• No Runtime Dependencies: The application is packaged as a statically-linked binary, simplifying installation and execution.

Motivation

With TLS certificate lifetimes shortening in the industry, having a streamlined one-command mechanism for reissuing and deploying certificates is increasingly critical. ReactorCA allows for the centralized management of keys and certificates, following a modern CLI design, where all operations can be version controlled within an infrastructure Git repository. Key tasks such as issuing, renewing, and deploying certificates are designed to minimize configuration effort while maintaining a secure and compliant environment.

Optimal Cryptographic Foundations

ReactorCA relies on established cryptographic standards, utilizing:

• Go's Standard Crypto Libraries for secure random number generation and key management.
• The age library for modern file encryption, leveraging ChaCha20-Poly1305 for encrypting private keys. Private keys are stored securely in .key.age files, making them accessible only by authorized users.

Quick Start

As a user, initiating the CA setup is intuitive:

1. Initialize Configuration: Set up default config files with a single command.

   ca init
   

2. Create CA Certificate: Generate a self-signed CA and encrypted private key.

   ca ca create
   

3. Issue Host Certificates: Quickly add certificates for hosts on the network.

   ca host issue web-server-example
   

4. List Certificates: View all issued certificates along with their respective expiration dates.

   ca host list
   

5. Export and Deploy Certificates: Flexible deployment options allow the export of certificates or direct deployment in a single command.

   ca host issue web-server-example --deploy
   

For a detailed understanding of each functionality and advanced configurations, users are encouraged to explore the comprehensive documentation provided within the ReactorCA repository.