ipacta

A pure-Python Certificate Authority that replaces Dogtag PKI for FreeIPA deployments. Built on the cryptography library, ipacta provides a compatible REST API, CLI tools, and python3-pki client library that FreeIPA expects, without requiring Java, Tomcat, or the Dogtag stack.

Overview

ipacta implements:

• CA engine -- X.509 certificate signing (RSA, EC, ML-DSA), revocation, CRL generation, OCSP responder (RFC 6960)
• KRA -- Key Recovery Authority for key archival and recovery (FreeIPA vaults)
• ACME -- RFC 8555 protocol server for automated certificate management
• Sub-CAs -- Lightweight Certificate Authorities
• Certificate profiles -- Dogtag-compatible .cfg profile format with ML-DSA support
• HSM support -- Hardware token integration through NSS
• AJP 1.3 server -- Binary protocol for Apache mod_proxy_ajp, with configurable packet size for post-quantum certificates

The python3-pki package is a drop-in replacement for Dogtag's client library. FreeIPA's cainstance.py, certmonger helpers, and ipa cert-* / ipa ca-* / ipa vault-* commands work without code changes.

REST API compatibility

ipacta implements every Dogtag REST endpoint that FreeIPA calls (~44 endpoint patterns across CA, KRA, profiles, authorities, CRL, and OCSP). Certificate requests from the RA agent are signed and returned immediately — there is no pending state or separate approval step, so Dogtag's multi-step agent workflow endpoints (approve, reject, assign, etc.) are not needed.

Dogtag endpoints that ipacta does not implement are either architecturally unnecessary or unused by FreeIPA:

• Group/User admin -- Dogtag's internal user database; ipacta delegates authentication and authorization to LDAP/Kerberos
• KRA connector -- Dogtag connects separate CA and KRA processes; ipacta runs CA+KRA in a single process
• Audit config/log download -- Dogtag internal administration; ipacta has its own audit subsystem
• Feature config, scheduled jobs, self-tests -- Dogtag admin console features not used by FreeIPA
• Installer endpoints (createRequestID, createCertID, installToken) -- ipacta handles its own initialization via pkispawn

ipacta adds endpoints Dogtag does not have: HSM management, serial number range allocation, pruning controls, extended OCSP management, and debug diagnostics.

Building

Requires: autoconf, automake, make, python3-devel, systemd.

./autogen.sh
./configure
make
make install DESTDIR=/path/to/buildroot

To build an RPM:

./autogen.sh
./configure
make dist
rpmbuild -ta ipacta-*.tar.gz

The spec produces three packages:

Package	Contents
ipacta	CLI tools, profiles, LDAP schemas, systemd units
python3-ipacta	CA engine and all Python modules
python3-pki	Drop-in replacement for Dogtag's python3-pki

Installation with FreeIPA

dnf install ipacta freeipa-server
ipa-server-install

ipacta's RPM Provides: pki-ca, pki-kra, and pki-acme, so it satisfies FreeIPA's dependency on Dogtag. The ipa-server-install flow runs unchanged.

Post-quantum cryptography

ipacta supports ML-DSA-44, ML-DSA-65, and ML-DSA-87 (FIPS 204) for certificate signing, provided python3-cryptography >= 49.0 with OpenSSL >= 3.5 is installed. Pass the signing algorithm to ipa-server-install:

ipa-server-install --ca-signing-algorithm=ML-DSA-44

After installation, verify all certificates:

ipacta-verify-certs

When ML-DSA is in use, the AJP packet size is automatically raised to 65536 bytes to accommodate larger post-quantum certificates.

Project layout

src/ipacta/              CA engine
  ca.py, ca_internal.py  Certificate signing, public API and internals
  backend.py             Unified CA operations facade
  cscfg.py               CS.cfg reader/writer (Dogtag config compat)
  certificate/           Certificate types, lifecycle state machine
  profile/               Profile manager, parser, constraints, defaults
  storage/               LDAP storage backends (certs, CRL, KRA, ACME, ...)
  rest_api/              Flask REST API (Dogtag wire-format compatible)
  core/                  Core modules (DN, LDAP, paths, constants, utilities)
  install/               Installer (certs, KRA, LDAP setup, services)
  cli/                   CLI install/uninstall modules
  kra.py                 Key Recovery Authority
  acme.py                ACME protocol engine
  ocsp.py                OCSP responder
  subca.py               Lightweight sub-CA management
  ajp_server.py          AJP 1.3 protocol server
  compat_server.py       Dogtag-compatible WSGI server
  audit.py               Signed audit logging

src/pki/                 python3-pki drop-in replacement
  cert.py                CertClient / CertData
  key.py                 KeyClient / KeyData
  profile.py             ProfileClient / ProfileData
  authority.py           AuthorityClient
  client.py              PKIConnection / PKIClient
  nssdb.py               NSSDatabase wrapper
  system.py              SystemConfigClient (pkispawn)

bin/                     CLI tools
  pkispawn               Installer entry point
  pkidestroy             Uninstaller entry point
  ipacta-verify-certs    Post-install certificate verification
  pki                    Dogtag-compatible certificate/key/profile CLI
  pki-server             Instance management (start, stop, status)
  tomcat                 Version shim for FreeIPA's AJP version check

share/
  profiles/              Certificate profile .cfg files
  ldap/                  LDAP schema, ACLs, indexes, VLV configs
  templates/             systemd unit templates
  pki/VERSION            PKI version file

tests/                   pytest test suite
doc/                     Documentation (overview, REST API, security, ...)

Runtime dependencies

• Python >= 3.9
• 389 Directory Server (LDAP backend)
• NSS tools (certutil)
• Python packages: cryptography, flask, gunicorn, python-ldap, cachetools

Running tests

pytest tests/

Documentation

See the doc/ directory:

• overview.md -- Architecture and design
• installation.md -- Installation guide
• configuration.md -- ipacta.conf reference
• rest-api.md -- REST API reference
• security.md -- Security model
• certificate-lifecycle.md -- Certificate state machine
• ca-engine.md -- CA engine internals

License

GPLv3 -- see COPYING.