Home

Documentation for the image tag 1.0.0-rc1. See Versions for the documentation of a release.

Qertum documentation

Qertum is a self-hosted certificate authority with post-quantum support. It issues, tracks, renews and revokes X.509 certificates through a web UI, a REST API, the qca command line, and standard ACME and EST clients. Storage is SQLite; there is no external database, message broker or cloud dependency.

This wiki covers running Qertum on your own server or development machine.

Start here

I want to...	Read
Understand the moving parts	Architecture
Check what I need before installing	Requirements and Getting the Image
Run it on one server with the least effort	Single Container
Run it with EST, or expose only ACME and EST	Multi Container
Run it from source to try it or develop on it	Local Development
Request and manage certificates in the browser, page by page	Using the Web UI
Script it from a terminal	Using the CLI
Integrate with the REST API	Using the REST API
Look up an environment variable or port	Configuration Reference
Put TLS in front of it	TLS and Reverse Proxy
Back up, restore, or move to new hardware	Backup and Restore
Use an external identity provider, or require step-up authentication	Identity Providers
Recover from a compromised CA key	Issuer Compromise Recovery
Install a new release	Upgrading
Fix something that does not work	Troubleshooting

Before you start

• Back up /data. It holds your CA private key. Losing it loses the CA. See Backup and Restore.
• Pick the deployment that matches your needs. The single container has no EST endpoint, by design. If you need EST, use the multi-container layout.
• Clients must trust your root. Nothing validates a Qertum certificate until its root is installed as a trust anchor on the relying party. See TLS and Reverse Proxy.
• Documentation follows releases. These pages describe one release of Qertum. If you run an older release, open the matching version from Versions.