FastPKI is an API-based PKI management system that provides an easier alternative to Easy-RSA. It allows you to create and manage Certificate Authorities, issue certificates, and revoke them through a RESTful API.
Full documentation: jsenecal.github.io/fastpki
- Create and manage Certificate Authorities (CAs)
- Intermediate CA hierarchy with path length constraints
- Automatic
allow_leaf_certspolicy enforcement - Issue certificates (server, client, and CA)
- Revoke certificates
- Organization management for multi-tenant deployments
- Role-based access control (SUPERUSER, ADMIN, USER)
- Per-user capability flags for fine-grained permissions
- Ownership-based access control on CAs and certificates
- RESTful API for easy integration
- Compatible with SQLite and PostgreSQL
- Database migrations with Alembic
- Docker support for easy deployment
- Type checking with mypy
- Code quality with ruff linter and formatter
- Python 3.9+
- FastAPI
- SQLModel
- Cryptography
- Docker (optional)
Pre-built images are available on GitHub Container Registry:
docker pull ghcr.io/jsenecal/fastpki:latestAvailable tags:
latest— Latest release<version>— Specific release (e.g.0.1.0)master— Latest build from master branch
# Clone the repository
git clone https://github.com/jsenecal/fastpki.git
cd fastpki
# Create a .env file from the example
cp .env.example .env
# Create data directory for SQLite database
mkdir -p data
# Development mode with SQLite (recommended for local development)
docker-compose -f docker/docker-compose.yml -f docker/docker-compose.dev.yml up -dFor production deployments with PostgreSQL:
# Production mode with PostgreSQL
docker-compose -f docker/docker-compose.yml -f docker/docker-compose.prod.yml up -dThe API will be available at http://localhost:8000
# Clone the repository
git clone https://github.com/jsenecal/fastpki.git
cd fastpki
# Install dependencies (creates the uv-managed virtualenv and installs the dev group)
uv sync
# Create a .env file from the example
cp .env.example .env
# Create data directory for SQLite database
mkdir -p data
# Run the application
uvicorn app.main:app --reloadWe use the following tools to ensure code quality:
- ruff: Fast Python linter and formatter
- mypy: Static type checker
Run linting and type checking:
# Using make
make lint
# Or directly
uv run ruff check app cli tests
uv run mypy app cliFormat code:
# Using make
make format
# Or directly
uv run ruff format app cli testsInstall pre-commit hooks to automatically check your code before committing:
pre-commit installThe full user and reference documentation is published at jsenecal.github.io/fastpki. The source lives in docs/ and is built with Zensical.
When the application is running, you can also access the automatic API documentation at:
- Swagger UI: http://localhost:8000/docs
- ReDoc: http://localhost:8000/redoc
These endpoints are disabled by default. Set ENABLE_DOCS=true in your environment to expose them (typically only in development).
FastPKI has three user roles:
- SUPERUSER — Full access to all resources across the system
- ADMIN — Full access to all resources within their organization
- USER — Read access within their organization; write actions require capability flags
Permission checks follow this order:
- Superusers have full access to everything
- Resource creators have full access to their own resources
- Admins have full access to all resources within their organization
- Users can read resources within their organization
- Per-user capability flags grant specific write actions to regular users
Regular users can be granted fine-grained permissions via boolean capability flags:
| Flag | Description |
|---|---|
can_create_ca |
Create Certificate Authorities |
can_create_cert |
Create certificates |
can_revoke_cert |
Revoke certificates |
can_export_private_key |
Export private keys |
can_delete_ca |
Delete Certificate Authorities |
FastPKI implements a first-user privilege system for initial setup:
-
The first user created in the system can be assigned any role, including
superuser. This is a bootstrap mechanism that allows for the initial setup of the system. -
After the first user is created, only existing superusers can create other users with elevated privileges (
adminorsuperuserroles). -
Regular users can only create other regular users.
To create the first superuser:
# Make a POST request to create the first user with superuser role
curl -X POST http://localhost:8000/api/v1/users/ \
-H "Content-Type: application/json" \
-d '{
"username": "admin",
"email": "admin@example.com",
"password": "securepassword",
"role": "superuser"
}'This first superuser can then authenticate and manage other users through the API.
FastPKI supports both SQLite and PostgreSQL:
-
SQLite (default for development):
- Data is stored in the
data/fastpki.dbfile for persistence - Uses the aiosqlite driver for async support
- Connection string:
sqlite+aiosqlite:///./data/fastpki.db
- Data is stored in the
-
PostgreSQL (recommended for production):
- Uses the asyncpg driver for async support
- Connection string:
postgresql+asyncpg://postgres:postgres@db:5432/fastpki - Configure using the
DATABASE_URLenvironment variable
/alembic # Database migrations
/app # Main application code
/api # API endpoints
/core # Core configuration
/db # Database models and session management
/schemas # Pydantic schemas for API requests/responses
/services # Business logic (CA, certificate, user, organization, permission)
/tests # Test suite (279 tests, 90% coverage)
/docker # Docker configuration
/data # SQLite database files and other persistent data
The test suite includes 279 tests with 90% code coverage. Tests are written using pytest:
# Run tests (using make)
make test
# Run tests with coverage
make test-cov
# Or directly
pytest
pytest --cov=app