EST enrollment server
A standards-compliant, post-quantum ready certificate enrollment server for private networks. Built in Rust.
kipuka (Hawaiian) — an area of older land surrounded by younger lava flows, an island of stability. Like a kipuka preserves established growth amid change, this server provides stable certificate enrollment amid evolving security requirements.
Everything you need to run a production EST certificate authority on your own terms.
All six EST operations: cacerts, simpleenroll, simplereenroll, fullcmc, serverkeygen, and csrattrs. Plus STAR auto-renewal (RFC 8739).
Active-passive, round-robin, weighted, and latency-based failover strategies across multiple certificate authorities.
CA private keys loaded from HSMs via PKCS#11. Entrust nShield, Utimaco, Thales Luna, and Kryoptic for dev/test.
ML-DSA signing (FIPS 204), ML-KEM key encapsulation (FIPS 203), and composite hybrid algorithms via Synta.
SQLite for single-node, PostgreSQL or MariaDB for scale. One config line to switch. Automatic migrations.
mTLS client certificates, one-time passwords with rate limiting, and GSSAPI/Kerberos enterprise SSO integration.
Configure, start, and enroll your first certificate.
$ kipuka /etc/kipuka/kipuka.toml
INFO kipuka: loading config from '/etc/kipuka/kipuka.toml'
INFO kipuka: opening database 'sqlite:///var/lib/kipuka/kipuka.db'
INFO kipuka::ca: loaded CA 'rsa-ca' (RSA 3072-bit, expires 2035-06-24)
INFO kipuka::tls: TLS 1.2+ with client auth (optional)
INFO kipuka: EST server listening on 0.0.0.0:9443IETF RFCs and standards implemented
From RFC 7030 EST to FIPS 204 post-quantum signatures and NIAP CA Protection Profile v2.0. kipuka tracks the standards so you don't have to.
Container
# No login required
podman pull registry.kipuka.dev/kipuka:latest
podman run --rm \
-v ./kipuka.toml:/etc/kipuka/kipuka.toml:ro \
-v ./certs:/etc/kipuka/certs:ro \
-p 9443:9443 \
registry.kipuka.dev/kipuka:latest
Build from source
git clone https://codeberg.org/czinda/kipuka
cd kipuka
cargo build --release
cp kipuka.toml.example kipuka.toml
cargo run --release -- --config kipuka.toml
A Cargo workspace with six internal crates and zero external CA dependencies.