stepca-web/README.md.old at main · OpusCapita/stepca-web · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
# Step CA Admin

A web-based dashboard for managing [Step CA](https://smallstep.com/docs/step-ca) – the open-source certificate authority. Built with Flask and styled with AdminLTE, it provides an intuitive UI to manage ACME accounts, x.509 and SSH certificates, provisioners, and system services.

---

## Features

- **ACME Management**
  - List and manage ACME Accounts, Orders, Certificates, Authorizations, and Challenges.

- **X.509 Certificate Management**
  - View valid certificates.
  - View revoked certificates with detailed info and linked provisioners.

- **SSH Certificate Management**
  - View all issued SSH certificates.

- **Provisioner Management**
  - List, add, and delete JWK/ACME provisioners using `step ca provisioner`.

- **Admin Users**
  - View configured admin provisioners.

- **Step CA Config Editor**
  - Edit and validate the `ca.json` file with JSON syntax highlighting.

- **Systemd Service Control**
  - Start, stop, or restart the Step CA systemd service (with limited permissions).

- **Dashboard Overview**
  - Visual KPIs like number of active certs, revoked certs, provisioners, etc.

---

## Requirements

- Python 3.9+
- Linux with `systemd` (for service management)
- Step CA installed and configured
- A configured admin provisioner

---

## Project Structure

```
stepca-admin/
├── app.py
├── templates/
│   ├── layout.html
│   ├── dashboard.html
│   └── ...
├── static/
│   └── (CSS, JS, icons)
├── src/
│   ├── libs/
│   │   ├── cert_utils.py
│   │   ├── provisioner_utils.py
│   │   └── ...
├── requirements.txt
└── README.md
```

---

## Installation

1. **Clone the repository**

```bash
git clone https://github.com/youruser/stepca-admin.git
cd stepca-admin
```

2. **Create a virtual environment**

```bash
python3 -m venv venv
source venv/bin/activate
```

3. **Install dependencies**

```bash
pip install -r requirements.txt
```

4. **Generate the jwk_key.json file**

- Run the following step command

```bash
step ca provisioner list \
    | jq -r '.[] | select(.name == "Admin JWK") | .encryptedKey' \
    | step crypto jwe decrypt \
    | jq
```

5. **Run the app**

```bash
flask run
```

Then open your browser at: [http://localhost:5000](http://localhost:5000)

---

## Development

- Use the built-in Flask dev server for local testing.
- For UI, modify `templates/` and `static/` folders.
- To add new pages, extend `layout.html` and register routes in `app.py`.

---

## To Do / Ideas

- [ ] Add user authentication (basic auth or OAuth)
- [ ] Implement audit logging
- [ ] Add filtering and searching in tables
- [ ] Support bulk certificate operations
- [ ] UI for creating short-lived MTLS certs

---

## Contributing

Pull requests are welcome! For major changes, open an issue first to discuss what you’d like to change.

Please make sure to test and lint your code (`black`, `flake8`).

---

## License

MIT License — see `LICENSE` for details.

---

## Contact

Damien Hauser
damien@dhconsulting.ch