CryptOS

Your own certificate authority, on a PKI OSwith no shell to break into.

CryptOS turns a bare machine into an immutable, API-driven certificate authority: no shell, no login, no door in except the API. Every image is built from tested source and signed only when you boot it, so you hold the keys, not us.

This is the documentation for CryptOS users and administrators: building it, running it, and managing a fleet with FleetOS Manager.

CryptOS

The OS itself: building, installing and running a CA node, and getting certificates from it.

Get startedWhat CryptOS is, why it exists, and where the project stands today.ConceptsCertificates, chains of trust, TPM-sealed keys and the CA roles, explained.Use casesInternal TLS, Kubernetes, devices, code signing and an air-gapped root.Try it locallyBuild an image, boot it, and run the first-boot ceremony.Install and deployBuild a bootable image and install a node to disk.Using CryptOSSet up a node and run it day to day with cryptosctl.ReferenceThe cryptosctl commands, the gRPC API, and machine config.

FleetOS Manager

Running many nodes from one place: installing the manager, its operator CA, and the web console.

OverviewWhat FleetOS Manager does, and how a node joins and leaves the fleet.Install and runDeploy it with Helm, then the first run: the operator CA and the first admin.Operator CA and credentialsWho can sign in, how their credentials are issued, rotated and revoked.Using the web UIThe fleet, a node's page, certificates, approvals and the audit log.

Looking for the product overview rather than the documentation? Visit cryptos-pki.com.