What's under the hood

Concise, accurate, and standards-referenced — for engineers and security teams evaluating NetCloudz PKI, the European private PKI from NetCloudz B.V.

Back to the product overview

At a glance

NetCloudz PKI capabilities and the mechanisms that implement them.
Vendor	NetCloudz B.V., Utrecht, the Netherlands (EU)
Certificate format	X.509 v3 (RFC 5280)
Automated enrollment	ACME, HTTP-01 (RFC 8555)
Revocation	CRL + OCSP (RFC 6960), offline-signed CRL import
Key algorithms	RSA 2048–4096, ECDSA P-256 / P-384
Encryption at rest	AES-256-GCM + HKDF-SHA256, online rekey
SSO	OIDC (Entra ID / Keycloak / Auth0 / generic) + group sync
MFA	TOTP with backup codes
API	REST + Bearer JWT, OpenAPI / Swagger
Observability	Prometheus metrics, append-only audit log, health probes
Air-gap support	Offline Root CA ceremony CLI
Data store	PostgreSQL, versioned migrations
Runtime	Single Go binary, container-ready

Architecture

API-first Go service (Gin) backed by PostgreSQL.
Clean separation: HTTP handlers → business-logic services → GORM models.
REST API with Bearer-JWT auth and a Swagger/OpenAPI definition; a cookie-auth browser UI; and standards-based protocol endpoints (ACME, CRL, OCSP).
Ships as a single self-contained Go binary with all state in PostgreSQL — container-ready, with boring, predictable restarts.

Certificate authority

Three-tier hierarchy: Root CA → Issuer CA → end-entity. Root CAs are structurally prevented from signing leaf certificates.
End-entity profiles: TLS server, client (mTLS), and client-server.
Keys: RSA 2048/3072/4096 and ECDSA P-256/P-384, with a CA-key floor of RSA-4096 / P-384.
Full lifecycle: issue, import (cert + key), renew, revoke (with RFC 5280 reason codes), and retire/unretire with history preserved.
Export as PEM or password-protected PKCS#12 (.p12) bundles, behind access-control and audit gates.
In-place CA replacement that mints a new serial while keeping the retired generation queryable for already-issued leaves.
Certificate templates constrain issuance — allowed profiles, algorithms, key sizes, CN/SAN patterns, validity ceilings, permitted issuers, and CSR support — and attach to groups for delegated, policy-bounded issuance.

ACME (RFC 8555)

HTTP-01 challenge type with the full order flow: new-account, new-order, authorization/challenge, finalize, certificate download, and revocation.
Account key rollover and deactivation.
Outbound challenge validation is SSRF-guarded (rejects private/loopback/link-local/CGNAT targets); a single flag relaxes this for on-prem networks.
The service can renew its own TLS certificate through ACME against itself or an external directory (e.g. Let’s Encrypt).

Revocation

CRL responder (DER, public, rate-limited) and OCSP responder (RFC 6960), with revocation lookups unioned across same-key CA generations.
Offline / keyless issuers: for air-gapped signing keys, operators upload offline-signed CRLs as the authoritative revocation channel; OCSP returns a deliberate, audited unauthorized rather than a forgeable response. Pending revocations are surfaced via a dashboard tile and a Prometheus gauge.

Authentication & authorization

JWT (1-hour expiry, token-version claim) for the API; cookie sessions for the UI with silent reissue.
OIDC SSO (Microsoft Entra ID, Keycloak, Auth0, or generic), including IdP-group → local-group synchronization on login.
TOTP MFA with hashed secrets and backup codes.
RBAC across admin / user / system roles, plus group membership and per-certificate access control (owner / group / public). CA private-key export is admin-only behind a time-limited, audited gate.
A randomized first-boot bootstrap admin that auto-disables once a real administrator account exists.

Cryptography at rest & key management

Private keys and secrets are encrypted with AES-256-GCM, with per-row keys derived via HKDF-SHA256 from a master secret (random 16-byte salt and 12-byte nonce per row). Ciphertext is versioned and key-ID tagged.
Online key rotation (POST /iam/admin/rekey) re-encrypts every protected column under a new key, with a retired-secrets map for zero-downtime rollover.
The master encryption secret lives outside the database; backup, restore, and rotation are documented runbooks.

Offline / air-gapped ceremonies

A standalone pki-offline CLI generates an offline Root CA, signs Issuer CSRs produced by the online service, re-signs CA certificates, and generates CRLs — all on an air-gapped host.
The Issuer-CSR round-trip (prepare → offline-sign → import) is tracked end-to-end with audit events at each step.

Operations & observability

Prometheus metrics (token-gated) covering issuance, revocation, CRL/OCSP outcomes, ACME order/nonce state, DB connection-pool pressure, cache hit ratios, and request latency.
Append-only audit log with per-role scoping, configurable retention, and CSV / JSON export (formula-injection-safe CSV).
/healthz, /readyz, and /version endpoints for orchestrators; structured JSON logging via slog.
Edge defense in depth: per-IP token-bucket rate limiting on public and login endpoints, security headers (HSTS, nosniff, frame-deny), trusted-proxy / X-Forwarded-For handling, request body-size caps, and dial-time SSRF guards on all outbound connections (OIDC, ACME, SMTP).
TLS 1.2 floor with AEAD-only cipher suites; TLS 1.3 where clients support it.

Deployment & data

Ships with Docker Compose (service + PostgreSQL 17); deployable to any container platform.
Versioned, paired up/down SQL migrations run automatically on boot (or out-of-band via an operator flag) — safe to roll forward and back.
Configuration is environment-driven and fully documented; required secrets fail fast at startup (fail-closed).

Complete feature list

Every shipped, customer-facing capability, grouped by area.

Certificate authority & hierarchy

Full certificate authority hierarchy — Build and manage multi-tier PKI: Root CAs, Issuer CAs, and sub-issuers.
CA hierarchy tree view — See your whole Root → Issuer → leaf structure visually, with status and expiry.
Offline / air-gapped root signing — Keep your most sensitive CA keys offline with a guided signing ceremony.
Issuer creation from an offline root — Generate an issuer CSR online, sign it offline, and import it back.
CA re-signing & replacement — Renew an expiring CA in place, keeping the same key and superseding the old certificate.

Certificate issuance & lifecycle

Certificate templates — Define reusable issuance policies that constrain names, key types, validity, and profiles.
Flexible key algorithms — Issue with RSA or ECDSA at policy-enforced strengths.
Server, client, and combined profiles — Issue the right certificate type for the job.
Subject Alternative Names — Issue certificates covering multiple DNS names, IPs, and email addresses.
Certificate lifecycle management — Issue, renew, revoke, and retire certificates from one place.
Retire & restore — Soft-retire certificates out of the active list while preserving full history, and restore if needed.
Bulk operations — Retire or revoke many certificates at once, respecting the active filter.
Certificate import — Bring existing certificates in from PEM or PKCS#12 files, with automatic issuer resolution.
External certificate inventory — Track and view certificates issued by CAs you don't operate, as a single pane of glass.
Multi-format export — Download certificates and keys as PEM or PKCS#12, with broad-compatibility options.
Search, filter, and detail views — Find certificates fast and inspect full details in a slide-in panel.

Revocation & status

Revocation with standard reason codes — Revoke for key compromise, superseded, and the full RFC reason set.
CRL distribution — Publish revocation lists at public, rate-limited endpoints.
OCSP responder — Answer real-time certificate status queries over OCSP.
Offline-issuer revocation — Serve revocation for air-gapped CAs via operator-uploaded signed CRLs.

ACME automation

Automated issuance & renewal with ACME — Issue and renew certificates automatically using the standard ACME protocol.
ACME account management — Standards-compliant account creation, key rollover, and deactivation.
External Account Binding (EAB) — Gate ACME access with operator-issued credentials.
Per-credential template scoping — Bind each ACME credential to specific templates and pre-authorize approved names.
Self-managed server TLS — The product secures its own web interface and renews its certificate automatically.
Let's Encrypt integration — Renew the server's TLS certificate against an external ACME CA.

Access control & identity

Browser-based admin UI — Manage the entire PKI from a web interface, no command line required.
Single sign-on (OIDC / Entra ID) — Log in through your identity provider with group synchronization.
Multi-factor authentication — Protect local accounts with TOTP and one-time backup codes.
Users, groups, and role-based access — Organize people and scope what each can see and do.
Group-based certificate access — Keep certificates private, share them with a group, or publish them.
Self-service account management — Users manage their own password and MFA enrollment.
Admin MFA recovery — Admins can reset MFA for users who lose their device.

Operations, audit & compliance

Complete audit trail — Every security-relevant action is logged, including failed logins.
Audit log export — Export the trail to CSV or JSON for compliance, with configurable retention.
Prometheus metrics — Export issuance, revocation, and request metrics for monitoring.
Health & readiness probes — First-class endpoints for load balancers and orchestrators.
Documented backup & restore — Proven procedures for backing up and recovering the PKI and its keys.
Email integration — Configure SMTP delivery for operator notifications.

Platform & integration

REST API for everything — Every capability is available through a documented API for automation.
Interactive API documentation — Explore and try the API through built-in Swagger/OpenAPI docs.
Standards-aligned — Built to RFC 5280 (X.509), RFC 6960 (OCSP), and RFC 8555 (ACME).
Single-tenant by design — Each deployment is fully isolated for one organization.

Want to dig in against your own setup?

We'll walk through the API, the CA hierarchy, and the deployment model with your team.

Request a demo