Controlled Cryptographic Item — a web application for managing X.509 certificates across configurable permission areas. Search existing filesystem inventories alongside certificates stored in Consul, manage versions, create certificate requests, and export certificates and authorized private keys.
Built with Ruby on Rails, Hotwire, PostgreSQL and HashiCorp Consul, with German and English interfaces. The release badge includes prereleases. Check the release notes before deploying.
The overview shows the actual application with synthetic certificates, demo identities and PuppetDB host associations. Detailed views are documented under certificate details, CA inventory and audit logs.
The application logo opens a permission-scoped dashboard backed by local data. The sidebar links to Certificates, optional Hosts, Import, CSR and Audit logs, and includes a collapsed view of the signed-in user's actual CCI roles.
- Certificate management: search and filter certificates from Consul and legacy files, preview imports, confirm overwrites, retain and activate versions, inspect certificate chains, and export PEM, DER, PKCS#12/PFX or JKS. Bulk and chain exports are available where applicable.
- Certificate requests: create RSA or EC CSRs, retain encrypted request keys, and publish matching issued certificates to one Consul area. Open requests can be manually soft deleted before an issued certificate is uploaded. Certificate issuance by a CA remains an external step.
- Infrastructure integration: Puppet readers and Hiera output for certificate distribution, optional searchable PuppetDB host pages, and an always-active CA inventory with verified downstream certificate links. Consul certificates have status and archive controls, while filesystem deletion uses a separate confirmation and recovery workflow. Read-only reconciliation removes externally deleted filesystem entries after two complete scans, with a per-source 20% deletion guard.
- Access and audit: Keycloak OIDC authentication, independent area-specific Reader, Writer, Key Exporter, CSR and Auditor roles, encrypted keys for imports and certificate requests, and audit records for UI changes and exports.
- Operations: container deployment, health checks, configurable expiry warnings, area-specific Consul clusters and ACL tokens, a Zabbix 7.4 monitoring template, and German/English interfaces with light and dark themes.
For automated ACME issuance and renewal using this storage contract, see
zaeh-acme_kvstore, a compatible
external Puppet implementation. It implements active, norollout and delete
and stops renewal for archived CertIDs. CCI-UI displays its optional management
metadata and explains the effect of manual imports or activation. It is not a required
dependency. The bundled cci manifests remain a simpler reader without status
processing; see Puppet integration.
For local evaluation, install Docker Engine with Compose 2.24 or newer and Ruby
for the secret setup helper, and the Linux setfacl command (package acl)
for granting the container user read access to the protected YAML file. Allow approximately 2 GiB of RAM and a free local
port 3000.
git clone https://github.com/c8m6/cci-ui.git
cd cci-ui
ruby bin/setup-local
setfacl -m u:10001:r config.yml
docker compose -f compose.yml up --build -d --waitOpen http://localhost:3000 and select a local test
identity. Compose starts the application, indexer, PostgreSQL and Consul with
example areas Zone A and Zone B. The initial inventory is empty unless
you import certificates or add files under data/. Keep the generated config.yml
secrets so stored private keys remain readable. The helper preserves existing
configuration.
This local identity mode is for evaluation only. Production requires Keycloak,
a configured Consul service, PostgreSQL, persistent encryption secrets and an
HTTPS reverse proxy. Public linux/amd64 images are available as
c8m6/cci-ui:<release tag>.
Use an explicit release tag or digest, rather than latest.
Follow installation and production deployment for the
required configuration, image startup, backups and upgrades.
| Topic | Guide |
|---|---|
| Installation and operations | Local and production setup, Keycloak, backups and health checks |
| Configuration | YAML configuration · Production Compose with external services |
| Certificates and permissions | Architecture, roles, storage and audit logs · Filesystem deletion and recovery |
| Certificate requests and CAs | CSR workflow and key management · CA inventory and Hiera export |
| Consul clients | Schema, version selection and Ruby import/read examples |
| Puppet | Puppet integration and limitations · PuppetDB host inventory |
| Monitoring | Integrations · Zabbix setup and template |
| Interface languages | Language selection and adding translations |
| Development | Contribution and validation workflow · Screenshot capture script |
| Releases and CI | GitHub Actions, security checks and Docker Hub publishing |
Report vulnerabilities through GitHub's private vulnerability reporting. Do not disclose exploitable vulnerabilities in public GitHub Issues. See the security policy for reporting details and version-policy limits.
Repository-managed CodeQL Advanced Setup analyzes Ruby on main pushes and
manual runs. Push and pull-request CI runs Rails tests, RuboCop, Brakeman and
bundler-audit. Manual full validation and release publication also build and
test the application image and run Trivy. Passing checks are not a guarantee
that the application is free of vulnerabilities. See
security validation for
scanner scope, blocking thresholds and reports.
Issues and pull requests are welcome. See CONTRIBUTING.md for setup, validation and the AGPL-3.0-or-later contribution requirements. Use the private reporting route above for undisclosed security vulnerabilities.
CCI-UI is licensed under the GNU Affero General Public License v3.0 or later.
SPDX-License-Identifier: AGPL-3.0-or-later.
See LICENSE for the terms and NOTICE for project attribution.
Copyright (C) 2026 Christian Meißner. Third-party dependencies and referenced
services remain under their respective licenses.