QPKI Documentation

Welcome to the Post-Quantum PKI documentation. This guide will help you find the right information based on your needs.

Getting Started

Document	Description
Installation	Download binaries, Homebrew, or build from source
Quick Start	Create your first CA and certificate in 5 minutes
Post-Quantum	PQC algorithms and hybrid certificates

Core PKI

Document	Description
CA	CA initialization and management
Profiles	Certificate profile templates
Keys & CSR	Key generation and CSR operations
Certificates	Certificate issuance
CRL	Revocation lists

End Entities

Document	Description
Credentials	Bundled key + certificate lifecycle

Services

Document	Description
OCSP	Real-time certificate status (RFC 6960)
TSA	Timestamping service (RFC 3161)
CMS	CMS signatures and encryption (RFC 5652)
COSE	CBOR Object Signing (IoT, attestation)
SSH	SSH certificate issuance (OpenSSH format)

Operations

Document	Description
HSM	Hardware Security Module integration (PKCS#11)
Audit	Audit logging and SIEM integration

Migration

Document	Description
Crypto-Agility	Algorithm migration guide
Hybrid	Hybrid certificates

Reference

Document	Description
CLI	Complete command reference
Troubleshooting	Common errors and solutions
Standards	OIDs and formats
PKI Basics	Certificates, keys, CAs, trust chains
Glossary	PKI and PQC terminology

Development

Document	Description
Architecture	System architecture overview
Contributing	Contribution guide
Testing	Testing guide
Interoperability	Interop testing

Quality

Document	Description
Testing Strategy	Testing philosophy and approach
Acceptance Tests	102 acceptance tests
Interop Tests	OpenSSL/BouncyCastle validation
SSH Tests	OpenSSH certificate validation
Compliance	FIPS, RFC standards

Standards Compliance

Standard	Description	Status
RFC 5280	X.509 PKI Certificates	Implemented
RFC 6960	OCSP	Implemented
RFC 3161	TSA Timestamping	Implemented
RFC 5652	CMS Signed Data	Implemented
RFC 9883	ML-KEM in CMS (CSR Attestation)	Implemented
FIPS 204	ML-DSA (Dilithium)	Implemented
FIPS 205	SLH-DSA (SPHINCS+)	Implemented
FIPS 203	ML-KEM (Kyber)	Implemented
ITU-T X.509 9.8	Catalyst Hybrid Certificates	Implemented
IETF draft-13	Composite Signatures	Implemented
PROTOCOL.certkeys	OpenSSH Certificate Format	Implemented
PROTOCOL.krl	OpenSSH Key Revocation List	Implemented

Document Map

docs/
├── README.md              ← You are here
│
├── getting-started/       # Getting Started
│   ├── INSTALLATION.md    Installation guide
│   ├── POST-QUANTUM.md    PQC & hybrid certificates
│   └── QUICK-START.md     Quick start guide
│
├── core-pki/             # Core PKI
│   ├── CA.md              CA, certificates, CRL
│   ├── CERTIFICATES.md    Certificate issuance
│   ├── CRL.md             Revocation lists
│   ├── KEYS.md            Key generation, CSR
│   └── PROFILES.md        Certificate templates
│
├── end-entities/          # End Entities
│   └── CREDENTIALS.md     Credential lifecycle
│
├── services/              # Services
│   ├── OCSP.md            Real-time revocation
│   ├── TSA.md             Timestamping
│   ├── CMS.md             Signatures & encryption
│   ├── COSE.md            CBOR Object Signing
│   └── SSH.md             SSH certificates
│
├── operations/            # Operations
│   ├── HSM.md             PKCS#11 integration
│   └── AUDIT.md           Audit logging
│
├── migration/             # Migration
│   ├── CRYPTO-AGILITY.md  Algorithm migration
│   └── HYBRID.md          Hybrid certificates
│
├── reference/             # Reference
│   ├── CLI.md             Command reference
│   ├── PKI-BASICS.md      PKI fundamentals
│   ├── STANDARDS.md       OIDs and formats
│   ├── TROUBLESHOOTING.md Common errors
│   └── GLOSSARY.md        Terminology
│
├── dev/                   # Development
│   ├── ARCHITECTURE.md    System architecture
│   ├── CONTRIBUTING.md    Contribution guide
│   ├── TESTING.md         Testing guide
│   └── INTEROPERABILITY.md Interop testing
│
└── quality/               # Quality Assurance
    ├── STRATEGY.md        Test philosophy
    ├── TESTS-ACCEPTANCE.md 102 acceptance tests
    ├── TESTS-INTEROP.md   OpenSSL/BC validation
    ├── TESTS-SSH.md       OpenSSH certificate validation
    └── COMPLIANCE.md      FIPS/RFC standards