certpilot-gateway-selfsigned

A CertPilot gateway that signs certificates with a local CA it generates itself.

Implements provider.v1.

docker run --rm -p 9091:9091 ghcr.io/certpilot/gateway-selfsigned:0.4.0

What it is for

Two things, and it is worth being precise because one of them is not "development".

Trying CertPilot out. It needs no account, no credentials and no network, so the quickstart can issue a real certificate in the time it takes to start a container.

Names no public CA will ever sign. .internal, .local, a bare hostname, an RFC 1918 address. Those are not going to a public CA, and the estate that holds them still expires, still needs rotating, and is exactly the estate that gets forgotten. A certificate from here is a real certificate with a real expiry that this system will renew and deploy like any other.

It is not a PKI. There is no offline root, no HSM, no revocation, no CRL and no path length planning. If you need those, you need Vault or a real CA — and a gateway for it.

What it does

Key types	RSA, ECDSA, Ed25519
CSRs	honoured. Supply one and it signs your key
Revocation	no — reported as supports_revocation=false
CA info	no — reported as supports_ca_info=false

Those last two are reported honestly rather than stubbed, so the core knows not to offer a revoke button that would do nothing.

Flags

-port              9091
-insecure          serve without TLS. Loopback only
-tls-cert/-tls-key/-tls-ca

Conformance

go run github.com/certpilot/certpilot-gateway-sdk/cmd/conformance@latest \
    -addr localhost:9091 -insecure -domain test.example.com

This gateway is the one that can be checked end to end without any external dependency, so CI runs the full issuance path here — with and without a CSR — on every pull request.

Releases

0.4.0, on linux/amd64 and linux/arm64. Images publish on a tag, never on a merge, so latest means the most recent release rather than the most recent commit — pin anyway for anything you depend on.

The Go module is tagged in step with the image, so go run github.com/certpilot/certpilot-gateway-selfsigned/[email protected] runs the same code the image contains.

Every tag also gets its release page, created by the same workflow once the image has published. The notes are the tag's annotation, so write them with git tag -a; a lightweight tag gets GitHub's list of the pull requests merged since the last release.

Licence

Apache 2.0.