core

Varwof PKI

⚠️ Technical Preview — Core cryptographic primitives verified for OpenSSL interoperability; RFC compliance ongoing. Not for production use. APIs and features may change before official release.

Single binary, pure Go, private CA up in one minute.

中文

Pure Go: all features implemented in pure Go, no external dependencies. System Requirements: none. Just a single Go-compiled binary. Target Users: individual developers, small teams, K8s dev clusters.

Language: Go 1.26 — Database: SQLite (recommended, pure Go)

Features

Performance

Full benchmark reports: Bench & Test.

Quick Start

go build -o /usr/local/bin/varwof ./cmd/pki/

varwof init-ca --name root --profile root-ca --out-dir /etc/varwof/core/root
varwof init-ca --name issuing --profile sub-ca \
  --parent root --parent-key /etc/varwof/core/root/private/ca.key

varwof serve

varwof issue --cn server.example.com \
  --san "DNS:server.example.com,IP:10.0.0.1" \
  --profile tls-server --out-dir /etc/varwof/core/certs

Installation

go build -o /usr/local/bin/varwof ./cmd/pki/

Deployment (systemd)

deploy/varwof-core.service is a ready-to-use unit. It assumes the PKI tree lives in /etc/varwof/core and that the service runs as the varwof user.

go build -o /usr/local/bin/varwof ./cmd/pki

sudo useradd --system --home /etc/varwof --shell /usr/sbin/nologin varwof   # if missing
sudo mkdir -p /etc/varwof/core
sudo varwof init-full --out-dir /etc/varwof/core \
    --root "Varwof Root CA" --org Varwof --domain example.com \
    --capability-schemes /path/to/capability/data
sudo chown -R varwof:varwof /etc/varwof

sudo install -m 0644 deploy/varwof-core.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now varwof-core

init-full writes the whole tree, including the configuration file /etc/varwof/core/core.json (named after the component, like /etc/nginx/nginx.conf) and authz.json. It also:

• opens HTTP on :8443 and mTLS on :4433 — both unprivileged, so the service never needs root or CAP_NET_BIND_SERVICE;
• pins tls_client_ca to the management CA, so the HTTPS listener actually verifies client certificates;
• writes tls/api/certs/api-chain.pem (leaf + issuing CA) and points tls_cert at it, so a client that trusts only the root can verify the server;
• installs the capability data tree and sets capability_schemes when --capability-schemes is given. Without it, registration validation stays disabled and the service logs a warning at startup.

Configuration is discovered in this order: ./core.json, ~/.config/varwof/core.json, /etc/varwof/core/core.json. The previous name pki.json is still accepted in each of those locations.

deploy/varwof-core-backup.{service,timer} run a daily database backup:

sudo install -m 0755 deploy/varwof-core-backup.sh /usr/local/bin/varwof-core-backup
sudo install -m 0644 deploy/varwof-core-backup.service \
                 deploy/varwof-core-backup.timer /etc/systemd/system/
sudo systemctl daemon-reload && sudo systemctl enable --now varwof-core-backup.timer

Backups land in /var/lib/varwof/backups and are pruned after 90 days.

Architecture

graph TB
    subgraph varwof["varwof Ecosystem"]
        core["core<br/>PKI CA<br/>:4430/:4433"]
        tcp["gateway-tcp<br/>TCP L4"]
        http["gateway-http<br/>HTTP L7"]
        udp["gateway-udp<br/>UDP L3"]
        gwcore["gateway-core<br/>Security Engine"]
        client["client<br/>CLI"]
        types["types<br/>Shared Types"]
        reg["register<br/>Capability Registry"]
        eng["engine<br/>In-Memory"]
    end
    client -->|mTLS| core
    tcp --> gwcore
    http --> gwcore
    udp --> gwcore
    gwcore -->|mTLS API| core
    core --> eng
    core --> types
    core --> reg

Documentation

core is the core CA engine of the varwof ecosystem, providing complete PKI lifecycle management. This project is a member of the Open Invention Network.

License & Commercial Use

varwof-core is licensed under AGPL-3.0. Organizations that cannot adopt AGPL may request a commercial license.

Varwof is an independent personal project. During the ecosystem-building period (target 1–2 years), the commercial license is free and granted annually (one-year terms, fee 0; renewal is decided by Varwof, free renewals during the free period). Use is unrestricted: unlimited instances, users, and issuance; embedding in products and SaaS is allowed. If fees are introduced, licensees receive 6 months' notice and may fall back to AGPL-3.0. Not offered in the EU/EEA/UK/Switzerland. The software is provided 'as is' without warranties of any kind; use is at your own risk.

Contact: pki@varwof.com | https://varwof.com

Links

Community

Questions, feedback, and port status: AIC Discussions