devcertkit

devcertkit is a simple toolkit wrapper for EasyRSA.
It streamlines the management of internal SSL certificates and VPN infrastructure (OpenVPN) using your own private Certificate Authority (CA).

Built for:

• Homelabs and self-hosted services
• Internal HTTPS environments
• Secure remote access (OpenVPN)
• Development and testing workflows

This project is based on a collection of private helper scripts and has been refined for ease of use and real-world reliability.

---

Why devcertkit?

Managing internal SSL and VPN configurations directly via OpenSSL or EasyRSA can be complex and error-prone.
devcertkit abstracts this complexity, making it easier to handle:

• Unified PKI Management: Separate or shared PKIs for SSL and VPN.
• Advanced SSL Support: Multi-domain SAN, Wildcards, and PEM bundle creation.
• VPN Ready: Fully functional OpenVPN CA management, client configuration generation (.ovpn), and server configuration templates.
• Device Compatibility: Specific output modes for OpenWRT (uhttpd), mobile devices, and routers.
• Automated Workflows: Workspace-based structure with automatic CA creation or existing CA import.

---

Features

SSL Management

• EasyRSA-based certificate generation.
• Support for Subject Alternative Names (SAN) and Wildcards.
• OpenWRT/uhttpd compatibility mode.
• Optional PEM and CA bundle creation.
• Automated packaging of certificates via zip.

VPN Management

• Full OpenVPN CA and PKI management.
• Automated client certificate and .ovpn config generation.
• Server configuration templates (UDP/TCP fallback).
• Multiple client templates: general, mobile, router.
• Automatic inclusion of necessary keys (ca.crt, ta.key) in client packages.

General

• Workspace-based structure for clean separation of runtime and output.
• Automatic EasyRSA backend resolution and setup.
• Flexible configuration via settings files.

---

Installation & Requirements

Prerequisites

Ensure the following tools are installed:

• Bash
• OpenSSL
• zip (for packaging)

Setup

1. Clone the repository.
2. Initialize the workspace:

   ./devcertkit init

   This command prepares the environment and resolves the EasyRSA backend.

---

Usage

SSL Management

Initialize SSL PKI:

./devcertkit ssl init

CA Management:

• ssl ca create: Interactively create a new SSL CA.
• ssl ca info: Display details about the current SSL CA.
• ssl ca import: Import an existing CA from config/ca/ssl.

Certificate Generation:

• Standard: ./devcertkit ssl cert create -d git.home
• Wildcard: ./devcertkit ssl cert create -d *.example.home
• OpenWRT: ./devcertkit ssl cert create --openwrt -d config.router
• PEM Bundle: ./devcertkit ssl cert create --create-pem -d mail.home
• Include CA: ./devcertkit ssl cert create --include-ca -d mail.home

Information:

./devcertkit ssl cert info git.home

VPN Management

Initialize VPN PKI:

./devcertkit vpn init

CA Management:

• vpn ca create: Create a new VPN CA (passwordless by default).
• vpn ca create --pass: Create a new VPN CA with a password.
• vpn ca info: Display details about the VPN CA.
• vpn ca import: Import an existing CA from config/ca/vpn.
• vpn ca gen-tls: Generate a new OpenVPN TLS-AUTH key (ta.key).

Client Creation: Generate a client configuration and certificates:

# General client (with password prompt for the key)
./devcertkit vpn client create my-client

# Mobile client (no password)
./devcertkit vpn client create -t mobile --no-pass my-phone

# Router-specific client (no password)
./devcertkit vpn client create -t router --no-pass my-router

Options for client creation:

• -t, --type <type>: general, mobile, or router (default: general).
• --no-pass: Skip password protection for the client key.
• --archive: Create a zip compression of the output directory.
• --vpn-port <port>: Override the VPN server port in the client config.

Information:

./devcertkit vpn client info my-client

---

Project Structure

• devcertkit: Main entry point.
• config/: Configuration files and templates.
• runtime/: Internal PKI and EasyRSA backend.
• output/: Generated certificates and client packages.
• scripts/: Implementation details for SSL and VPN commands.

---

Planned Features

Planned improvements include:

• OpenVPN server-config creation
• automatic EasyRSA download, if not available

---

Credits

This project uses EasyRSA for certificate and PKI management.

---

License

MIT License Copyright (c) 2026 nedron92

EasyRSA is licensed separately by the OpenVPN community.