Qertum

A self-hosted certificate authority with post-quantum support. Issue, track, renew and revoke X.509 certificates through a web UI, a REST API, a command line, or standard ACME and EST clients. Storage is SQLite: no external database, message broker or cloud service is needed.

Stable release. Pin an exact image tag, take a backup and read the release notes before you upgrade. The support and compatibility policy says what a version number promises and which releases get security fixes.

Quick start

docker run -d --name qertum \
  -e QERTUM_HOST=localhost \
  -e IdentityService__SeedAdminPassword='choose-a-strong-password' \
  -p 127.0.0.1:8080:8080 -p 127.0.0.1:8081:8081 -p 127.0.0.1:8082:8082 -p 8083:8083 \
  -v qertum-data:/data \
  --restart unless-stopped \
  qertum/qertum:1.0.0

Open http://localhost:8080 on the same machine, sign in as admin and follow the onboarding to create or import your root CA. The ACME directory is at http://localhost:8083/acme/directory. Published host ports must equal the container ports. QERTUM_HOST is the public address: the exact name users type in the browser, with no NAT, DNS alias or other name in between. localhost, 127.0.0.1 and the machine's LAN IP are different values, and a browser address that differs from it fails sign-in with The specified 'redirect_uri' is not valid for this client application (ID2043).

Browser and API ports bind to loopback, so this HTTP trial is local to the Docker host. For remote access, put a TLS reverse proxy in front of the web, identity and API ports, set QERTUM_HOST to the proxy's host name, set QERTUM_PUBLIC_SCHEME=https and set QERTUM_TRUSTED_PROXIES to the proxy's address or network; see TLS and Reverse Proxy. Keep the backend HTTP ports private to the proxy. ACME clients on other machines can use http://<host>:8083 directly. ACME must not sit behind a TLS proxy.

The single container has no EST endpoint. For EST, or to expose only ACME and EST, use the multi-container layout in deploy/multi-container/.

Images

Two multi-architecture images (linux/amd64 and linux/arm64), identical on three registries:

Deployment	Docker Hub	Quay.io	GitHub Container Registry
Single container	qertum/qertum	quay.io/qertum/qertum	ghcr.io/qertum/qertum
One container per service	qertum/qertum-services	quay.io/qertum/qertum-services	ghcr.io/qertum/qertum-services

What it does

• Request lifecycle with approval, renewal and asynchronous revocation, every step audit-logged in a tamper-evident log. Optional two-person approval for the most sensitive operations.
• ACME (RFC 8555) with http-01 and dns-01, including wildcards and external account binding, and EST (RFC 7030) for devices, in the multi-container layout.
• Post-quantum ready: RSA and ECDSA alongside ML-DSA, SLH-DSA, ML-KEM, paired classical and post-quantum certificates, and composite ML-DSA, with a staged enforcement policy that can steer an organisation off classical keys.
• Issuance policies and templates that govern every path (web, API, CLI, ACME, EST), and role-based permissions.
• Issuer hierarchy: an offline root with online intermediates, renewal of roots and intermediates with a new key under the same name, rollover and trust-bundle export.
• Revocation publishing: a CRL at /crl and an OCSP responder at /ocsp.
• Webhooks with HMAC signatures and retries, and metrics through OpenTelemetry.

Architecture

The diagram shows the complete architecture for this release. See Architecture for service roles, deployment choices and limits.

Keep the CA key safe

Back up /data: it holds the CA private key, and losing it loses the CA. Clients reject Qertum certificates until the root is installed as a trust anchor on each of them. Exporting a CA key is possible for administrators but is not a safe way to manage one; keep a production root offline.

Documentation

The wiki covers installing, configuring and operating Qertum:

• Single Container and Multi Container
• Using the Web UI and Using the REST API
• Backup and Restore, Upgrading and Troubleshooting
• Identity Providers and Issuer Compromise Recovery

What a version number promises, which releases get security fixes and where to ask for help is in the support and compatibility policy.

Each deployment also has its own guide next to its compose files: deploy/single-container/, deploy/multi-container/ and deploy/identity/.

Building from source

Requires the .NET 10 SDK and Docker.

dotnet build Qertum.sln
dotnet test Qertum.sln

To run the whole stack locally, see Local Development.

Security, contributing and license

• Report vulnerabilities privately: SECURITY.md.
• Contributing: CONTRIBUTING.md, Code of Conduct.
• MIT, see LICENSE. Third-party components in the images and qca, with their licences: THIRD-PARTY-NOTICES.txt.