meatloaf-bot/pikvm-https-cert
Watch
1
0
Fork
You've already forked pikvm-https-cert
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
PiKVM HTTPS & Certificate Authority Management Plugin (Extra)
18 commits 1 branch 0 tags 333 KiB
  • Python 64%
  • JavaScript 23.1%
  • HTML 5.6%
  • CSS 4.4%
  • Shell 2.9%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Adam Outler 908f62d960 Rename extra directory and routes from https to certmgr
2026-11-03 19:06:54 -05:00
extras/certmgr Rename extra directory and routes from https to certmgr 2026-11-03 19:06:54 -05:00
kvmd_certmgr Rename extra directory and routes from https to certmgr 2026-11-03 19:06:54 -05:00
systemd Refactor to FHS standard and use /etc/kvmd/nginx/ssl 2026-11-03 16:51:38 -05:00
tests Refactor to FHS standard and use /etc/kvmd/nginx/ssl 2026-11-03 16:51:38 -05:00
web/extras/certmgr Rename extra directory and routes from https to certmgr 2026-11-03 19:06:54 -05:00
.gitignore feat: implement PiKVM HTTPS & CA certificate manager plugin (kvmd-certmgr) 2026-10-29 10:32:47 -04:00
GEMINI.md Rename extra directory and routes from https to certmgr 2026-11-03 19:06:54 -05:00
install.sh Rename extra directory and routes from https to certmgr 2026-11-03 19:06:54 -05:00
kvmd-certmgr-thirdparty.install Rename extra directory and routes from https to certmgr 2026-11-03 19:06:54 -05:00
PKGBUILD Rename extra directory and routes from https to certmgr 2026-11-03 19:06:54 -05:00
pyproject.toml Refactor to FHS standard and use /etc/kvmd/nginx/ssl 2026-11-03 16:51:38 -05:00
README.md Rename extra directory and routes from https to certmgr 2026-11-03 19:06:54 -05:00
setup.py Refactor to FHS standard and use /etc/kvmd/nginx/ssl 2026-11-03 16:51:38 -05:00
uninstall.sh Rename extra directory and routes from https to certmgr 2026-11-03 19:06:54 -05:00

README.md

PiKVM HTTPS & Certificate Authority Manager (kvmd-certmgr-thirdparty)

A PiKVM Extra (extras/certmgr) that provides a Web UI on the PiKVM main page (HTTPS / SSL) and a local Unix-socket service (kvmd-certmgr.service) for managing, creating, renewing, and syncing browser-compliant Root CA and Server TLS certificates.

Features

  1. Main Page UI Presence: Registers /usr/share/kvmd/extras/certmgr/manifest.yaml (place: 25) so an HTTPS / SSL tile appears directly on the PiKVM index page.
  2. Personalized Information: Configure Country (C), State (ST), Locality (L), Organization (O), Organizational Unit (OU), Root CA Common Name, Server Common Name (CN), Email, SAN DNS Names, and SAN IPv4/IPv6 Addresses. Persisted in /etc/kvmd/nginx/ssl/certmgr.json.
  3. Generate CA Certificate: Generates a 4096-bit RSA Root CA (v3_ca, 10-year validity, X.509 nameConstraints) and immediately signs and installs an initial 2048-bit Server TLS fullchain certificate (365-day validity, serverAuth EKU, SANs).
  4. Replace CA Certificate (With Confirmation Gate): Protected behind a collapsible Danger Zone and a modal dialog requiring an explicit acknowledgment checkbox and typing REPLACE CA before overwriting the Root CA.
  5. Replace Server Certificate: Issues a fresh Server TLS Certificate signed by the existing Root CA whenever your PiKVM's IP address or DNS hostname changes, without invalidating client CA trust stores.
  6. Multi-Device Fleet CA Sync: Pull the Root CA directly from another PiKVM over HTTPS (with optional SHA-256 fingerprint pinning) or export/import a CA bundle so one trusted Root CA covers all PiKVM units on your LAN.
  7. Download CA Certificate & OS Trust Guides: One-click download in DER (.crt) or PEM (.pem) format, accompanied by documentation links for Windows, Ubuntu, macOS, RHEL, Arch, Chrome, Firefox, iOS, and Android.

Installation on PiKVM

Via pacman

rw
pacman -S kvmd-certmgr-thirdparty
ro

From Source (makepkg)

git clone https://github.com/adamoutler/kvmd-certmgr-thirdparty.git
cd kvmd-certmgr-thirdparty
makepkg -si

Running Tests

PYTHONPATH=. pytest -v