Does this sound familiar?
Two kinds of trouble, one cause. You do this rarely, and the manual assumes you do it daily.
Nobody explained what all this is
GPG? PKCS#11? An internal PKI? What is it, and how do I use it?
- GPG / OpenPGPOne identity, many keys
- PKCS#11How programs talk to a token
- X.509The certificate format
- Internal PKIYour own certificate authority
- CRLA signed list of revoked certificates
- Root vs intermediateWhich one lives in the drawer?
- Name constraintsA fence around what a CA may name
- Master key vs subkeysWhy does a key have children?
- PIVA smart-card standard with slots
- Trust storeWho gets believed, and why
- Custody chainWho holds which key, down to the leaf
Learn explains it, in order
Plain pages that start from what goes wrong in real life and then give the rule. They are written for someone technical who is new to PKI. Read them in order, or jump in from a chip above.
Then the tools push back
YubiKey PIV, gpg-agent, CRL signing, a laptop that has to boot offline.
- YubiKey PIV slots9a, 9c, 9d, 9e. Which one was it?
- gpg-agent vs scdaemon vs pcscdThree daemons, one card, one lock
- keytocardMoves the key. Back up first.
- Boot the offline machineAgain. For ten minutes of signing.
- gpg --edit-cardA menu with its own rules
- CRL re-signingThe list expires on its own schedule
- ykmanOne more tool, one more PIN
- Expiring subkeysThey lapse on a Tuesday
- Lost cardIs there a spare? Where?
- PIN, then PUKThree wrong tries each, then a reset
- Revocation certificateNobody made one in advance
The tools do the chores
A command line plans each step, checks the card, asks you to confirm, and writes the record. Then a wizard, served on your own computer only, shows the same steps with their explanation next to them. You stay in charge: the PIN and the touch stay on the card.
Planned, not built yet: ritueel is in its design phase.
Start learningThe custody chainView on GitHub
Our mission
ritueel teaches people to manage the root of a PKI and the master key of OpenPGP smoothly and safely, and gives them tools that simplify each ritual, from creating a root to signing intermediates and subkeys onto cards, while the person stays in charge.
Almost everything built on keys hangs from a few keys that are used rarely: the root of a certificate hierarchy, the master key of an OpenPGP identity. Using them is a manual ritual, a ceremony, done by a person, and most people do it once or twice in their life. ritueel exists to make that experience smooth and safe.
The ledger and the four rituals
Learning and tools meet in two things. The ledger is the written record of what you did: which roots exist, where each lives, what was signed and when. Next year you do not start from memory. Read how to keep it.
The four rituals are what you come back to. Each one reads the ledger and adds to it, whether you run it by hand from a guide or with a tool.
What comes next
When the root is in order, the next step is identity built on top of it. sluis holds intermediates and signs online. Your root of custody first, then secure-by-design identity on top. The two are separate products; they do not depend on each other and exchange standard formats only.
Where to start
| If you want to | Read |
|---|---|
| Understand what a root is and why it is kept offline | What is a root? and Why the root stays offline |
| See who holds which key, from the root down to the leaf | The custody chain |
| Choose where a key will live | Where a key lives and Which keys to buy |
| Follow a root from birth to retirement | The life of a root |
| Do something now | Guides |
| Know what the tools do today | Tools |
Status
ritueel is in the design phase. There is no release yet. The decision records are accepted, the learning pages and the hand-off contract are written, and the roadmap lists the milestones of the first version. The command line and the wizard are planned; every page says what is built.
How to take part is in Contributing.