Trustpoint CA Playground

A set of shell scripts to generate complete two-tier PKI hierarchies (Root CA → two Issuing CAs) using OpenSSL with EC keys. Designed for development, testing, and PoC environments.

Each hierarchy produces a Root CA, two Issuing CAs (A & B), and optionally an end-entity certificate (signed by Issuing CA A). All artifacts are available in PEM, DER, and PKCS#12 formats.

Quick Start

chmod +x create_ca_hierarchy.sh setup_all_hierarchies.sh
./setup_all_hierarchies.sh

This creates four PKI hierarchies under ./pki/:

Hierarchy	Purpose	End-Entity Cert
IDevID	Device identity (IEEE 802.1AR)	—
Application	Application / TLS credentials	—
CodeSigning	Code-signing certificates	Trustpoint Code Signing
TLS	TLS server/client certificates	trustpoint.local

Directory Structure

pki/
├── idevid/
│   ├── root/                — IDevID Root CA
│   ├── issuing-a/           — IDevID Issuing CA A
│   └── issuing-b/           — IDevID Issuing CA B
├── application/
│   ├── root/                — Application Root CA
│   ├── issuing-a/           — Application Issuing CA A
│   └── issuing-b/           — Application Issuing CA B
├── codesigning/
│   ├── root/                — Code-Signing Root CA
│   ├── issuing-a/           — Code-Signing Issuing CA A
│   ├── issuing-b/           — Code-Signing Issuing CA B
│   └── ee/                  — Code-signing end-entity cert
└── tls/
    ├── root/                — TLS Root CA
    ├── issuing-a/           — TLS Issuing CA A
    ├── issuing-b/           — TLS Issuing CA B
    └── ee/                  — TLS server end-entity cert

License

See LICENSE.