ShrouDB
Issue TLS certificates for your internal services

Forge

An internal certificate authority.

Create a CA, then issue, renew, and revoke short-lived X.509 certificates for services on your network, either from a subject name or from a CSR. Forge also maintains the certificate revocation list.

Use it from your app

terminal
# Issue a 24-hour certificate for an internal service
$ curl -s localhost:8200/v1/forge \
    -H "Authorization: Bearer $DEPLOY_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"args":["ISSUE","internal","CN=payments.internal",
                 "TTL","24h","SAN_DNS","payments.internal"]}'

What it does

  • Create root and intermediate CAs.
  • Issue certificates from a subject name or from a CSR.
  • Short lifetimes, renewal, and revocation.
  • Maintains the certificate revocation list.
  • CA key rotation.

Turn it on

Forge runs inside Moat, the ShrouDB server. Add this to moat.tomland restart. It shares Moat's encrypted storage, access tokens, and audit log with the other engines.

moat.toml
[engines.forge]
enabled = true

Commands

Over RESP3, prefix each command with FORGE. Over HTTP, send POST /v1/forge {"args": [...]}. The SDKs have a method for each.

CommandArgsDescription
CA CREATE<name> <algorithm> <subject>Create a CA
ISSUE<ca> <subject> [TTL <dur>] [SAN_DNS <name>]Issue a certificate
ISSUE_FROM_CSR<ca> <csr_pem>Issue from a CSR
RENEW<ca> <serial>Renew a certificate
REVOKE<ca> <serial> [REASON <r>]Revoke a certificate
INSPECT<ca> <serial>Show certificate details
CA ROTATE<name>Rotate the CA key
Try Forge locally
The quickstart takes about five minutes.
QuickstartAll engines