⚠️ Technical Preview — Core cryptographic primitives verified for OpenSSL interoperability; RFC compliance ongoing. Not for production use. APIs and features may change before official release.
Single binary, pure Go, private CA up in one minute.
Pure Go: all features implemented in pure Go, no external dependencies. System Requirements: none. Just a single Go-compiled binary. Target Users: individual developers, small teams, K8s dev clusters.
Language: Go 1.26 — Database: SQLite (recommended, pure Go)
| Category | Capabilities |
|---|---|
| CA | init-ca (root/sub), ca-list, ca-info, sub-ca create |
| Issue | CSR or auto keygen, 9 profiles, batch CSV, renew |
| Revoke | CLI revocation, OCSP real-time, CRL generation |
| TSA | RFC 3161 timestamp |
| OCSP | RFC 6960 responder |
| Code sign | PKCS#7 detached/embedded, CAdES-T, verify |
| Cross-cert | Cross-certificate issue/list/revoke |
| Trust bridge | Cross-sign CA, federate trust anchors |
| Multi-DB | SQLite (recommended), PostgreSQL, MySQL/MariaDB |
| RBAC | Users (4 roles), API tokens, audit log |
| REST API | JSON API for all operations |
| Health | /healthz, /readyz endpoints |
| Metric | Result |
|---|---|
| Signing throughput | ~11,000 req/s (signing-bound ceiling) |
| Enterprise workload | 833 AIC/s sustained, p99 5 ms, ~800 MB stable RAM, no backpressure, no 503 |
Full benchmark reports: Bench & Test.
go build -o /usr/local/bin/varwof ./cmd/pki/
varwof init-ca --name root --profile root-ca --out-dir /etc/varwof/core/root
varwof init-ca --name issuing --profile sub-ca \
--parent root --parent-key /etc/varwof/core/root/private/ca.key
varwof serve
varwof issue --cn server.example.com \
--san "DNS:server.example.com,IP:10.0.0.1" \
--profile tls-server --out-dir /etc/varwof/core/certsgo build -o /usr/local/bin/varwof ./cmd/pki/graph TB
subgraph varwof["varwof Ecosystem"]
core["core<br/>PKI CA<br/>:4430/:4433"]
tcp["gateway-tcp<br/>TCP L4"]
http["gateway-http<br/>HTTP L7"]
udp["gateway-udp<br/>UDP L3"]
gwcore["gateway-core<br/>Security Engine"]
client["client<br/>CLI"]
types["types<br/>Shared Types"]
reg["register<br/>Capability Registry"]
eng["engine<br/>In-Memory"]
end
client -->|mTLS| core
tcp --> gwcore
http --> gwcore
udp --> gwcore
gwcore -->|mTLS API| core
core --> eng
core --> types
core --> reg
| Document | EN | CN |
|---|---|---|
| Quick Start | docs/core/en/quickstart.md |
docs/core/zh/quickstart.md |
| Configuration | docs/core/en/configuration.md |
docs/core/zh/configuration.md |
| Deployment | docs/core/en/deployment.md |
docs/core/zh/deployment.md |
| Commands | docs/core/en/commands.md |
docs/core/zh/commands.md |
| API Reference | docs/core/en/api.md |
docs/core/zh/api.md |
| OpenAPI Spec | docs/openapi.yaml |
— |
| Bench & Performance | docs/bench/README.md |
docs/bench/README_CN.md |
core is the core CA engine of the varwof ecosystem, providing complete PKI lifecycle management. This project is a member of the Open Invention Network.
varwof-core is licensed under AGPL-3.0. Organizations that cannot adopt AGPL may request a commercial license.
Varwof is an independent personal project. During the ecosystem-building period (target 1–2 years), the commercial license is free and granted annually (one-year terms, fee 0; renewal is decided by Varwof, free renewals during the free period). Use is unrestricted: unlimited instances, users, and issuance; embedding in products and SaaS is allowed. If fees are introduced, licensees receive 6 months' notice and may fall back to AGPL-3.0. Not offered in the EU/EEA/UK/Switzerland. The software is provided 'as is' without warranties of any kind; use is at your own risk.
Contact: pki@varwof.com | https://varwof.com
| Homepage | https://varwof.com |
| Community | https://varwof.org |
| IETF Draft | draft-wei-aic-identity-cert |
| License | AGPL-3.0 / Commercial |
| Member | Open Invention Network |
Questions, feedback, and port status: AIC Discussions