# sjsu-cmpe272/simple-pki architecture

> Architecture diagram of the GitHub repository sjsu-cmpe272/simple-pki, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/sjsu-cmpe272/simple-pki
- Repository: https://github.com/sjsu-cmpe272/simple-pki
- Video tour (about a minute): https://gitdiagram.com/sjsu-cmpe272/simple-pki/video

## Overview

This repository documents a command-driven PKI workflow for Simple Inc: create a self-signed root CA, have it issue a signing CA, then issue a TLS certificate for the server and package the chain and server key for Tomcat. The README also documents CA databases and a Tomcat/browser deployment step. No source excerpts are available, so the graph reflects documented commands and artifacts rather than unverified implementation details.

Main entry points: [`ca/root-ca.crt`](https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/root-ca.crt) (Root certificate), [`ca/signing-ca.crt`](https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/signing-ca.crt) (Signing CA certificate), [`certs/simple.jks`](https://github.com/sjsu-cmpe272/simple-pki/blob/main/certs/simple.jks) (Java keystore), [`ca/root-ca.csr`](https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/root-ca.csr) (Root CSR and key)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ca["Certificate authorities"]
  node_root_config["Root CA config<br/>[root-ca.conf]"]
  node_root_request["Root CSR and key<br/>[root-ca.csr]"]
  node_root_key["Root private key<br/>[root-ca.key]"]
  node_root_cert["Root certificate<br/>[root-ca.crt]"]
  node_root_db[("Root CA database<br/>[root-ca.db]")]
  node_signing_config["Signing CA config<br/>[signing-ca.conf]"]
  node_signing_request["Signing CA CSR and key<br/>[signing-ca.csr]"]
  node_signing_key["Signing CA private key<br/>[signing-ca.key]"]
  node_signing_cert["Signing CA certificate<br/>[signing-ca.crt]"]
  node_signing_db[("Signing CA database<br/>[signing-ca.db]")]
end

subgraph group_server["Server certificate"]
  node_server_config["Server config<br/>[server.conf]"]
  node_server_request["Server CSR and key<br/>[simple.org.csr]"]
  node_server_key["Server private key<br/>[simple.org.key]"]
  node_server_cert["TLS server certificate<br/>[simple.org.crt]"]
end

subgraph group_deploy["Keystore deployment"]
  node_pkcs12["PKCS&#35;12 bundle<br/>[simple.p12]"]
  node_keystore["Java keystore<br/>[simple.jks]"]
end

node_operator(("Operator"))
node_openssl["OpenSSL"]
node_keytool["Java keytool"]
node_tomcat["Tomcat"]
node_browser(("Browser"))

node_operator -->|"runs commands"| node_openssl
node_openssl -->|"reads config"| node_root_config
node_openssl -->|"creates CSR"| node_root_request
node_openssl -->|"creates key"| node_root_key
node_operator -->|"requests self-signing"| node_openssl
node_openssl -->|"self-signs CSR"| node_root_cert
node_root_request -->|"provides CSR"| node_openssl
node_root_key -->|"signs with key"| node_openssl
node_operator -->|"creates signing CA"| node_openssl
node_openssl -->|"reads config"| node_signing_config
node_openssl -->|"creates CSR"| node_signing_request
node_openssl -->|"creates key"| node_signing_key
node_operator -->|"issues signing CA"| node_openssl
node_openssl -->|"reads issuer config"| node_root_config
node_signing_request -->|"provides CSR"| node_openssl
node_openssl -->|"issues certificate"| node_signing_cert
node_root_cert -->|"signs signing CA"| node_openssl
node_operator -->|"creates server request"| node_openssl
node_openssl -->|"reads config"| node_server_config
node_openssl -->|"creates CSR"| node_server_request
node_openssl -->|"creates key"| node_server_key
node_operator -->|"issues server certificate"| node_openssl
node_openssl -->|"reads issuer config"| node_signing_config
node_server_request -->|"provides CSR"| node_openssl
node_openssl -->|"issues certificate"| node_server_cert
node_signing_cert -->|"signs server certificate"| node_openssl
node_operator -->|"imports certificates"| node_keytool
node_keytool -->|"creates keystore"| node_keystore
node_root_cert -->|"imports trust cert"| node_keytool
node_signing_cert -->|"imports trust cert"| node_keytool
node_operator -->|"exports server bundle"| node_openssl
node_server_key -->|"provides private key"| node_openssl
node_server_cert -->|"provides certificate"| node_openssl
node_openssl -->|"exports bundle"| node_pkcs12
node_operator -->|"imports key pair"| node_keytool
node_pkcs12 -->|"provides key pair"| node_keytool
node_keytool -->|"imports key pair"| node_keystore
node_keystore -->|"configures TLS"| node_tomcat
node_browser -->|"requests HTTPS"| node_tomcat

click node_root_config "https://github.com/sjsu-cmpe272/simple-pki/blob/main/etc/root-ca.conf"
click node_root_request "https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/root-ca.csr"
click node_root_key "https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/root-ca/private/root-ca.key"
click node_root_cert "https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/root-ca.crt"
click node_root_db "https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/root-ca/db/root-ca.db"
click node_signing_config "https://github.com/sjsu-cmpe272/simple-pki/blob/main/etc/signing-ca.conf"
click node_signing_request "https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/signing-ca.csr"
click node_signing_key "https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/signing-ca/private/signing-ca.key"
click node_signing_cert "https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/signing-ca.crt"
click node_signing_db "https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/signing-ca/db/signing-ca.db"
click node_server_config "https://github.com/sjsu-cmpe272/simple-pki/blob/main/etc/server.conf"
click node_server_request "https://github.com/sjsu-cmpe272/simple-pki/blob/main/certs/simple.org.csr"
click node_server_key "https://github.com/sjsu-cmpe272/simple-pki/blob/main/certs/simple.org.key"
click node_server_cert "https://github.com/sjsu-cmpe272/simple-pki/blob/main/certs/simple.org.crt"
click node_pkcs12 "https://github.com/sjsu-cmpe272/simple-pki/blob/main/certs/simple.p12"
click node_keystore "https://github.com/sjsu-cmpe272/simple-pki/blob/main/certs/simple.jks"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_root_config,node_root_request,node_root_key,node_root_cert,node_root_db,node_signing_config,node_signing_request,node_signing_key,node_signing_cert,node_signing_db,node_browser toneBlue
class node_server_config,node_server_request,node_server_key,node_server_cert toneAmber
class node_pkcs12,node_keystore toneMint
class node_operator,node_openssl,node_keytool,node_tomcat toneIndigo
```

## Components

### Certificate authorities

- [Root CA config](https://github.com/sjsu-cmpe272/simple-pki/blob/main/etc/root-ca.conf): `etc/root-ca.conf`
- [Root CSR and key](https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/root-ca.csr): `ca/root-ca.csr`
- [Root private key](https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/root-ca/private/root-ca.key): `ca/root-ca/private/root-ca.key`
- [Root certificate](https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/root-ca.crt): `ca/root-ca.crt`
- [Root CA database](https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/root-ca/db/root-ca.db): `ca/root-ca/db/root-ca.db`
- [Signing CA config](https://github.com/sjsu-cmpe272/simple-pki/blob/main/etc/signing-ca.conf): `etc/signing-ca.conf`
- [Signing CA CSR and key](https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/signing-ca.csr): `ca/signing-ca.csr`
- [Signing CA private key](https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/signing-ca/private/signing-ca.key): `ca/signing-ca/private/signing-ca.key`
- [Signing CA certificate](https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/signing-ca.crt): `ca/signing-ca.crt`
- [Signing CA database](https://github.com/sjsu-cmpe272/simple-pki/blob/main/ca/signing-ca/db/signing-ca.db): `ca/signing-ca/db/signing-ca.db`

### Server certificate

- [Server config](https://github.com/sjsu-cmpe272/simple-pki/blob/main/etc/server.conf): `etc/server.conf`
- [Server CSR and key](https://github.com/sjsu-cmpe272/simple-pki/blob/main/certs/simple.org.csr): `certs/simple.org.csr`
- [Server private key](https://github.com/sjsu-cmpe272/simple-pki/blob/main/certs/simple.org.key): `certs/simple.org.key`
- [TLS server certificate](https://github.com/sjsu-cmpe272/simple-pki/blob/main/certs/simple.org.crt): `certs/simple.org.crt`

### Keystore deployment

- [PKCS#12 bundle](https://github.com/sjsu-cmpe272/simple-pki/blob/main/certs/simple.p12): `certs/simple.p12`
- [Java keystore](https://github.com/sjsu-cmpe272/simple-pki/blob/main/certs/simple.jks): `certs/simple.jks`

### Other components

- **Operator**
- **OpenSSL**
- **Java keytool**
- **Tomcat**
- **Browser**

## Connections

- Operator → OpenSSL: runs commands
- OpenSSL → Root CA config: reads config
- OpenSSL → Root CSR and key: creates CSR
- OpenSSL → Root private key: creates key
- Operator → OpenSSL: requests self-signing
- OpenSSL → Root certificate: self-signs CSR
- Root CSR and key → OpenSSL: provides CSR
- Root private key → OpenSSL: signs with key
- Operator → OpenSSL: creates signing CA
- OpenSSL → Signing CA config: reads config
- OpenSSL → Signing CA CSR and key: creates CSR
- OpenSSL → Signing CA private key: creates key
- Operator → OpenSSL: issues signing CA
- OpenSSL → Root CA config: reads issuer config
- Signing CA CSR and key → OpenSSL: provides CSR
- OpenSSL → Signing CA certificate: issues certificate
- Root certificate → OpenSSL: signs signing CA
- Operator → OpenSSL: creates server request
- OpenSSL → Server config: reads config
- OpenSSL → Server CSR and key: creates CSR
- OpenSSL → Server private key: creates key
- Operator → OpenSSL: issues server certificate
- OpenSSL → Signing CA config: reads issuer config
- Server CSR and key → OpenSSL: provides CSR
- OpenSSL → TLS server certificate: issues certificate
- Signing CA certificate → OpenSSL: signs server certificate
- Operator → Java keytool: imports certificates
- Java keytool → Java keystore: creates keystore
- Root certificate → Java keytool: imports trust cert
- Signing CA certificate → Java keytool: imports trust cert
- Operator → OpenSSL: exports server bundle
- Server private key → OpenSSL: provides private key
- TLS server certificate → OpenSSL: provides certificate
- OpenSSL → PKCS#12 bundle: exports bundle
- Operator → Java keytool: imports key pair
- PKCS#12 bundle → Java keytool: provides key pair
- Java keytool → Java keystore: imports key pair
- Java keystore → Tomcat: configures TLS
- Browser → Tomcat: requests HTTPS