https://czinda.io/tags/kipuka/Recent content in Kipuka on Chris ZindaHugo -- 0.146.0en-usThu, 25 Jun 2026 00:00:00 +0000https://czinda.io/posts/kipuka-est-server-and-infrastructure/Thu, 25 Jun 2026 00:00:00 +0000https://czinda.io/posts/kipuka-est-server-and-infrastructure/Enterprise certificate enrollment shouldn't require a monolithic CA. kipuka is a Rust-based EST server with multi-CA failover, HSM key protection, NIAP compliance, CoAP/DTLS for constrained devices, CMP enrollment, and post-quantum readiness — designed to fit into the PKI you already have.https://czinda.io/posts/state-of-pqc-may-2026/Tue, 26 May 2026 00:00:00 +0000https://czinda.io/posts/state-of-pqc-may-2026/A practitioner's scorecard for post-quantum cryptography adoption across TLS, SSH, and PKI — what works today, what's close, and what's still blocked.https://czinda.io/posts/migrating-asn1-to-synta/Tue, 19 May 2026 00:00:00 +0000https://czinda.io/posts/migrating-asn1-to-synta/How PKI.Next replaced six competing ASN.1/X.509 Rust crates with synta — a schema-generated, zero-copy library — in a single migration that touched 34 files, deleted 1,726 lines, and made certificate parsing 3x faster.https://czinda.io/posts/pki-next-part6-replacing-dogtag/Thu, 14 May 2026 00:00:00 +0000https://czinda.io/posts/pki-next-part6-replacing-dogtag/What twenty years of operating Dogtag PKI taught us about building its replacement, the compatibility proxy that makes migration possible, and the architectural bets that will define the next twenty years of certificate management.https://czinda.io/posts/pki-next-part5-protocol-servers/Tue, 12 May 2026 00:00:00 +0000https://czinda.io/posts/pki-next-part5-protocol-servers/How PKI.Next serves EST, ACME, CoAP, SPIFFE/SPIRE, HashiCorp Vault, and Dogtag compatibility from a single CA using the Registration Authority pattern — and why protocol diversity is the future of PKI.https://czinda.io/posts/pki-next-part4-tamper-evident-audit/Sat, 09 May 2026 00:00:00 +0000https://czinda.io/posts/pki-next-part4-tamper-evident-audit/How PKI.Next implements HMAC hash-chained audit logs for Common Criteria FAU_STG.2 compliance, the timestamp precision bug that silently broke chain verification, and why audit integrity is the hardest part of running a CA.https://czinda.io/posts/pki-next-part3-fips-and-hsm/Thu, 07 May 2026 00:00:00 +0000https://czinda.io/posts/pki-next-part3-fips-and-hsm/How PKI.Next uses Rust feature flags and trait objects to support three cryptographic backends — ring, aws-lc-rs (FIPS 140-3), and PKCS#11 hardware — without a single if-else in the certificate issuance path.https://czinda.io/posts/pki-next-part1-building-ca-in-rust/Wed, 29 Apr 2026 00:00:00 +0000https://czinda.io/posts/pki-next-part1-building-ca-in-rust/Why we chose Rust to build a modern Certificate Authority from scratch, the modular crate architecture that makes it work, and what 55,000 lines of Rust buys you that Java and C never could.