- Home
- Public Key Infrastructure Software
- Dogtag Certificate System
Dogtag Certificate System
What it is
Dogtag Certificate System is free, open source certificate-authority software for enterprises deploying public key infrastructure at scale. It handles certificate issuance, revocation, retrieval, certificate profiles, and certificate-revocation-list generation and publishing. Encryption keys can be archived and recovered, while smartcard tools cover token profiles, enrollment, on-hold handling, recovery, and formatting. The suite includes a Certificate Authority, Key Recovery Authority, OCSP Responder, Token Key Service, Token Processing System, and ACME Responder. Listed enrollment responders include ACME, CMC, EST, and SCEP, and developers can use its REST interface. Dogtag runs on Linux in self-hosted deployments and provides an API. It requires access to a 389 Directory Server for storage, locally or over a network. Fedora installation commands and deployment guidance cover subsystems, clones, and HSMs. The project identifies GPL-2.0 as its license and provides documentation, mailing lists, and IRC chat.
For and against
For
- Free open source software
- Broad certificate lifecycle controls
- Smartcard lifecycle support
- Multiple enrollment protocols
- REST interface for clients
Against
- Requires 389 Directory Server access
- Self-hosted Linux deployment required
- No free trial is offered
The verdict
Dogtag provides a broad certificate-authority suite for enterprise PKI, including revocation, key recovery, smartcards, and multiple protocols. Its infrastructure requirements make it a fit for organizations prepared to manage the surrounding services.
Who it suits
Dogtag is intended for enterprises building large-scale PKI deployments. It fits teams that can operate Linux, self-host the system, and provide 389 Directory Server access.
Plans and prices
Dogtag Certificate System
Open source certificate authority software · Requires access to 389 Directory Server
Read 8 Oct 2026 · dogtagpki.org
On the record
- Certificate lifecycle
- It supports certificate issuance, revocation, retrieval, certificate revocation list generation and publishing, and certificate profiles.dogtagpki.org · read 8 Oct 2026
- Deployment
- The project README gives Fedora installation commands and points to deployment instructions for subsystems, clones, and HSMs.github.com · read 8 Oct 2026
- Directory storage
- Dogtag requires access to a 389 Directory Server for storage, either locally or over the network.dogtagpki.org · read 8 Oct 2026
- Enrollment protocols
- The project lists ACME, CMC, EST, and SCEP responders among its features.github.com · read 8 Oct 2026
- Intended users
- The site describes Dogtag as a collection of technologies for enterprises deploying PKI on a large scale.dogtagpki.org · read 8 Oct 2026
- Key recovery
- The system supports encryption key archival and recovery.dogtagpki.org · read 8 Oct 2026
- License
- The project README identifies the software license as GPL-2.0.github.com · read 8 Oct 2026
- Purpose
- Dogtag is an enterprise-class open source certificate authority for deploying PKI at scale.dogtagpki.org · read 8 Oct 2026
- REST API
- The site links a programming guide for developers writing clients against Dogtag's REST interface.dogtagpki.org · read 8 Oct 2026
- Security
- The project describes the system as hardened by real-world deployments.dogtagpki.org · read 8 Oct 2026
- Smartcards
- Smartcard lifecycle features include token profiles, enrollment, on-hold handling, key recovery, and formatting.dogtagpki.org · read 8 Oct 2026
- Subsystems
- The suite includes a Certificate Authority, Key Recovery Authority, OCSP Responder, Token Key Service, Token Processing System, and ACME Responder.github.com · read 8 Oct 2026
- Support and community
- The project directs users to documentation, mailing lists, and online IRC chat for help and community participation.dogtagpki.org · read 8 Oct 2026
