Requirements¶
PKIFactor ships in two packagings of the same product, built from the same signed images:
| Packaging | For | Database | High availability |
|---|---|---|---|
| Appliance (a Linux host running Docker Compose, installed by the provisioner) | Most installations, including air-gapped ones | PostgreSQL 16 in a container | Yes: Patroni cluster across 2 nodes plus a witness, or 3 nodes (High availability) |
| Helm chart for Kubernetes and OpenShift | Platforms that run everything on Kubernetes | External PostgreSQL (recommended) or a single in-cluster instance | Database HA is provided by your managed PostgreSQL (Kubernetes and OpenShift) |
Appliance host¶
| Resource | Minimum | Recommended |
|---|---|---|
| Operating system | Debian 12, Ubuntu 22.04, AlmaLinux / Rocky / RHEL 9 | Debian 12 or AlmaLinux 9 |
| CPU | 2 vCPU | 4 vCPU |
| Memory | 4 GB | 8 GB |
| Disk | 40 GB | 100 GB SSD |
| Docker | Docker Engine 24+ with the Compose v2 plugin | installed by the provisioner if absent |
Each node of a high-availability cluster needs 4 vCPU, 8 GB of memory and 100 GB of SSD.
For reference, the test appliance (version 1.8.50, about 150 managed certificates, a dozen devices) runs on 2 vCPU and 6 GB of memory: its containers use about 2 GB of memory in steady state, and the system with the images and the database takes about 22 GB of disk. Plan the recommended size for production, the backups and the growth of the audit trail. Sizing by number of managed certificates, growth of the database and the logs, and the settings to adjust: Capacity planning.
Air-gapped hosts
The Docker images travel in the installation package, so PKIFactor itself needs no Internet access. Only Docker is fetched from the Docker repository when it is not already installed: on a host without Internet access, install Docker Engine and the Compose plugin from your internal mirror first.
DNS names¶
Create the DNS records before the installation. They can all point to the same address (the host, or the load balancer address in high availability).
| Name | Example | Serves |
|---|---|---|
| CLM | clm.example.com |
Web interface and REST API |
| ACME | acme.example.com |
ACME server |
| EST | est.example.com |
EST server |
| CMP | cmp.example.com |
CMP server |
| SCEP | scep.example.com |
SCEP server |
The setup wizard derives the four protocol names from the CLM name: clm.example.com gives acme.example.com, est.example.com, cmp.example.com and scep.example.com.
TLS certificate¶
nginx terminates TLS for every name above. One certificate whose subject alternative names cover all five names is the simplest choice.
- RSA 2048 bits or more, or ECDSA P-256 or more;
- TLS 1.2 and TLS 1.3 are served;
- provide the full chain (server certificate followed by the intermediate certificates).
A self-signed certificate is generated at installation if you have none yet; replace it before production with pkifactor-ctl tls update (Appliance).
Network flows¶
Inbound¶
| Port | Purpose |
|---|---|
| 443/TCP | Web interface, API, ACME, EST, SCEP and CMP over HTTPS |
| 80/TCP | Redirection to HTTPS, ACME HTTP-01 |
| 22/TCP | Administration over SSH |
The CMP CoAP transport (5683/UDP) is bound to the local host only; publish it explicitly if your devices use CMP over CoAP.
Outbound¶
PKIFactor opens connections only towards what you configure:
| Destination | Typical port | When |
|---|---|---|
| Certification authorities (Vault, AD CS over WinRM, EJBCA, ZetaCA, public CAs) | 443, 5986, 8200, 8443 | Issuance, revocation, template synchronization |
| Deployment targets (F5, FortiWeb, PAN-OS, Check Point, Kemp, IIS, SSH servers) | 443, 5986, 22 | Certificate push and verification |
| Directories (LDAP, Entra ID through Microsoft Graph, Keycloak, Okta, Google) | 636, 443 | Directory groups and search |
| SSO identity provider | 443 | Sign-in |
| KMS (Vault Transit) or HSM | 8200, vendor port | Key encryption at rest |
| SMTP server | 25, 465, 587 | Notifications |
| SIEM | 514, 6514 | Audit forwarding |
| ServiceNow instance | 443 | Inventory, incidents, changes |
| DNS provider APIs | 443 | DNS-01 and public CA domain validation |
The complete matrix, flow by flow, is in Network flow matrix. Outbound HTTPS can go through a proxy, either globally (HTTPS_PROXY and NO_PROXY in .env) or per certification authority (the proxy setting of the connector, which can also force a direct connection).
Between high-availability nodes¶
| Port | Purpose |
|---|---|
| 2379/TCP, 2380/TCP | etcd (mutual TLS) |
| 5432/TCP | PostgreSQL replication |
| 8008/TCP | Patroni REST API |
Time¶
All hosts must be synchronized with NTP. Certificate validity, token lifetimes, ACME and the etcd cluster all depend on a correct clock.