Freedom251 › Certificate Management Software
Dogtag Certificate System
What Dogtag Certificate System is
Dogtag Certificate System is an open source certificate authority for enterprises deploying public key infrastructure at scale. It handles certificate issuance, revocation and retrieval, as well as certificate profiles and generating and publishing certificate revocation lists. The system also supports encryption key archival and recovery. Smartcard lifecycle functions include token profiles, enrollment, on-hold handling, key recovery and formatting. Its components include a Certificate Authority, Key Recovery Authority, OCSP Responder, Token Key Service, Token Processing System and ACME Responder. The project lists ACME, CMC, EST and SCEP responders, and provides a programming guide for clients using its REST interface. Dogtag is for self-hosted Linux deployments and requires access to a 389 Directory Server for storage, locally or over a network. The project provides Fedora installation commands and deployment instructions for subsystems, clones and HSMs. It is licensed under GPL-2.0. Documentation, mailing lists and online IRC chat are listed as community resources.
Who it suits
Dogtag suits enterprises deploying PKI at scale, particularly those needing certificate lifecycle and smartcard management. It is intended for teams able to run a self-hosted Linux deployment and provide access to a 389 Directory Server.
What it does well
- Supports certificate issuance, revocation and retrieval.
- Includes key archival and recovery.
- Lists ACME, CMC, EST and SCEP responders.
- REST interface programming guide is available.
- Licensed under GPL-2.0.
What to know first
- Requires access to a 389 Directory Server.
- Deployment is self-hosted on Linux.
- No free trial is listed.
Limits
Dogtag is free open source software. Its storage requires access to a 389 Directory Server, locally or over a network.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Dogtag Certificate System | Open source certificate authority software · Requires access to 389 Directory Server | Free |
As dogtagpki.org lists them, read 8 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the Dogtag Certificate System website.
- Review the Fedora installation commands in the project README.
- Provide access to a 389 Directory Server locally or over the network.
- Follow the deployment instructions for the required subsystems, clones or HSMs.
- Use the documentation, mailing lists or online IRC chat for help.
Verdict
Dogtag combines certificate authority, key recovery, responder and smartcard functions for large-scale PKI deployments. Its directory-server requirement and self-hosted Linux deployment are central considerations.
Questions
Is Dogtag free?
Yes. The Dogtag Certificate System plan is free and the software is open source.
What license does it use?
The project README identifies the license as GPL-2.0.
What platforms does Dogtag support?
It is listed for Linux, self-hosted deployment and API access.
What storage does it require?
Dogtag requires access to a 389 Directory Server, either locally or over a network.
What certificate workflows are supported?
It supports issuance, revocation, retrieval, certificate profiles, and generating and publishing certificate revocation lists.
Where can users get help?
The project points users to documentation, mailing lists and online IRC chat.
Facts from Dogtag Certificate System's own pages
- Certificate lifecycle
- It supports certificate issuance, revocation, retrieval, certificate revocation list generation and publishing, and certificate profiles. · dogtagpki.org, 8 Oct 2026
- Deployment
- The project README gives Fedora installation commands and points to deployment instructions for subsystems, clones, and HSMs. · github.com, 8 Oct 2026
- Directory storage
- Dogtag requires access to a 389 Directory Server for storage, either locally or over the network. · dogtagpki.org, 8 Oct 2026
- Enrollment protocols
- The project lists ACME, CMC, EST, and SCEP responders among its features. · github.com, 8 Oct 2026
- Intended users
- The site describes Dogtag as a collection of technologies for enterprises deploying PKI on a large scale. · dogtagpki.org, 8 Oct 2026
- Key recovery
- The system supports encryption key archival and recovery. · dogtagpki.org, 8 Oct 2026
- License
- The project README identifies the software license as GPL-2.0. · github.com, 8 Oct 2026
- Purpose
- Dogtag is an enterprise-class open source certificate authority for deploying PKI at scale. · dogtagpki.org, 8 Oct 2026
- REST API
- The site links a programming guide for developers writing clients against Dogtag's REST interface. · dogtagpki.org, 8 Oct 2026
- Security
- The project describes the system as hardened by real-world deployments. · dogtagpki.org, 8 Oct 2026
- Smartcards
- Smartcard lifecycle features include token profiles, enrollment, on-hold handling, key recovery, and formatting. · dogtagpki.org, 8 Oct 2026
- Subsystems
- The suite includes a Certificate Authority, Key Recovery Authority, OCSP Responder, Token Key Service, Token Processing System, and ACME Responder. · github.com, 8 Oct 2026
- Support and community
- The project directs users to documentation, mailing lists, and online IRC chat for help and community participation. · dogtagpki.org, 8 Oct 2026