This page uses a local CA and a browser-generated ECDSA key. The private key is created in your browser and is never posted to the server by this application.
You enter an email address. The server validates the address, generates a 6-digit one-time code, stores only an HMAC-SHA-256 digest of that code in short-lived in-memory state, and sends the code through the configured SMTP account. The code expires after 10 minutes and is limited to five verification attempts.
Your browser generates an ECDSA P-384 key pair using the Web Crypto API. The browser creates a PKCS#10 CSR containing:
C=UD · ST=Uddiyana · L=Dakini Land · O=CryptoDakini · OU=Internet Privacy · CN=<your email>
The CSR requests the verified email as a Subject Alternative Name. The CSR is signed locally with ECDSA/SHA-384.
The server receives the email, a short-lived verification token, and the CSR. It verifies the CSR signature, verifies the email SAN, verifies the required Subject, and verifies that the public key is P-384.
The server does not receive the private key. There is no private-key upload endpoint in this build.
The server signs the CSR with a locally installed Smallstep step-ca instance using the local smime-issuer JWK provisioner. The actual signing command runs with step ca sign --offline.
The resulting certificate chains to the CryptoDakini Internet Privacy CA root through its local intermediate CA.
Issued certificates are configured with digitalSignature, nonRepudiation, keyEncipherment key usages; emailProtection, clientAuth extended key usages; and CA:FALSE basic constraints.
The browser key is ECDSA P-384. The exact certificate signature and remaining X.509 fields are determined by the installed step-ca configuration and profile at issuance time.
After issuance, the browser creates the PKCS#12 files locally from the browser-held private key, the issued certificate, and the CA chain. Two profiles are offered: a modern AES-256 protected P12 and a legacy iOS-oriented 3DES protected P12.
The P12 password format uses *secret password* + the 8 digits you choose. Those 8 digits are not sent to the server as part of the certificate request.
Verification state and enrollment tokens are kept in process memory and expire. The application does not use a database for enrollment state. The CA itself is local and uses step-ca's configured certificate authority state.
CryptoDakini's web application listens on 127.0.0.1:8080. step-ca listens on 127.0.0.1:9000. Caddy is expected to reverse-proxy to the web application; this installer does not modify an existing Caddy installation.
The service's documented password format is *secret password* + your 8 digits. For password information explicitly published by the creator, use the official CryptoDakini channel. The issuer does not recover your chosen digits from the server.
✦ PASSWORD / CREATOR · CRYPTODAKINI ✦