Certdog Architecture
The certdog application is made up of the following main components:
The User Interface
A web based front end that allows for system configuration and the management of certificates (requesting, searching, revoking etc.)
It allows users and administrators to login and perform operations. Available operations are dependant on what privileges the logged in user has e.g. a standard user will not have any administrative (e.g. user management) operations available
The UI performs very little processing. All operations are handed off to the API making it a lightweight component. This this also means that everything that you can do via the UI can be done via the REST API
The REST API
This is available to all users who have a valid logon. That is, if they can authenticate to the UI they can make use of the REST API
Available operations can be viewed using the Swagger interface that can be accessed at this location:
https://[servername]/certdog/api/swagger-ui.html
E.g.
https://127.0.0.1/certdog/api/swagger-ui.html
If you wish to develop your own applications that make use of certdog features, you should develop against this API
The Database
Certdog uses a mongo database which offers speed and flexibility. For example, you may host your database locally (the default), on a separate server or in the cloud (MongoDB Atlas)
You can use a dedicated instance or use an existing instance you already have in place
If any other components are updated, there is usually no need to also update the database
There are several simple mechanisms for backing up the data
Sensitive data stored in the database is encrypted by the API service before being stored
The ADCS Agent
This is the component that interfaces with the Microsoft CA (Active Directory Certificate Services)
It communicates directly with the database to increase performance. This means that as soon as a request is placed, the database can push the request to the agent for immediate processing. The alternative would be to continually poll the API for requests, which would create additional overhead (due to the continual polling) and delays from requesting a certificate to it being returned
By default all communication between the components is protected via TLS