Installation

Prerequisites

• Rust toolchain 1.75 or later (install via rustup)
• C compiler, linker, and pkg-config
• System development libraries (see below)

System packages

The workspace includes crates that link to system C libraries via FFI. All development headers must be installed before building.

Fedora / RHEL

sudo dnf install gcc make pkgconf-pkg-config clang \
    openssl-devel sqlite-devel krb5-devel \
    openldap-devel cyrus-sasl-devel

Fedora 42+ and RHEL 10+ ship OpenSSL 3.5.

Optional database backends:

sudo dnf install libpq-devel              # for --features backend-postgres
sudo dnf install mariadb-connector-c-devel # for --features backend-mariadb

Optional documentation tools:

sudo dnf install scdoc          # man page compilation from .scd sources
cargo install mdbook            # HTML documentation
cargo install mdbook-pandoc     # PDF documentation

Debian / Ubuntu

sudo apt install build-essential pkg-config clang \
    libssl-dev libsqlite3-dev libkrb5-dev \
    libldap2-dev libsasl2-dev

Ubuntu 25.04+ ships OpenSSL 3.5. On older releases (e.g. Ubuntu 24.04 with OpenSSL 3.0), the CLI works with classical key types but the server will fail at startup. Install OpenSSL 3.5 from source or from a PPA to run the server.

OpenSSL version requirements

Check your installed OpenSSL version:

openssl version

The output should show OpenSSL 3.5.0 or later for full server functionality.

Tip: On systems where the default openssl package is older than 3.5, you can build against a locally installed OpenSSL by setting NATIVE_OSSL_OPENSSL_SOURCES to the build directory (must contain include/ and libcrypto.a). See the native-ossl-sys build script for details.

Checking out the source

git clone <akamu-repo> akamu

All synta dependencies are fetched automatically from crates.io — no manual checkout required.

Building from source

The repository is a Cargo workspace with seven members: the akamu server binary, akamu-jose, akamu-client, akamu-cli, akamuctl, akamu-cosigner, and akamu-ldap (the OpenLDAP C-binding library, used by the server when reading profiles from LDAP).

cd akamu
cargo build --release

This compiles all seven workspace members. The binaries are placed at:

• target/release/akamu — the ACME server
• target/release/akamu-cli — the command-line client
• target/release/akamuctl — the admin CLI
• target/release/akamu-cosigner — the MTC cosigner daemon

To build only the server:

cargo build --bin akamu --release

To build only the CLI:

cargo build --bin akamu-cli --release

Note: The first build downloads and compiles all dependencies including bundled SQLite. It can take several minutes on a first run.

Verifying the build

./target/release/akamu --help

The binary accepts a single optional argument: the path to the configuration file (defaults to config.toml in the current directory).

Installing the binary

Copy the binary to a location in $PATH:

sudo install -m 0755 target/release/akamu /usr/local/bin/akamu

systemd service (optional)

Create /etc/systemd/system/akamu.service:

[Unit]
Description=ACME Certificate Server
After=network.target

[Service]
Type=simple
User=akamu
Group=akamu
ExecStart=/usr/local/bin/akamu /etc/akamu/config.toml
Restart=on-failure
RestartSec=5s

# Logging
StandardOutput=journal
StandardError=journal

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/var/lib/akamu /etc/akamu

[Install]
WantedBy=multi-user.target

Then enable and start:

sudo systemctl daemon-reload
sudo systemctl enable --now akamu

Running tests

cargo test

cargo test runs tests across all workspace members: the server, akamu-jose, and akamu-client. To limit the run to a specific crate:

cargo test -p akamu          # server tests only
cargo test -p akamu-jose     # JWK/JWS primitive tests
cargo test -p akamu-client   # ACME client library tests

All tests are self-contained and do not require external services. Some integration tests start local HTTP or TLS servers on ephemeral ports.

Demo prerequisites

The demo scripts under contrib/demo/ showcase different deployment scenarios. Each demo builds the required binaries automatically but needs certain system tools installed first.

All demos

Every demo requires the Rust toolchain and the system build packages listed above. They also need OpenSSL 3.5+ in the system PATH.

Per-demo requirements (Fedora)

Running a demo

cd /path/to/akamu
bash contrib/demo/mtc/run-demo.sh              # runs and exits
bash contrib/demo/mtc/run-demo.sh --interactive # keeps servers running

Each demo creates a temporary directory, starts services on non-privileged ports, and cleans up on exit or Ctrl-C. No root privileges are required (except for the Dogtag demo, which uses container images via podman).