first build

README.md

@@ -0,0 +1,54 @@
+# Certificate Portal
+
+OIDC-authenticated web portal that issues a **user certificate** from Active Directory Certificate Services and delivers it as a **signed Apple `.mobileconfig`**.
+
+This is **Design B**: the portal talks to the CA itself. There is no NDES and no SCEP. The device never contacts AD CS.
+
+```
+Sign in (OIDC) → LDAP objectSid → RSA key + CSR in memory
+    → POST /certsrv/certfnsh.asp (NTLM) → PKCS#12 inside .mobileconfig
+    → CMS-sign the profile → download over HTTPS
+```
+
+## Tradeoff
+
+The **private key is generated on the server**, packed into a PKCS#12, and sent to the device. It is kept in memory only for that request and is not written to disk. That is commonly accepted for user Wi-Fi certificates. Do not use this portal for keys that must never leave the device (SCEP / on-device generation is a different design).
+
+## Documentation
+
+| Doc | Contents |
+| --- | --- |
+| [docs/architecture.md](docs/architecture.md) | Request flow, the two PKCS#12s, why phones never talk to the CA |
+| [docs/setup.md](docs/setup.md) | OIDC, LDAP, certsrv, TLS, Docker / `python -m cert_portal` |
+| [docs/adcs.md](docs/adcs.md) | Web Enrollment, template flags, SID URI / strong mapping |
+| [docs/profile-signing.md](docs/profile-signing.md) | Signing identity, device trust, CMS format |
+| [docs/security.md](docs/security.md) | Key lifetime, logging, sessions, who can download |
+| [.env.example](.env.example) | Every setting, commented |
+
+After sign-in, operators and users can also open **Help** in the app (`/help`) without cloning this repo.
+
+## Quick start
+
+1. Copy `.env.example` to `.env` and fill in OIDC, LDAP, certsrv, and the profile-signing PKCS#12 path.
+2. Python 3.12+: `pip install -e ".[dev]"` then `python -m cert_portal`
+3. Or: `docker build -t cert-portal .` and run with `--env-file .env`, publishing port 8000, mounting the signing P12.
+
+Put a reverse proxy in front for TLS. Set `PUBLIC_BASE_URL` and `OIDC_REDIRECT_URI` to that HTTPS origin (`/auth/callback`).
+
+## What you need on the Windows side
+
+- AD CS **Web Enrollment** (`https://ca.example.com/certsrv`) reachable from the Linux host
+- A template the portal service account can **Enroll**, with subject and SAN **supplied in the request**
+- A domain account for NTLM to certsrv (and a separate LDAP bind account, or the same one)
+- A certificate (and private key) used only to **sign** `.mobileconfig` files, already trusted on devices
+
+Details: [docs/adcs.md](docs/adcs.md) and [docs/profile-signing.md](docs/profile-signing.md).
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+```
+
+Tests mock the CA. They do not need live AD CS, LDAP, or an IdP.