Skip to content
Documentation
Getting Started

Getting Started

This guide takes you through a complete key ceremony end to end: install rite, run a real ceremony, and verify its transcript. It uses only the OpenSSL backend, so no hardware is required to follow along.

Install 

brew tap rite-ly/tap
brew install rite

Confirm the install:

rite version

Get a ceremony

Download the example ceremony used in the demo. It generates an offline root signing key, issues its self-signed certificate, and records a witness attestation.

curl -O https://raw.githubusercontent.com/rite-ly/rite/main/examples/showcase/demo.rite.yaml

The file is plain YAML. Roles, sections, steps, and attestations are all readable at a glance, and every run-specific value is declared explicitly.

Validate

Before running anything, check that the ceremony is well formed. rite check catches missing references, undefined roles, and schema errors.

rite check demo.rite.yaml

Prepare the printed script

rite script produces a printable HTML protocol that participants complete by hand during the ceremony, archived alongside the digital transcript.

rite script demo.rite.yaml   # writes demo.html

View a rendered sample script

Execute

rite run walks the operator and witness through each step in an interactive terminal, recording every action in an append-only transcript.

rite run demo.rite.yaml

Advance through the steps as prompted. The runtime generates the keypair, builds the certificate signing request, issues the certificate, and collects the attestations from each role. On completion it prints the transcript fingerprint and writes a timestamped output directory:

demo-root-signing-key-ceremony-20260705T142200
├── artifacts
│   ├── root_cert.pem
│   └── root_public_key.pem
└── transcript.jsonl

Artifacts are written as they are produced. The transcript records every step, role, attestation, and artifact hash.

Verify

This is what separates a ceremony from a checklist. rite verify confirms the transcript is internally consistent and has not been altered since the ceremony ran.

rite verify demo-root-signing-key-ceremony-*
The transcript is an append-only JSONL file. rite verify recomputes every recorded hash and checks the chain, then prints the transcript fingerprint. Compare it with the fingerprint the participants wrote on paper at the end of the ceremony: if they match, the transcript has not been edited since.

Want to try it without running the ceremony yourself? Download the sample transcript from a completed run and verify it: rite verify demo-transcript.jsonl.

Package the run as an evidence bundle, with the ceremony definition it ran from, and derive a public disclosure that withholds everything above the public level. Both verify to the same fingerprint:

rite bundle create demo-root-signing-key-ceremony-* --definition demo.rite.yaml -o demo-bundle
rite bundle disclose demo-bundle --level public -o demo-public
rite verify demo-public

Generate a human-readable audit document for stakeholders:

rite report demo-root-signing-key-ceremony-*   # writes report.html

View a rendered sample report

Next steps