From 448ce05b3a347f935b0df3e8d5eda4ae36c4fd0c Mon Sep 17 00:00:00 2001
From: Slawomir Koszewski <slawek@koszewscy.waw.pl>
Date: Sun, 25 Oct 2026 23:03:03 +0100
Subject: [PATCH] fix: the PKI is kept in ou=pki of the router's directory
 instead of files under /etc/vpn-router/pki, and the router's site-to-site
 certificate names only the identities its connections present, and /ca/bundle
 gives the certificate bundle of a CA.

---
 ADR.md                                        |   54 +-
 README.md                                     |   55 +-
 debian-package/debian/changelog               |   24 +
 debian-package/src/usr/lib/vpn-router/setup   |   26 +-
 .../src/usr/lib/vpn-router/vpnrouter.py       |    4 +
 .../src/usr/lib/vpn-router/vpnrouter_ldap.py  |   59 +-
 .../src/usr/lib/vpn-router/vpnrouter_pki.py   | 1040 ++++++++++-------
 .../src/usr/lib/vpn-router/vpnrouter_users.py |   19 +-
 debian-package/src/usr/lib/vpn-router/web     |    6 +
 debian-package/src/usr/sbin/vpn-router-ca     |   18 +-
 10 files changed, 796 insertions(+), 509 deletions(-)

diff --git a/ADR.md b/ADR.md
index a6e250b..d5a39bb 100644
--- a/ADR.md
+++ b/ADR.md
@@ -152,8 +152,8 @@ Status: Accepted
 
 Context: Users are managed from the command line, by an operator at a terminal, and through
 `/users` of the web service, by the Router Manager. Both must apply the same rules to names,
-passwords and person attributes, and both change the directory and the PKI, whose state is one
-file, so two changes must not run at the same time. The web unit is sandboxed with
+passwords and person attributes, and both change the directory and the PKI, whose CRL numbers and
+CRLs two changes must not write at the same time. The web unit is sandboxed with
 `ProtectSystem=strict`.
 
 Decision: `vpnrouter_users.py` holds the user operations, the checks and a session that takes a
@@ -162,9 +162,9 @@ lock and the connection of the user manager account. The web service imports it
 the output, text for people and JSON with `--json`. The web unit allows writing the paths the
 operations need: `/run/vpn-router` for the lock, its `RuntimeDirectory`, which systemd creates
 before the service starts, also before setup has run, and keeps when it stops, as setup's state
-files are there too; `/etc/vpn-router/pki` for the certificates and the PKI's state, and
-`/etc/swanctl/x509crl`, `/etc/openvpn/server` and `/var/lib/vpn-router/pki-publish` for the
-CRLs a revocation signs. The PKI module, `vpnrouter_pki.py`, works the same way for `/ca`,
+files are there too, and `/etc/swanctl/x509crl`, `/etc/openvpn/server` and
+`/var/lib/vpn-router/pki-publish` for the copies of the CRLs a revocation signs; the PKI itself is
+in the directory (ADR-32). The PKI module, `vpnrouter_pki.py`, works the same way for `/ca`,
 `vpn-router-ca` and `vpn-router-setup`, and its lock is the users' lock, as adding and removing
 a user issue and revoke a certificate.
 
@@ -757,8 +757,8 @@ of common name and the subject alternative names a certificate may have; `vpn-se
 `vpn-user` are issued by the router only, so no certificate for another use comes from the P2S
 CA. The module `vpnrouter_pki.py`, with `python3-cryptography` from the Ubuntu archive, builds
 the keys, certificates, CSRs and CRLs in the processes that need them, as the user module does
-(ADR-6); the settings are the `pki` section of `vpn-router.json` and the state is
-`pki/state.json`. Keeping the root key off the router is recommended, not required: while it is
+(ADR-6); the settings are the `pki` section of `vpn-router.json`, and the CAs and the
+certificates are kept in the router's directory (ADR-32). Keeping the root key off the router is recommended, not required: while it is
 on the router a new issuing CA is signed at once, and while it is not the CA gets its key and a
 CSR, signed offline and imported with `vpn-router-ca` or `/ca`. The root key itself crosses
 neither the API nor the Manager. For a certificate of something other than the router, the router
@@ -808,14 +808,17 @@ secret to distribute. Azure's VPN gateway authenticates site-to-site connections
 keys only.
 
 Decision: A connection's `auth` is `psk`, the default, or `certificate`. With `certificate` the
-router presents one site-to-site certificate of its `s2s` CA, whose names are `wan.local_fqdn`,
-the public address and the internal address, so it fits every `local_id_mode`; the peer's
+router presents one site-to-site certificate of its `s2s` CA, whose names are `wan.local_fqdn` and
+the local identities the connections with `certificate` use, the public or the internal address of
+their `local_id_mode`, and no address no connection presents, such as an internal address the peers
+never see; the peer's
 certificate must name the connection's `id` and be issued by the router's `s2s` CA or, when the
 connection has `remote_ca`, by that CA, its PEM certificate kept in the connection and copied to
 `/etc/swanctl/x509ca/s2s-<name>.pem`. A peer without a PKI gets its certificate from the router.
 
 Consequences: The connection Azure's gateway needs stays `psk`, so the platform writes nothing
-new. The router's site-to-site certificate is issued again when an address it names changes. The
+new. The router's site-to-site certificate is issued again when the set of names it needs changes,
+such as when a connection's `local_id_mode` or its address changes. The
 router does not check a remote CA's revocations unless strongSwan can fetch the CRL its
 certificates name.
 
@@ -861,3 +864,34 @@ Manager shows which one is in effect.
 Consequences: The first setup run with HTTPS starts the installation and serves HTTPS on the run
 that follows it. The key of Caddy's repository is trusted as downloaded over HTTPS, the way Caddy's
 installation instructions do it. Going back to the archive's Caddy is a manual downgrade.
+
+## ADR-32: The PKI is kept in the router's directory
+
+Status: Accepted
+
+Context: The CAs, their keys and CRLs, the inventory of the certificates issued and their
+revocations, and the router's and the users' certificates and keys need a store. Files with a
+JSON state file cannot be searched, and are copied apart from the users the certificates belong
+to. The router runs slapd, which holds the users and is provisioned on every
+configured router (ADR-10), and PostgreSQL, which holds the refresh tokens and the metrics, may
+be another server (`web.database`) and is in a backup only with `backup.metrics`. RFC 4523
+defines `pkiCA` with `cACertificate` and `certificateRevocationList`, and `userCertificate`, which
+OpenLDAP's core schema includes.
+
+Decision: The PKI is held in `ou=pki` of the router's directory. A CA is an entry of the package's
+class `vpnRouterAuthority` with `cACertificate` and `certificateRevocationList`, its key, its CSR,
+its CRL number, the source of the root CRL and the time it was retired; a certificate is an entry
+of `vpnRouterCertificate` named by its serial number under its CA, with `userCertificate`, its
+kind, template, names, expiry and revocation, and the key of a router or user certificate. A
+user's certificate is also the `userCertificate` of the user's entry. An ACL lets no account read
+`vpnRouterPrivateKey`; only root, the database's root DN, does, through the local socket. A
+retired CA keeps its entry, renamed, so its certificates stay in the inventory. A root supplied
+from outside, by cloud-init or by hand, is placed as files before the first setup with a platform,
+which imports and removes them. strongSwan, OpenVPN, Caddy and the system's trust store read files,
+so setup and every revocation write them from the directory. Setup provisions the directory before
+the PKI; without the directory it leaves the PKI and its files as they are and configures the rest.
+
+Consequences: `slapcat` writes the users and the PKI into every backup in one consistent copy, and a
+restore brings both back together. The PKI depends on slapd, as the users already do, and not on
+PostgreSQL. The directory holds the CA keys, so it is as sensitive as the CA itself. The schema
+grows by the package's PKI attributes and classes, which setup adds to slapd's configuration.
diff --git a/README.md b/README.md
index f0ee508..4d57ebb 100644
--- a/README.md
+++ b/README.md
@@ -202,8 +202,9 @@ certificate; all such connections are written to `/etc/swanctl/conf.d/site-to-si
 Traffic from a connection's `local_cidrs` to its `cidrs` is not masqueraded.
 
 With `auth` `certificate`, the router authenticates with its site-to-site certificate, which the
-site-to-site issuing CA signs for `wan.local_fqdn`, the public address and the internal
-address, so it fits every `local_id_mode`. The peer's certificate must name `id` and be issued
+site-to-site issuing CA signs for `wan.local_fqdn` and for the public or the internal address
+that a connection with `auth` `certificate` uses as its identity (`local_id_mode` `public_ip` or
+`internal_ip`); it is issued again when that set of names changes. The peer's certificate must name `id` and be issued
 by the router's site-to-site CA, or by the CA of `remote_ca`. A peer with no PKI of its own gets
 its certificate from the router (template `site-to-site`, see Certificates), with the root and
 the site-to-site CA certificates as its trust anchors.
@@ -371,18 +372,27 @@ services - that is what `systemctl restart vpn-router-setup` adds.
 
 ## Certificates
 
-The router has a two-level certificate authority in `/etc/vpn-router/pki` (mode 0700), kept by
-`vpn-router-setup` and managed with `vpn-router-ca`, `vpn-router-user` and `/ca` of the status
-web service, which the Router Manager uses:
+The router has a two-level certificate authority, kept by `vpn-router-setup` and managed with
+`vpn-router-ca`, `vpn-router-user` and `/ca` of the status web service, which the Router Manager
+uses. It is held in `ou=pki,dc=vpn-router,dc=local` of the router's directory, next to the users:
 
 ```
-root/cert.pem  root/key.pem  root/crl.pem       the root CA; key.pem is absent while the root is offline
-ca/<name>/cert.pem  key.pem  crl.pem  csr.pem    an issuing CA; csr.pem while it waits for the offline root
-router/vpn-server_cert.pem  _key.pem              the router's VPN server certificate
-router/site-to-site_cert.pem  _key.pem            the router's site-to-site certificate
-users/<user>_cert.pem  _key.pem                   the users' certificates
-retired/<name>-<time>/                            the issuing CAs taken out of use
-state.json                                        the certificates issued, revocations and CRL numbers
+cn=root                       the root CA; without vpnRouterPrivateKey while the root is offline
+cn=<name>                     an issuing CA; with vpnRouterCertificateRequest while it waits for the offline root
+cn=<name>-<time>              an issuing CA taken out of use, with vpnRouterRetired
+serialNumber=<serial>,cn=<CA> a certificate the CA issued
+```
+
+A CA entry (class `vpnRouterAuthority`) has its certificate (`cACertificate;binary`), key, CRL
+(`certificateRevocationList;binary`) and CRL number. A certificate entry (class
+`vpnRouterCertificate`) has the certificate (`userCertificate;binary`), its kind (`ca`, `router`,
+`user` or `external`), template, names, expiry and revocation, and for the router's and the users'
+certificates the key. A user's certificate is also the `userCertificate` of the user's entry. No
+account of the directory reads a key (`vpnRouterPrivateKey`); only root does, through the local
+socket. `slapcat` writes the whole PKI into every backup with the users.
+
+```sh
+ldapsearch -Q -Y EXTERNAL -H ldapi:/// -b ou=pki,dc=vpn-router,dc=local -s one cn
 ```
 
 ### The CAs
@@ -403,8 +413,8 @@ The root signs the issuing CAs only (path length 1), and the issuing CAs sign th
 Once a platform is chosen, `vpn-router-setup` creates what is missing: the root when it has
 neither certificate nor key, each issuing CA, the router's certificates once `wan.local_fqdn` is
 set, and the CRLs. The names, lifetimes and key type of `pki` apply when something is created. An
-issuing CA removed from `pki.issuing_cas` is retired: its directory moves to `retired/` and its
-certificate is revoked on the root CRL. The router renews its own certificates when less than a
+issuing CA removed from `pki.issuing_cas` is retired: its entry is renamed `cn=<name>-<time>`,
+loses its key, and its certificate is revoked on the root CRL. The router renews its own certificates when less than a
 third of their lifetime is left, when the names they need change, or when their CA changes; a
 user's certificate is renewed by removing and adding the user.
 
@@ -541,9 +551,9 @@ vpn-router-ca root import-crl root.crl
 ```
 
 An existing root CA of your own is used by placing its certificate, and its key if the router may
-use it, before choosing the platform: `vpn-router-ca root import-cert root-cert.pem`, or the files
-`root/cert.pem` and `root/key.pem`. Without the key, the issuing CAs wait for their certificates
-as above.
+use it, as `/etc/vpn-router/pki/root/cert.pem` and `key.pem` before `vpn-router-setup` first runs
+with a platform, as cloud-init can. Setup imports them into the directory and removes the files.
+Without the key, the issuing CAs wait for their certificates as above.
 
 ### ACME server
 
@@ -623,7 +633,7 @@ it is added:
 
 - a VPN user, an `inetOrgPerson` with a first name, a last name and an e-mail address
   (`givenName`, `sn` and `mail`; `cn` is the first and the last name), and a client certificate
-  with the user name as its common name, in `/etc/vpn-router/pki/users`;
+  with the user name as its common name, the entry's `userCertificate`, whose key the PKI keeps;
 - a Manager-only account, an `account`, `simpleSecurityObject` and `vpnRouterAccount` with the
   name, the password and an optional e-mail address, for notifications: no names and no
   certificate, so no VPN access. It can sign in to `/auth` and, as a member of `admins`, manage
@@ -1061,6 +1071,7 @@ A change is made, checked and applied as for `/site-to-site`.
 | `POST /ca/certificates` | `{"ca", "template", "csr"}` | 201 and `{"serial", "certificate", "chain"}`, PEM |
 | `POST /ca/certificates` | `{"ca", "template", "subject", "sans", "password"}` | 201 and `{"serial", "pfx"}`, a PKCS#12 file in base64 |
 | `POST /ca/certificates/<serial>/revoke` | `{"reason"}`, optional | the certificate, with `reissue` for a router certificate |
+| `GET /ca/bundle/<name>` | | `{"name", "pem"}`: the certificates a client trusts the CA with, the root alone for `root`, the issuing CA followed by the root for an issuing CA |
 | `GET /ca/issuing/<name>/csr` | | `{"name", "csr", "extensions"}` of an issuing CA waiting for the offline root |
 | `PUT /ca/issuing/<name>/certificate` | `{"certificate"}`, PEM, signed by the root | `{"name", "subject", "expires"}` |
 | `PUT /ca/root/crl` | `{"crl"}`, PEM, signed by the root | `{"next_update"}` |
@@ -1266,12 +1277,12 @@ A backup holds the state that `vpn-router-setup` cannot make again:
 
 | Item | Content |
 |---|---|
-| `/etc/vpn-router` | `vpn-router.json`, the secrets, `rclone.conf`, and the PKI: the CAs, the root key while it is on the router, and the certificates of the router and the users |
+| `/etc/vpn-router` | `vpn-router.json`, the secrets and `rclone.conf` |
 | `/etc/wireguard` | The WireGuard keys and the peers |
 | `/etc/ufw`, `/etc/default/ufw` | The firewall rules |
 | `/etc/vpn-router-manager` | The Router Manager's settings, when it is installed |
 | `files/<path>` | Each `psk_file` outside `/etc/vpn-router` |
-| `ldap/vpn-router.ldif` | The user directory, written by `slapcat`: users, groups, service accounts, password hashes and TOTP secrets |
+| `ldap/vpn-router.ldif` | The user directory, written by `slapcat`: users, groups, service accounts, password hashes and TOTP secrets, and the PKI: the CAs and their keys, the root key while it is on the router, and the certificates issued, with the keys of the router's and the users' certificates |
 | `postgresql/vpn-router.dump` | With `backup.metrics`, the database of the metrics and the refresh tokens, written by `pg_dump -Fc` |
 | `manifest.json` | The host, the time, the version of the package, the schedule and the items |
 
@@ -1373,8 +1384,8 @@ file when the package created them, and Caddy's configuration `/etc/caddy/vpn-ro
 `/var/lib/caddy` belongs to the `caddy` package. It removes the backup timer's schedule, the
 record of the last backup, the published CA files, the copies of the ACME CAs in
 `/etc/caddy/vpn-router-pki` and OpenVPN's CA and CRL files. Caddy stays installed, and with it the
-source of Caddy's repository. Key material, users and backups are never deleted: `/etc/vpn-router/pki`,
-`/etc/vpn-router/ldap`, `/etc/vpn-router/rclone.conf`, the user directory in slapd, the WireGuard
+source of Caddy's repository. Key material, users and backups are never deleted:
+`/etc/vpn-router/ldap`, `/etc/vpn-router/rclone.conf`, the user directory in slapd with the PKI, the WireGuard
 key pair, everything under `/etc/swanctl`, the archives in `backup.path` and
 `/var/lib/vpn-router/backup/before-restore` are left alone.
 
diff --git a/debian-package/debian/changelog b/debian-package/debian/changelog
index 84bf00a..33f0e4b 100644
--- a/debian-package/debian/changelog
+++ b/debian-package/debian/changelog
@@ -1,3 +1,27 @@
+vpn-router (0.21.3-1) unstable; urgency=medium
+
+  fix: the PKI is kept in ou=pki of the router's directory instead of files under /etc/vpn-router/pki, and the router's site-to-site certificate names only the identities its connections present, and /ca/bundle gives the certificate bundle of a CA.
+
+  * The CAs with their certificates, keys, CSRs and CRLs, and every
+    certificate issued with its revocation, are entries of the
+    package's schema in ou=pki; a user's certificate is also the
+    userCertificate of the user's entry, and only root reads a key.
+  * slapcat puts the PKI into every backup with the users.
+  * A root CA supplied as /etc/vpn-router/pki/root/cert.pem and key.pem
+    before the first setup is imported into the directory, and the files
+    are removed; vpn-router-ca root import-cert is gone.
+  * Setup provisions the directory before the configuration; without it,
+    the PKI and its files are left as they are.
+  * The router's site-to-site certificate names wan.local_fqdn and the
+    public or internal address a connection with auth certificate uses
+    as its identity, not every address of the router, and is issued
+    again when those names change.
+  * GET /ca/bundle/<name> of the status web service answers the PEM
+    certificates a client trusts a CA with: the root alone, or an issuing
+    CA followed by the root.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sun, 01 Nov 2026 10:00:00 +0100
+
 vpn-router (0.21.2-1) unstable; urgency=medium
 
   fix: pki.root_key_warning silences the warning of vpn-router-ca status and /ca about the root key on the router.
diff --git a/debian-package/src/usr/lib/vpn-router/setup b/debian-package/src/usr/lib/vpn-router/setup
index 2159411..5b5fc03 100755
--- a/debian-package/src/usr/lib/vpn-router/setup
+++ b/debian-package/src/usr/lib/vpn-router/setup
@@ -577,7 +577,12 @@ def manage_caddy(cfg, ctx):
         group = grp.getgrnam(CADDY_GROUP).gr_gid
     except KeyError:
         fail(f'the group {CADDY_GROUP} does not exist; is the caddy package installed?')
-    acme = [name for name in ctx['pki_acme'] if vpnrouter_pki.ready(name)]
+    try:
+        credentials = {name: vpnrouter_pki.authority_files(name) for name in ctx['pki_acme']}
+    except ldap.LDAPError as exc:
+        warn(f'the ACME servers are left out: the PKI cannot be read: {exc}')
+        credentials = {}
+    acme = [name for name, files in credentials.items() if files is not None]
     copied = False
     for folder in (CADDY_PKI_DIR.iterdir() if CADDY_PKI_DIR.is_dir() else []):
         if folder.name not in acme:
@@ -587,8 +592,8 @@ def manage_caddy(cfg, ctx):
         for path in (CADDY_PKI_DIR, folder):
             path.mkdir(mode=0o750, exist_ok=True)
             os.chown(path, 0, group)
-        for file in ('cert.pem', 'key.pem'):
-            copied |= vpnrouter.install_file(vpnrouter_pki.CA_DIR / name / file, folder / file, 0o640)
+        for file, data in zip(('cert.pem', 'key.pem'), credentials[name]):
+            copied |= vpnrouter_pki.write(folder / file, data, 0o640)
             os.chown(folder / file, 0, group)
     authorities = vpnrouter.issuing_cas(cfg)
     caddy_ctx = dict(ctx, manager_port=manager_port() if MANAGER.exists() else 0,
@@ -739,14 +744,19 @@ def main():
     start_bootstrap()
     progress('running', 'configuration')
     cfg = vpnrouter.load_config()
-    ctx, changed = vpnrouter.configure(cfg)
-
-    if ctx is None:
+    if vpnrouter.deferred(cfg):
         print('vpn-router: platform is none, configuration deferred; '
               f'set general.platform in {vpnrouter.CONFIG_FILE}')
         progress('deferred', 'configuration', f'general.platform is none; set it in {vpnrouter.CONFIG_FILE}')
         return 0
 
+    # The directory holds the PKI, which the configuration needs; its problem ends setup only after every other step.
+    failed_step = 'user directory'
+    progress('running', failed_step)
+    problem = manage_directory()
+    progress('running', 'configuration')
+    ctx, changed = vpnrouter.configure(cfg)
+
     progress('running', 'routes')
     if vpnrouter.routing_ready(ctx):
         apply_routes(ctx)
@@ -778,10 +788,6 @@ def main():
     progress('running', 'WireGuard')
     manage_wireguard(ctx, changed)
 
-    # The tunnels are up before the directory and the admin, whose problem ends setup only after every other step.
-    failed_step = 'user directory'
-    progress('running', failed_step)
-    problem = manage_directory()
     if not problem:
         failed_step = 'Router Manager admin'
         progress('running', failed_step)
diff --git a/debian-package/src/usr/lib/vpn-router/vpnrouter.py b/debian-package/src/usr/lib/vpn-router/vpnrouter.py
index b827bb1..c2ab265 100644
--- a/debian-package/src/usr/lib/vpn-router/vpnrouter.py
+++ b/debian-package/src/usr/lib/vpn-router/vpnrouter.py
@@ -17,6 +17,7 @@ import tempfile
 import urllib.parse
 
 import jinja2
+import ldap
 
 LIB_DIR = pathlib.Path(__file__).resolve().parent
 if str(LIB_DIR) not in sys.path:
@@ -1011,6 +1012,7 @@ def configure(cfg=None, public_ip=None):
 
     changed = set()
 
+    # Without the directory, which holds the PKI, the copies of the last run stay and what needs none is configured.
     with vpnrouter_pki.locked():
         try:
             notices = vpnrouter_pki.provision(cfg, ctx)
@@ -1018,6 +1020,8 @@ def configure(cfg=None, public_ip=None):
                 changed.add('swanctl')
         except vpnrouter_pki.Failure as failure:
             fail(str(failure))
+        except ldap.LDAPError as exc:
+            notices = [f'the PKI is left as it is: the directory cannot be reached: {exc}']
     for notice in notices:
         warn(notice)
     # What needs the router's own certificates.
diff --git a/debian-package/src/usr/lib/vpn-router/vpnrouter_ldap.py b/debian-package/src/usr/lib/vpn-router/vpnrouter_ldap.py
index 05f756e..cdde4ab 100644
--- a/debian-package/src/usr/lib/vpn-router/vpnrouter_ldap.py
+++ b/debian-package/src/usr/lib/vpn-router/vpnrouter_ldap.py
@@ -11,6 +11,9 @@ The password policy locks an account for LOCKOUT_SECONDS after LOCKOUT_FAILURES
 a successful bind clears the count. slapd's otp overlay is configured on the database, so a
 bind of a user with a TOTP token takes the password followed by a current code.
 cn=totp,ou=policies holds the TOTP parameters the token of every user points to.
+
+ou=pki holds the router's PKI (vpnrouter_pki): an entry per CA, and under it an entry per
+certificate the CA issued. Private keys are readable by root alone, the database's root DN.
 """
 
 import os
@@ -29,6 +32,7 @@ USERS = f'ou=users,{BASE}'
 GROUPS = f'ou=groups,{BASE}'
 SERVICES = f'ou=services,{BASE}'
 POLICIES = f'ou=policies,{BASE}'
+PKI = f'ou=pki,{BASE}'
 DEFAULT_POLICY = f'cn=default,{POLICIES}'
 TOTP_PARAMS = f'cn=totp,{POLICIES}'
 MANAGER = f'cn=user-manager,{SERVICES}'
@@ -54,16 +58,43 @@ OVERLAYS = ('ppolicy', 'otp')
 #: under .1 and object classes under .2. vpnRouterAccount, auxiliary, adds properties of the
 #: package to a user of either kind: mail, for a Manager-only account, vpnRouterScope,
 #: authorization scopes, of which service marks a service account, and displayName and
-#: description, the labels of a service account.
+#: description, the labels of a service account. vpnRouterAuthority is a CA of the PKI: its
+#: certificate and CRL (cACertificate and certificateRevocationList of RFC 4523), its key, the
+#: CSR it waits with for the offline root, the number of its last CRL, where the CRL came from,
+#: and when it was retired. vpnRouterCertificate is a certificate a CA issued, named by its
+#: serial number: the certificate, the key the router keeps for its own and the users'
+#: certificates, its kind, template, names and expiry, and its revocation.
 SCHEMA_OID = '2.25.98477352595735834532404256531620013001'
 SCHEMA_NAME = 'vpn-router'
+_STRING = 'EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SINGLE-VALUE'
+_TIME = 'EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE'
+_OCTETS = 'EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE'
 SCHEMA_ATTRIBUTE_TYPES = (
     f"( {SCHEMA_OID}.1.1 NAME 'vpnRouterScope' DESC 'VPN router: an authorization scope of the account' "
     "EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )",
+    f"( {SCHEMA_OID}.1.2 NAME 'vpnRouterPrivateKey' DESC 'VPN router: a private key, PEM' {_OCTETS} )",
+    f"( {SCHEMA_OID}.1.3 NAME 'vpnRouterCertificateRequest' DESC 'VPN router: the CSR of a CA, PEM' {_OCTETS} )",
+    f"( {SCHEMA_OID}.1.4 NAME 'vpnRouterCRLNumber' DESC 'VPN router: the number of the last CRL of a CA' "
+    "EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )",
+    f"( {SCHEMA_OID}.1.5 NAME 'vpnRouterCRLSource' DESC 'VPN router: signed or uploaded, where the CRL of a CA came from' {_STRING} )",
+    f"( {SCHEMA_OID}.1.6 NAME 'vpnRouterRetired' DESC 'VPN router: when a CA was retired' {_TIME} )",
+    f"( {SCHEMA_OID}.1.7 NAME 'vpnRouterKind' DESC 'VPN router: ca, router, user or external, the kind of a certificate' {_STRING} )",
+    f"( {SCHEMA_OID}.1.8 NAME 'vpnRouterTemplate' DESC 'VPN router: the template of a certificate' {_STRING} )",
+    f"( {SCHEMA_OID}.1.9 NAME 'vpnRouterSubjectAltName' DESC 'VPN router: a subject alternative name of a certificate' "
+    "EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )",
+    f"( {SCHEMA_OID}.1.10 NAME 'vpnRouterNotAfter' DESC 'VPN router: when a certificate expires' {_TIME} )",
+    f"( {SCHEMA_OID}.1.11 NAME 'vpnRouterRevoked' DESC 'VPN router: when a certificate was revoked' {_TIME} )",
+    f"( {SCHEMA_OID}.1.12 NAME 'vpnRouterRevocationReason' DESC 'VPN router: why a certificate was revoked' {_STRING} )",
 )
 SCHEMA_OBJECT_CLASSES = (
     f"( {SCHEMA_OID}.2.1 NAME 'vpnRouterAccount' DESC 'VPN router: properties of a user or a Manager-only account' "
     "SUP top AUXILIARY MAY ( mail $ vpnRouterScope $ displayName $ description ) )",
+    f"( {SCHEMA_OID}.2.2 NAME 'vpnRouterAuthority' DESC 'VPN router: a CA of the PKI' SUP top STRUCTURAL MUST cn "
+    "MAY ( cACertificate $ certificateRevocationList $ vpnRouterPrivateKey $ vpnRouterCertificateRequest $ "
+    "vpnRouterCRLNumber $ vpnRouterCRLSource $ vpnRouterRetired ) )",
+    f"( {SCHEMA_OID}.2.3 NAME 'vpnRouterCertificate' DESC 'VPN router: a certificate a CA of the PKI issued' SUP top "
+    "STRUCTURAL MUST serialNumber MAY ( cn $ userCertificate $ vpnRouterPrivateKey $ vpnRouterKind $ vpnRouterTemplate $ "
+    "vpnRouterSubjectAltName $ vpnRouterNotAfter $ vpnRouterRevoked $ vpnRouterRevocationReason ) )",
 )
 
 #: The TOTP parameters: digits, the OID of HMAC-SHA1, seconds per time step, and the time steps accepted before and after now.
@@ -74,6 +105,7 @@ TOTP_WINDOW = 1
 
 #: The ACLs of the database, in order.
 ACCESS = (
+    'to attrs=vpnRouterPrivateKey by * none',
     f'to attrs=userPassword by dn.exact="{MANAGER}" =wx by self =wx by anonymous auth by * none',
     f'to attrs=oathSecret by dn.exact="{MANAGER}" =w by * none',
     f'to dn.subtree="{USERS}" by dn.exact="{MANAGER}" manage by * read',
@@ -126,20 +158,27 @@ def _ensure_modules(connection):
 
 
 def _ensure_schema(connection):
-    """Add the package's schema to cn=config when missing, else set its definitions that differ."""
+    """Add the package's schema to cn=config when missing, else add the definitions it lacks; a definition that differs
+    from the one of the same OID replaces the whole list of its kind."""
     found = connection.search_s('cn=schema,cn=config', ldap.SCOPE_ONELEVEL, f'(cn=*{SCHEMA_NAME})',
                                 ['olcAttributeTypes', 'olcObjectClasses'])
-    attributes = {'olcAttributeTypes': [value.encode() for value in SCHEMA_ATTRIBUTE_TYPES],
-                  'olcObjectClasses': [value.encode() for value in SCHEMA_OBJECT_CLASSES]}
+    attributes = {'olcAttributeTypes': list(SCHEMA_ATTRIBUTE_TYPES), 'olcObjectClasses': list(SCHEMA_OBJECT_CLASSES)}
     if not found:
         connection.add_s(f'cn={SCHEMA_NAME},cn=schema,cn=config', ldap.modlist.addModlist(
-            dict(attributes, objectClass=[b'olcSchemaConfig'], cn=[SCHEMA_NAME.encode()])))
+            dict({name: [value.encode() for value in values] for name, values in attributes.items()},
+                 objectClass=[b'olcSchemaConfig'], cn=[SCHEMA_NAME.encode()])))
         return
     dn, current = found[0]
-    changes = [(ldap.MOD_REPLACE, name, values) for name, values in attributes.items()
-               if unordered(current.get(name, [])) != [value.decode() for value in values]]
-    if changes:
-        connection.modify_s(dn, changes)
+    for name, wanted in attributes.items():
+        present = unordered(current.get(name, []))
+        oids = {value.split()[1] for value in present}
+        missing = [value for value in wanted if value not in present]
+        if not missing:
+            continue
+        if any(value.split()[1] in oids for value in missing):
+            connection.modify_s(dn, [(ldap.MOD_REPLACE, name, [value.encode() for value in wanted])])
+        else:
+            connection.modify_s(dn, [(ldap.MOD_ADD, name, [value.encode() for value in missing])])
 
 
 def _ensure_password_hash(connection):
@@ -230,7 +269,7 @@ def provision():
         database = _ensure_database(connection)
         _ensure_overlays(connection, database)
         _ensure_entry(connection, BASE, {'objectClass': [b'dcObject', b'organization'], 'dc': [b'vpn-router'], 'o': [b'vpn-router']})
-        for unit in (USERS, GROUPS, SERVICES, POLICIES):
+        for unit in (USERS, GROUPS, SERVICES, POLICIES, PKI):
             _ensure_entry(connection, unit, {'objectClass': [b'organizationalUnit'], 'ou': [unit.split(',')[0][3:].encode()]})
         _ensure_entry(connection, DEFAULT_POLICY, {
             'objectClass': [b'organizationalRole', b'pwdPolicy'],
diff --git a/debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py b/debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py
index a845868..9e01d4d 100644
--- a/debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py
+++ b/debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py
@@ -1,15 +1,22 @@
 """The router's PKI, for vpn-router-setup, the web service, vpn-router-ca and the user module.
 
-The root CA (ROOT_DIR) signs the issuing CAs, and only them: p2s, which signs the router's VPN server certificate and
-the users' certificates, s2s, which signs the router's site-to-site certificate and those of its peers, and the
-general-purpose CAs of pki.issuing_cas. Each CA is a directory with cert.pem, key.pem and crl.pem. While the root key is
-not on the router, a new issuing CA has key.pem and csr.pem and is pending until import_ca takes its certificate, signed
-offline. The router's own certificates are in ROUTER_DIR and the users' in USER_DIR, with their keys, which the OpenVPN
-profile embeds; a certificate issued for anything else is kept without its key. STATE records every certificate issued,
-its revocation, the CRL numbers, where the root CRL came from and the retired CAs.
+The root CA signs the issuing CAs, and only them: p2s, which signs the router's VPN server certificate and the users'
+certificates, s2s, which signs the router's site-to-site certificate and those of its peers, and the general-purpose
+CAs of pki.issuing_cas. The PKI is kept in ou=pki of the router's directory (vpnrouter_ldap), which root reaches through
+the local socket. Each CA is an entry cn=<name> of class vpnRouterAuthority, with its certificate, key, CRL and CRL
+number; while the root key is not on the router, a new issuing CA has its key and a CSR and is pending until import_ca
+takes its certificate, signed offline. Each certificate a CA issued is an entry serialNumber=<serial> of class
+vpnRouterCertificate under the CA, with its kind, template, names, expiry and revocation; the router's own certificates
+and the users' keep their keys there, as the router and the OpenVPN profile need them, and a certificate issued for
+anything else is kept without its key. A user's certificate is also the userCertificate of the user's entry. A retired
+CA keeps its entry, renamed cn=<name>-<time> and marked with vpnRouterRetired.
+
+An existing root CA is supplied by placing its certificate, and its key if the router may use it, in SEED_DIR before
+vpn-router-setup runs; provision imports them into the directory and removes the files.
 
 The certificates carry the URLs of pki.publish for their issuer's certificate (AIA) and CRL (CRL distribution point);
-PUBLISH_DIR holds the DER copies served there. distribute copies what strongSwan and OpenVPN read.
+PUBLISH_DIR holds the DER copies served there. distribute writes the files strongSwan, OpenVPN and the system's trust
+store read.
 
 Callers hold locked() around every operation that writes, which is the lock of the user module's sessions too. A request
 that cannot be done raises Failure, whose status says why: 2 the request is invalid, 3 something it names does not
@@ -21,7 +28,6 @@ import contextlib
 import datetime
 import fcntl
 import ipaddress
-import json
 import os
 import pathlib
 import re
@@ -29,6 +35,10 @@ import shutil
 import subprocess
 import tempfile
 
+import ldap
+import ldap.dn
+import ldap.filter
+import ldap.modlist
 from cryptography import x509
 from cryptography.exceptions import InvalidSignature
 from cryptography.hazmat.primitives import hashes, serialization
@@ -37,14 +47,10 @@ from cryptography.hazmat.primitives.serialization import pkcs12
 from cryptography.x509.oid import AuthorityInformationAccessOID, ExtendedKeyUsageOID, NameOID
 
 import vpnrouter
+import vpnrouter_ldap
 
-PKI_DIR     = pathlib.Path('/etc/vpn-router/pki')
-ROOT_DIR    = PKI_DIR / 'root'
-CA_DIR      = PKI_DIR / 'ca'
-ROUTER_DIR  = PKI_DIR / 'router'
-USER_DIR    = PKI_DIR / 'users'
-RETIRED_DIR = PKI_DIR / 'retired'
-STATE       = PKI_DIR / 'state.json'
+#: The certificate (cert.pem) and the key (key.pem) of an existing root CA, which provision imports and removes.
+SEED_DIR = pathlib.Path('/etc/vpn-router/pki/root')
 
 #: The DER copies of the CA certificates and CRLs, <name>.crt and <name>.crl, which the web service and Caddy serve.
 PUBLISH_DIR = pathlib.Path('/var/lib/vpn-router/pki-publish')
@@ -70,8 +76,18 @@ OPENVPN_CRL = pathlib.Path('/etc/openvpn/server/vpn-router-crl.pem')
 #: The root CA in the system's trust store.
 TRUST_ANCHOR = pathlib.Path('/usr/local/share/ca-certificates/vpn-router-ca.crt')
 
-#: The router's own certificates: name -> the issuing CA and the template.
+#: The router's own certificates: name -> the issuing CA and the template, and the files strongSwan reads.
 ROUTER_CERTS = {'vpn-server': ('p2s', 'vpn-server'), 'site-to-site': ('s2s', 'site-to-site')}
+ROUTER_FILES = {'vpn-server': (VPN_SERVER_CERT, VPN_SERVER_KEY), 'site-to-site': (S2S_CERT, S2S_KEY)}
+
+#: The attributes of a CA's entry and of a certificate's entry.
+AUTHORITY_ATTRIBUTES = ['cACertificate;binary', 'certificateRevocationList;binary', 'vpnRouterPrivateKey',
+                        'vpnRouterCertificateRequest', 'vpnRouterCRLNumber', 'vpnRouterCRLSource', 'vpnRouterRetired']
+CERTIFICATE_ATTRIBUTES = ['serialNumber', 'cn', 'vpnRouterKind', 'vpnRouterTemplate', 'vpnRouterSubjectAltName',
+                          'vpnRouterNotAfter', 'vpnRouterRevoked', 'vpnRouterRevocationReason', 'createTimestamp']
+
+#: The suffix of a retired CA's name: -<time of the retirement>.
+RETIRED_SUFFIX = re.compile(r'-\d{14}$')
 
 #: The extended key usages of vpnrouter.EXTENDED_KEY_USAGES.
 EKU_OIDS = {
@@ -121,6 +137,16 @@ def locked():
         yield
 
 
+@contextlib.contextmanager
+def directory():
+    """A connection to the router's directory as root, closed at the end."""
+    connection = vpnrouter_ldap.root()
+    try:
+        yield connection
+    finally:
+        connection.unbind_s()
+
+
 def now():
     return datetime.datetime.now(datetime.timezone.utc).replace(microsecond=0)
 
@@ -129,8 +155,16 @@ def iso(moment):
     return moment.astimezone(datetime.timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ')
 
 
-def parse_iso(text):
-    return datetime.datetime.strptime(text, '%Y-%m-%dT%H:%M:%SZ').replace(tzinfo=datetime.timezone.utc)
+def generalized(moment):
+    """A time as LDAP's GeneralizedTime, in UTC."""
+    return moment.astimezone(datetime.timezone.utc).strftime('%Y%m%d%H%M%SZ').encode()
+
+
+def from_generalized(value):
+    """A GeneralizedTime value as an ISO 8601 UTC string, None for none."""
+    if not value:
+        return None
+    return iso(datetime.datetime.strptime(value[:14].decode(), '%Y%m%d%H%M%S').replace(tzinfo=datetime.timezone.utc))
 
 
 def utc(item, name):
@@ -141,27 +175,14 @@ def utc(item, name):
     return value.replace(tzinfo=datetime.timezone.utc) if value is not None else None
 
 
-def directory(name):
-    """The directory of the root (root) or of an issuing CA."""
-    return ROOT_DIR if name == 'root' else CA_DIR / name
-
-
-def read_cert(path):
-    return x509.load_pem_x509_certificate(path.read_bytes()) if path.is_file() else None
-
-
-def read_key(path):
-    return serialization.load_pem_private_key(path.read_bytes(), None) if path.is_file() else None
-
-
-def read_crl(path):
-    return x509.load_pem_x509_crl(path.read_bytes()) if path.is_file() else None
-
-
 def cert_pem(cert):
     return cert.public_bytes(serialization.Encoding.PEM)
 
 
+def cert_der(cert):
+    return cert.public_bytes(serialization.Encoding.DER)
+
+
 def key_pem(key, password=None):
     encryption = serialization.BestAvailableEncryption(password) if password else serialization.NoEncryption()
     return key.private_bytes(serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8, encryption)
@@ -172,7 +193,7 @@ def write(path, data, mode):
     if path.is_file() and path.read_bytes() == data:
         os.chmod(path, mode)
         return False
-    path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+    path.parent.mkdir(mode=0o755, parents=True, exist_ok=True)
     descriptor, name = tempfile.mkstemp(dir=path.parent, prefix=f'.{path.name}.')
     try:
         with os.fdopen(descriptor, 'wb') as handle:
@@ -193,20 +214,119 @@ def remove(path):
     return False
 
 
-def read_state():
+def first(attributes, name):
+    values = attributes.get(name)
+    return values[0] if values else None
+
+
+def authority_dn(name):
+    return f'cn={ldap.dn.escape_dn_chars(name)},{vpnrouter_ldap.PKI}'
+
+
+def authority(connection, name):
+    """The entry of a CA: {name, cert, key, csr (PEM), crl, crl_number, crl_source, retired}, None when there is none."""
     try:
-        state = json.loads(STATE.read_text(encoding='utf-8'))
-    except FileNotFoundError:
-        state = {}
-    state.setdefault('certificates', [])
-    state.setdefault('crl_numbers', {})
-    state.setdefault('retired', [])
-    state.setdefault('root_crl', None)
-    return state
+        attributes = connection.search_s(authority_dn(name), ldap.SCOPE_BASE, attrlist=AUTHORITY_ATTRIBUTES)[0][1]
+    except ldap.NO_SUCH_OBJECT:
+        return None
+    cert, key, crl = (first(attributes, item) for item in AUTHORITY_ATTRIBUTES[:3])
+    return {
+        'name': name,
+        'cert': x509.load_der_x509_certificate(cert) if cert else None,
+        'key': serialization.load_pem_private_key(key, None) if key else None,
+        'csr': first(attributes, 'vpnRouterCertificateRequest'),
+        'crl': x509.load_der_x509_crl(crl) if crl else None,
+        'crl_number': int(first(attributes, 'vpnRouterCRLNumber') or 0),
+        'crl_source': (first(attributes, 'vpnRouterCRLSource') or b'').decode() or None,
+        'retired': from_generalized(first(attributes, 'vpnRouterRetired')),
+    }
 
 
-def write_state(state):
-    write(STATE, (json.dumps(state, indent=2) + '\n').encode(), 0o600)
+def update(connection, name, values):
+    """Set attributes of a CA's entry, adding the entry when it is missing; a value None removes its attribute."""
+    dn = authority_dn(name)
+    try:
+        connection.search_s(dn, ldap.SCOPE_BASE, attrlist=['1.1'])
+    except ldap.NO_SUCH_OBJECT:
+        connection.add_s(dn, ldap.modlist.addModlist({
+            'objectClass': [b'vpnRouterAuthority'], 'cn': [name.encode()],
+            **{attribute: [value] for attribute, value in values.items() if value is not None}}))
+        return
+    connection.modify_s(dn, [(ldap.MOD_REPLACE, attribute, [value] if value is not None else [])
+                             for attribute, value in values.items()])
+
+
+def issuing(connection):
+    """The names of the issuing CAs in the directory that are not retired, sorted."""
+    found = connection.search_s(vpnrouter_ldap.PKI, ldap.SCOPE_ONELEVEL,
+                                '(&(objectClass=vpnRouterAuthority)(!(vpnRouterRetired=*))(!(cn=root)))', ['cn'])
+    return sorted(attributes['cn'][0].decode() for _, attributes in found)
+
+
+def certificate_entry(dn, attributes):
+    """A certificate's entry as the answers show it: serial, ca, kind, template, subject, sans, created, expires,
+    revoked and reason."""
+    def value(name):
+        return (first(attributes, name) or b'').decode() or None
+
+    return {
+        'serial': value('serialNumber'), 'ca': ldap.dn.str2dn(dn)[1][0][1], 'kind': value('vpnRouterKind'),
+        'template': value('vpnRouterTemplate'), 'subject': value('cn') or '',
+        'sans': [item.decode() for item in attributes.get('vpnRouterSubjectAltName', [])],
+        'created': from_generalized(first(attributes, 'createTimestamp')),
+        'expires': from_generalized(first(attributes, 'vpnRouterNotAfter')),
+        'revoked': from_generalized(first(attributes, 'vpnRouterRevoked')), 'reason': value('vpnRouterRevocationReason'),
+        'dn': dn,
+    }
+
+
+def certificate_entries(connection, base, condition=''):
+    """The certificates' entries under base that match the LDAP condition, newest first."""
+    found = connection.search_s(base, ldap.SCOPE_SUBTREE, f'(&(objectClass=vpnRouterCertificate){condition})',
+                                CERTIFICATE_ATTRIBUTES)
+    return sorted((certificate_entry(dn, attributes) for dn, attributes in found),
+                  key=lambda entry: entry['created'] or '', reverse=True)
+
+
+def record(connection, cert, ca, kind, template=None, key=None):
+    """Add a certificate the CA issued: kind is ca, router, user or external; key is kept for router and user."""
+    serial = f'{cert.serial_number:X}'
+    attributes = {
+        'objectClass': [b'vpnRouterCertificate'], 'serialNumber': [serial.encode()], 'cn': [common_name(cert).encode()],
+        'userCertificate;binary': [cert_der(cert)], 'vpnRouterKind': [kind.encode()],
+        'vpnRouterNotAfter': [generalized(utc(cert, 'not_valid_after'))],
+    }
+    if template:
+        attributes['vpnRouterTemplate'] = [template.encode()]
+    if san_values(cert):
+        attributes['vpnRouterSubjectAltName'] = [value.encode() for value in san_values(cert)]
+    if key is not None:
+        attributes['vpnRouterPrivateKey'] = [key_pem(key)]
+    connection.add_s(f'serialNumber={serial},{authority_dn(ca)}', ldap.modlist.addModlist(attributes))
+
+
+def holders(connection, ca, condition):
+    """The certificates of the CA that match the LDAP condition and have their key, not revoked, newest first: [(dn,
+    cert, key)]."""
+    found = connection.search_s(
+        authority_dn(ca), ldap.SCOPE_ONELEVEL,
+        f'(&(objectClass=vpnRouterCertificate)(vpnRouterPrivateKey=*)(!(vpnRouterRevoked=*)){condition})',
+        ['userCertificate;binary', 'vpnRouterPrivateKey'])
+    pairs = [(dn, x509.load_der_x509_certificate(attributes['userCertificate;binary'][0]),
+              serialization.load_pem_private_key(attributes['vpnRouterPrivateKey'][0], None)) for dn, attributes in found]
+    return sorted(pairs, key=lambda pair: utc(pair[1], 'not_valid_after'), reverse=True)
+
+
+def router_condition(name):
+    return f'(vpnRouterKind=router)(vpnRouterTemplate={ROUTER_CERTS[name][1]})'
+
+
+def user_condition(name):
+    return f'(vpnRouterKind=user)(cn={ldap.filter.escape_filter_chars(name)})'
+
+
+def drop_key(connection, dn):
+    connection.modify_s(dn, [(ldap.MOD_REPLACE, 'vpnRouterPrivateKey', [])])
 
 
 def new_key(kind):
@@ -239,9 +359,9 @@ def san_values(item):
             [f'email:{value}' for value in names.get_values_for_type(x509.RFC822Name)])
 
 
-def same_key(first, second):
+def same_key(one, other):
     der = serialization.Encoding.DER, serialization.PublicFormat.SubjectPublicKeyInfo
-    return first.public_bytes(*der) == second.public_bytes(*der)
+    return one.public_bytes(*der) == other.public_bytes(*der)
 
 
 def issued_by(cert, issuer):
@@ -363,21 +483,12 @@ def check_subject(kind, subject):
     return subject.lower() if kind == 'dns' else subject
 
 
-def record(state, cert, ca, kind, template=None):
-    """Add a certificate to the state: kind is ca, router, user or external."""
-    state['certificates'].append({
-        'serial': f'{cert.serial_number:X}', 'ca': ca, 'kind': kind, 'template': template,
-        'subject': common_name(cert), 'sans': san_values(cert), 'created': iso(now()),
-        'expires': iso(utc(cert, 'not_valid_after')), 'revoked': None, 'reason': None,
-    })
-
-
-def sign_crl(cfg, name, state):
+def sign_crl(connection, cfg, name):
     """Sign a new CRL of the CA with the certificates it revoked that have not expired, valid for pki.root_crl_days for
     the root and pki.crl_days for an issuing CA."""
-    folder = directory(name)
-    cert, key = read_cert(folder / 'cert.pem'), read_key(folder / 'key.pem')
-    number = state['crl_numbers'].get(name, 0) + 1
+    entry = authority(connection, name)
+    cert, key = entry['cert'], entry['key']
+    number = entry['crl_number'] + 1
     moment = now()
     days = cfg['pki']['root_crl_days'] if name == 'root' else cfg['pki']['crl_days']
     builder = (x509.CertificateRevocationListBuilder()
@@ -386,48 +497,43 @@ def sign_crl(cfg, name, state):
                .next_update(moment + datetime.timedelta(days=days))
                .add_extension(x509.CRLNumber(number), False)
                .add_extension(authority_key_id(cert), False))
-    for entry in state['certificates']:
-        if entry['ca'] == name and entry['revoked'] and entry['expires'] > iso(moment):
-            revoked = (x509.RevokedCertificateBuilder()
-                       .serial_number(int(entry['serial'], 16))
-                       .revocation_date(parse_iso(entry['revoked'])))
-            if entry['reason'] and entry['reason'] != 'unspecified':
-                revoked = revoked.add_extension(x509.CRLReason(x509.ReasonFlags[entry['reason']]), False)
-            builder = builder.add_revoked_certificate(revoked.build())
+    for revoked_entry in certificate_entries(connection, authority_dn(name), '(vpnRouterRevoked=*)'):
+        if revoked_entry['expires'] and revoked_entry['expires'] <= iso(moment):
+            continue
+        revoked = (x509.RevokedCertificateBuilder()
+                   .serial_number(int(revoked_entry['serial'], 16))
+                   .revocation_date(datetime.datetime.strptime(revoked_entry['revoked'], '%Y-%m-%dT%H:%M:%SZ')
+                                    .replace(tzinfo=datetime.timezone.utc)))
+        if revoked_entry['reason'] and revoked_entry['reason'] != 'unspecified':
+            revoked = revoked.add_extension(x509.CRLReason(x509.ReasonFlags[revoked_entry['reason']]), False)
+        builder = builder.add_revoked_certificate(revoked.build())
     crl = builder.sign(key, digest(key))
-    state['crl_numbers'][name] = number
-    if name == 'root':
-        state['root_crl'] = 'signed'
-    write(folder / 'crl.pem', crl.public_bytes(serialization.Encoding.PEM), 0o644)
+    update(connection, name, {'certificateRevocationList;binary': crl.public_bytes(serialization.Encoding.DER),
+                              'vpnRouterCRLNumber': str(number).encode(),
+                              **({'vpnRouterCRLSource': b'signed'} if name == 'root' else {})})
 
 
-def crl_stale(path):
+def crl_stale(crl):
     """Whether the CRL is missing or past half of its validity."""
-    crl = read_crl(path)
     if crl is None:
         return True
     last, following = utc(crl, 'last_update'), utc(crl, 'next_update')
     return following is None or now() >= last + (following - last) / 2
 
 
-def active():
-    """The names of the issuing CAs with a certificate, sorted."""
-    return sorted(folder.name for folder in CA_DIR.iterdir() if (folder / 'cert.pem').is_file()) \
-        if CA_DIR.is_dir() else []
-
-
 def ready(name):
     """Whether the issuing CA has its certificate and key, and so issues certificates."""
-    return (CA_DIR / name / 'cert.pem').is_file() and (CA_DIR / name / 'key.pem').is_file()
+    with directory() as connection:
+        entry = authority(connection, name)
+    return bool(entry and entry['cert'] and entry['key'] and not entry['retired'])
 
 
-def refresh_crls(cfg, state, force=()):
+def refresh_crls(connection, cfg, force=()):
     """Sign a new CRL for each CA with its key on the router whose CRL is stale, or that force names."""
-    for name in ['root', *active()]:
-        folder = directory(name)
-        if (folder / 'key.pem').is_file() and (folder / 'cert.pem').is_file() and \
-                (name in force or crl_stale(folder / 'crl.pem')):
-            sign_crl(cfg, name, state)
+    for name in ['root', *issuing(connection)]:
+        entry = authority(connection, name)
+        if entry and entry['key'] and entry['cert'] and (name in force or crl_stale(entry['crl'])):
+            sign_crl(connection, cfg, name)
 
 
 def renewal_due(cert):
@@ -436,38 +542,6 @@ def renewal_due(cert):
     return now() >= end - (end - start) / 3
 
 
-def router_identities(name, ctx):
-    """The common name and the subject alternative names of one of the router's certificates (ROUTER_CERTS)."""
-    fqdn = ctx['local_fqdn']
-    if name == 'vpn-server':
-        return fqdn, [fqdn]
-    return fqdn, [value for value in (fqdn, ctx['public_ip'], ctx['int_addr']) if value]
-
-
-def ensure_router_cert(cfg, ctx, state, name, urls):
-    """Issue one of the router's certificates when it is missing, due for renewal, not issued by its CA's current key,
-    named differently or without one of the names it needs; True when it was issued."""
-    ca, template_name = ROUTER_CERTS[name]
-    issuer, issuer_key = read_cert(CA_DIR / ca / 'cert.pem'), read_key(CA_DIR / ca / 'key.pem')
-    subject, sans = router_identities(name, ctx)
-    if issuer is None or issuer_key is None or not subject:
-        return False
-    cert_path, key_path = ROUTER_DIR / f'{name}_cert.pem', ROUTER_DIR / f'{name}_key.pem'
-    cert = read_cert(cert_path)
-    wanted = {f'IP:{value}' if is_address(value) else f'DNS:{value.lower()}' for value in sans}
-    if cert is not None and key_path.is_file() and not renewal_due(cert) and issued_by(cert, issuer) and \
-            common_name(cert) == subject and wanted <= set(san_values(cert)):
-        return False
-    template = vpnrouter.pki_templates(cfg)[template_name]
-    key = new_key(template['key'])
-    cert = sign(subject, key.public_key(), issuer, issuer_key, template['days'],
-                leaf_extensions(template, general_names(sans, vpnrouter.SAN_TYPES)), urls, ca)
-    write(key_path, key_pem(key), 0o600)
-    write(cert_path, cert_pem(cert), 0o644)
-    record(state, cert, ca, 'router', template_name)
-    return True
-
-
 def is_address(value):
     try:
         ipaddress.ip_address(value)
@@ -476,97 +550,162 @@ def is_address(value):
     return True
 
 
+def router_identities(name, ctx):
+    """The common name and the subject alternative names of one of the router's certificates (ROUTER_CERTS): the VPN
+    server certificate names wan.local_fqdn, and the site-to-site certificate also the local identity of each
+    site_to_site connection with certificate authentication, the public or the internal address of its
+    local_id_mode; None while such an identity is not known yet."""
+    fqdn = ctx['local_fqdn']
+    if name == 'vpn-server':
+        return fqdn, [fqdn]
+    names = [fqdn]
+    for connection in ctx['connections']:
+        if connection['auth'] != 'certificate' or connection['local_id_mode'] == 'fqdn':
+            continue
+        if not connection['local_id']:
+            return None
+        if connection['local_id'] not in names:
+            names.append(connection['local_id'])
+    return fqdn, names
+
+
+def ensure_router_cert(connection, cfg, ctx, name, urls):
+    """Issue one of the router's certificates when it has none, or its current one is due for renewal, not issued by
+    its CA's current key, or named otherwise than router_identities says; the older ones lose their keys. Nothing is
+    issued while an identity it needs is not known yet."""
+    ca, template_name = ROUTER_CERTS[name]
+    issuer = authority(connection, ca)
+    identities = router_identities(name, ctx)
+    if not issuer or issuer['cert'] is None or issuer['key'] is None or identities is None or not identities[0]:
+        return
+    subject, sans = identities
+    current = holders(connection, ca, router_condition(name))
+    wanted = {f'IP:{value}' if is_address(value) else f'DNS:{value.lower()}' for value in sans}
+    if current:
+        _, cert, _ = current[0]
+        if not renewal_due(cert) and issued_by(cert, issuer['cert']) and common_name(cert) == subject and \
+                wanted == set(san_values(cert)):
+            return
+    template = vpnrouter.pki_templates(cfg)[template_name]
+    key = new_key(template['key'])
+    cert = sign(subject, key.public_key(), issuer['cert'], issuer['key'], template['days'],
+                leaf_extensions(template, general_names(sans, vpnrouter.SAN_TYPES)), urls, ca)
+    record(connection, cert, ca, 'router', template_name, key)
+    for dn, _, _ in current:
+        drop_key(connection, dn)
+
+
+def import_seed(connection):
+    """Import the root CA of SEED_DIR into the directory, and remove the files; False when there is none."""
+    cert_file, key_file = SEED_DIR / 'cert.pem', SEED_DIR / 'key.pem'
+    if not cert_file.is_file():
+        if key_file.is_file():
+            raise Failure(f'{key_file} has no certificate; place cert.pem beside it')
+        return False
+    cert = x509.load_pem_x509_certificate(cert_file.read_bytes())
+    key = serialization.load_pem_private_key(key_file.read_bytes(), None) if key_file.is_file() else None
+    if not is_ca(cert):
+        raise Failure(f'{cert_file} is not a CA certificate')
+    if key is not None and not same_key(key.public_key(), cert.public_key()):
+        raise Failure(f'{key_file} is not the key of {cert_file}')
+    update(connection, 'root', {'cACertificate;binary': cert_der(cert), 'vpnRouterPrivateKey': key_pem(key) if key else None})
+    for path in (key_file, cert_file):
+        remove(path)
+    for folder in (SEED_DIR, SEED_DIR.parent):
+        with contextlib.suppress(OSError):
+            folder.rmdir()
+    return True
+
+
 def provision(cfg, ctx):
     """Create what the configuration needs and is missing, and keep it current; the notices to report.
 
-    The root is created when it has neither certificate nor key. Each issuing CA without a certificate is signed by
-    the root key, or, while the root key is not on the router, gets its key and a CSR and is pending. An issuing CA
-    that pki.issuing_cas no longer names is retired: its directory moves to RETIRED_DIR, and its certificate is revoked
-    on the root CRL. Stale CRLs are signed again, the router's certificates issued or renewed (ensure_router_cert), and
-    the copies of PUBLISH_DIR written.
+    The root is imported from SEED_DIR, or created when it has neither certificate nor seed. Each issuing CA without a
+    certificate is signed by the root key, or, while the root key is not on the router, gets its key and a CSR and is
+    pending. An issuing CA that pki.issuing_cas no longer names is retired, and its certificate revoked on the root CRL.
+    Stale CRLs are signed again, the router's certificates issued or renewed (ensure_router_cert), and the copies of
+    PUBLISH_DIR written.
     """
-    for folder in (PKI_DIR, CA_DIR, ROUTER_DIR, USER_DIR):
-        folder.mkdir(mode=0o700, parents=True, exist_ok=True)
-        os.chmod(folder, 0o700)
     pki = cfg['pki']
-    state = read_state()
     urls = vpnrouter.pki_base_urls(cfg)
     notices = []
+    with directory() as connection:
+        root = authority(connection, 'root')
+        if root is None or root['cert'] is None:
+            if root is not None and root['key'] is not None:
+                raise Failure('the root has a key but no certificate')
+            if not import_seed(connection):
+                root_key = new_key(pki['key'])
+                root_cert = sign(pki['root_name'], root_key.public_key(), None, root_key, pki['root_days'], ca_extensions(1))
+                update(connection, 'root', {'cACertificate;binary': cert_der(root_cert), 'vpnRouterPrivateKey': key_pem(root_key)})
+            root = authority(connection, 'root')
+        root_cert, root_key = root['cert'], root['key']
 
-    root_cert, root_key = read_cert(ROOT_DIR / 'cert.pem'), read_key(ROOT_DIR / 'key.pem')
-    if root_cert is None:
-        if root_key is not None:
-            raise Failure(f'{ROOT_DIR / "key.pem"} has no certificate; place root/cert.pem beside it')
-        root_key = new_key(pki['key'])
-        root_cert = sign(pki['root_name'], root_key.public_key(), None, root_key, pki['root_days'], ca_extensions(1))
-        write(ROOT_DIR / 'key.pem', key_pem(root_key), 0o600)
-        write(ROOT_DIR / 'cert.pem', cert_pem(root_cert), 0o644)
+        authorities = vpnrouter.issuing_cas(cfg)
+        force = set()
+        for name, settings in authorities.items():
+            entry = authority(connection, name)
+            if entry is not None and entry['cert'] is not None:
+                continue
+            key = entry['key'] if entry is not None and entry['key'] is not None else None
+            if key is None:
+                key = new_key(pki['key'])
+                update(connection, name, {'vpnRouterPrivateKey': key_pem(key)})
+            if root_key is not None:
+                cert = sign(settings['name'].strip(), key.public_key(), root_cert, root_key, pki['ca_days'],
+                            ca_extensions(0), urls, 'root')
+                update(connection, name, {'cACertificate;binary': cert_der(cert), 'vpnRouterCertificateRequest': None})
+                record(connection, cert, 'root', 'ca')
+                force.add(name)
+                continue
+            if entry is None or entry['csr'] is None:
+                request = (x509.CertificateSigningRequestBuilder()
+                           .subject_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, settings['name'].strip())]))
+                           .add_extension(x509.BasicConstraints(ca=True, path_length=0), True)
+                           .add_extension(CA_USAGE, True)
+                           .sign(key, digest(key)))
+                update(connection, name, {'vpnRouterCertificateRequest': request.public_bytes(serialization.Encoding.PEM)})
+            notices.append(f'issuing CA {name} waits for its certificate: sign its CSR (vpn-router-ca ca csr {name}) with '
+                           f'the root CA and import it with vpn-router-ca ca import {name}')
 
-    authorities = vpnrouter.issuing_cas(cfg)
-    force = set()
-    for name, authority in authorities.items():
-        folder = CA_DIR / name
-        if (folder / 'cert.pem').is_file():
-            continue
-        key = read_key(folder / 'key.pem')
-        if key is None:
-            key = new_key(pki['key'])
-            write(folder / 'key.pem', key_pem(key), 0o600)
-        if root_key is not None:
-            cert = sign(authority['name'].strip(), key.public_key(), root_cert, root_key, pki['ca_days'],
-                        ca_extensions(0), urls, 'root')
-            write(folder / 'cert.pem', cert_pem(cert), 0o644)
-            remove(folder / 'csr.pem')
-            record(state, cert, 'root', 'ca')
-            force.add(name)
-            continue
-        if not (folder / 'csr.pem').is_file():
-            request = (x509.CertificateSigningRequestBuilder()
-                       .subject_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, authority['name'].strip())]))
-                       .add_extension(x509.BasicConstraints(ca=True, path_length=0), True)
-                       .add_extension(CA_USAGE, True)
-                       .sign(key, digest(key)))
-            write(folder / 'csr.pem', request.public_bytes(serialization.Encoding.PEM), 0o644)
-        notices.append(f'issuing CA {name} waits for its certificate: sign {folder / "csr.pem"} with the root CA and '
-                       f'import it with vpn-router-ca ca import {name}')
+        for name in issuing(connection):
+            if name in authorities:
+                continue
+            entry = authority(connection, name)
+            moment = now()
+            if entry['cert'] is not None:
+                serial = f'{entry["cert"].serial_number:X}'
+                for revoked in certificate_entries(connection, authority_dn('root'),
+                                                   f'(serialNumber={serial})(!(vpnRouterRevoked=*))'):
+                    connection.modify_s(revoked['dn'], [(ldap.MOD_REPLACE, 'vpnRouterRevoked', [generalized(moment)]),
+                                                        (ldap.MOD_REPLACE, 'vpnRouterRevocationReason', [b'cessation_of_operation'])])
+                    force.add('root')
+                if root_key is None:
+                    notices.append(f'issuing CA {name} was retired: revoke its certificate on the root CRL offline and '
+                                   'upload the CRL with vpn-router-ca root import-crl')
+            retired = f'{name}-{moment.strftime("%Y%m%d%H%M%S")}'
+            connection.rename_s(authority_dn(name), f'cn={retired}')
+            update(connection, retired, {'vpnRouterRetired': generalized(moment), 'vpnRouterPrivateKey': None})
 
-    for folder in sorted(CA_DIR.iterdir()):
-        if not folder.is_dir() or folder.name in authorities:
-            continue
-        cert = read_cert(folder / 'cert.pem')
-        RETIRED_DIR.mkdir(mode=0o700, parents=True, exist_ok=True)
-        shutil.move(str(folder), str(RETIRED_DIR / f'{folder.name}-{now().strftime("%Y%m%d%H%M%S")}'))
-        state['retired'].append({'name': folder.name, 'retired': iso(now()),
-                                 'serial': f'{cert.serial_number:X}' if cert is not None else None})
-        for entry in state['certificates']:
-            if cert is not None and entry['ca'] == 'root' and entry['serial'] == f'{cert.serial_number:X}' and \
-                    not entry['revoked']:
-                entry['revoked'], entry['reason'] = iso(now()), 'cessation_of_operation'
-                force.add('root')
-        if root_key is None and cert is not None:
-            notices.append(f'issuing CA {folder.name} was retired: revoke its certificate on the root CRL offline and '
-                           'upload the CRL with vpn-router-ca root import-crl')
-
-    refresh_crls(cfg, state, force)
-    for name in ROUTER_CERTS:
-        ensure_router_cert(cfg, ctx, state, name, urls)
-    write_state(state)
-    publish()
+        refresh_crls(connection, cfg, force)
+        for name in ROUTER_CERTS:
+            ensure_router_cert(connection, cfg, ctx, name, urls)
+        publish(connection)
     return notices
 
 
-def publish():
+def publish(connection):
     """Write the DER copies of the certificates and CRLs of the root and the issuing CAs with a certificate to
     PUBLISH_DIR, and remove any other file there; True when anything changed."""
     PUBLISH_DIR.mkdir(parents=True, exist_ok=True)
     os.chmod(PUBLISH_DIR, 0o755)
     wanted = {}
-    for name in ['root', *active()]:
-        cert, crl = read_cert(directory(name) / 'cert.pem'), read_crl(directory(name) / 'crl.pem')
-        if cert is not None:
-            wanted[f'{name}.crt'] = cert.public_bytes(serialization.Encoding.DER)
-        if crl is not None:
-            wanted[f'{name}.crl'] = crl.public_bytes(serialization.Encoding.DER)
+    for name in ['root', *issuing(connection)]:
+        entry = authority(connection, name)
+        if entry is not None and entry['cert'] is not None:
+            wanted[f'{name}.crt'] = cert_der(entry['cert'])
+        if entry is not None and entry['crl'] is not None:
+            wanted[f'{name}.crl'] = entry['crl'].public_bytes(serialization.Encoding.DER)
     changed = False
     for path in PUBLISH_DIR.iterdir():
         if path.name not in wanted:
@@ -582,76 +721,100 @@ def remote_ca_file(connection):
     return f's2s-{connection}.pem'
 
 
-def install_crls():
-    """Copy the CRLs of the root, p2s and s2s to strongSwan, and those of the root and p2s to OpenVPN; True on change."""
+def install_crls(connection):
+    """Write the CRLs of the root, p2s and s2s for strongSwan, and those of the root and p2s for OpenVPN; True on
+    change."""
     changed = False
+    crls = {}
     for name, file in SWANCTL_CA_FILES.items():
-        source = directory(name) / 'crl.pem'
-        changed |= vpnrouter.install_file(source, X509CRL_DIR / file, 0o644) if source.is_file() \
-            else remove(X509CRL_DIR / file)
-    crls = [directory(name) / 'crl.pem' for name in ('root', 'p2s')]
-    if all(path.is_file() for path in crls):
-        changed |= write(OPENVPN_CRL, b''.join(path.read_bytes() for path in crls), 0o644)
+        entry = authority(connection, name)
+        crls[name] = entry['crl'].public_bytes(serialization.Encoding.PEM) if entry and entry['crl'] else None
+        changed |= write(X509CRL_DIR / file, crls[name], 0o644) if crls[name] else remove(X509CRL_DIR / file)
+    if crls['root'] and crls['p2s']:
+        changed |= write(OPENVPN_CRL, crls['root'] + crls['p2s'], 0o644)
     return changed
 
 
-def reload_crls():
+def reload_crls(connection):
     """Install the CRLs, and have strongSwan load them when they changed; OpenVPN reads its file when it changes."""
-    if install_crls():
+    if install_crls(connection):
         subprocess.run(['swanctl', '--load-creds'], capture_output=True, text=True)
 
 
 def distribute(cfg):
-    """Copy the certificates, keys and CRLs strongSwan, OpenVPN and the system's trust store read; True on change.
+    """Write the certificates, keys and CRLs strongSwan, OpenVPN and the system's trust store read; True on change.
 
     strongSwan gets the root, p2s and s2s, the remote CA of each site_to_site connection that has one, the router's
     certificates and keys, and the CRLs; OpenVPN the root and p2s in one file, and their CRLs (install_crls).
     """
     changed = False
-    for name, file in SWANCTL_CA_FILES.items():
-        source = directory(name) / 'cert.pem'
-        changed |= vpnrouter.install_file(source, X509CA_DIR / file, 0o644) if source.is_file() \
-            else remove(X509CA_DIR / file)
-    remote = {remote_ca_file(name): connection['remote_ca'].strip().encode() + b'\n'
-              for name, connection in cfg['site_to_site'].items() if connection['remote_ca'].strip()}
-    for path in X509CA_DIR.glob(remote_ca_file('*')):
-        if path.name not in remote:
-            changed |= remove(path)
-    for file, data in remote.items():
-        changed |= write(X509CA_DIR / file, data, 0o644)
-    for name, cert, key in (('vpn-server', VPN_SERVER_CERT, VPN_SERVER_KEY), ('site-to-site', S2S_CERT, S2S_KEY)):
-        if (ROUTER_DIR / f'{name}_cert.pem').is_file():
-            changed |= vpnrouter.install_file(ROUTER_DIR / f'{name}_cert.pem', cert, 0o644)
-            changed |= vpnrouter.install_file(ROUTER_DIR / f'{name}_key.pem', key, 0o600)
-        else:
-            changed |= remove(cert) | remove(key)
-    chain = [directory(name) / 'cert.pem' for name in ('root', 'p2s')]
-    if all(path.is_file() for path in chain):
-        changed |= write(OPENVPN_CA, b''.join(path.read_bytes() for path in chain), 0o644)
-    changed |= install_crls()
-    if vpnrouter.install_file(ROOT_DIR / 'cert.pem', TRUST_ANCHOR, 0o644):
-        changed = True
-        if shutil.which('update-ca-certificates'):
-            subprocess.run(['update-ca-certificates'], capture_output=True, text=True)
+    with directory() as connection:
+        certs = {}
+        for name, file in SWANCTL_CA_FILES.items():
+            entry = authority(connection, name)
+            certs[name] = cert_pem(entry['cert']) if entry and entry['cert'] else None
+            changed |= write(X509CA_DIR / file, certs[name], 0o644) if certs[name] else remove(X509CA_DIR / file)
+        remote = {remote_ca_file(name): connection_settings['remote_ca'].strip().encode() + b'\n'
+                  for name, connection_settings in cfg['site_to_site'].items() if connection_settings['remote_ca'].strip()}
+        for path in X509CA_DIR.glob(remote_ca_file('*')):
+            if path.name not in remote:
+                changed |= remove(path)
+        for file, data in remote.items():
+            changed |= write(X509CA_DIR / file, data, 0o644)
+        for name, (cert_file, key_file) in ROUTER_FILES.items():
+            current = holders(connection, ROUTER_CERTS[name][0], router_condition(name))
+            if current:
+                _, cert, key = current[0]
+                changed |= write(cert_file, cert_pem(cert), 0o644)
+                changed |= write(key_file, key_pem(key), 0o600)
+            else:
+                changed |= remove(cert_file) | remove(key_file)
+        if certs['root'] and certs['p2s']:
+            changed |= write(OPENVPN_CA, certs['root'] + certs['p2s'], 0o644)
+        changed |= install_crls(connection)
+        if certs['root'] and write(TRUST_ANCHOR, certs['root'], 0o644):
+            changed = True
+            if shutil.which('update-ca-certificates'):
+                subprocess.run(['update-ca-certificates'], capture_output=True, text=True)
     return changed
 
 
-def chain_of(ca):
-    """The PEM certificates of the issuing CA and the root."""
-    return (cert_pem(read_cert(CA_DIR / ca / 'cert.pem')) + cert_pem(read_cert(ROOT_DIR / 'cert.pem'))).decode()
+def bundle(name):
+    """The PEM certificates a client trusts a CA with: {name, pem}; for root the root alone, for an issuing CA the
+    issuing CA followed by the root."""
+    with directory() as connection:
+        root = authority(connection, 'root')
+        entry = root if name == 'root' else authority(connection, name) if isinstance(name, str) else None
+    if root is None or root['cert'] is None:
+        raise Failure('there is no root CA', 3)
+    if entry is None or entry['retired']:
+        raise Failure(f'no CA {name}', 3)
+    if entry['cert'] is None:
+        raise Failure(f'issuing CA {name} has no certificate yet', 4)
+    pem = cert_pem(root['cert']) if name == 'root' else cert_pem(entry['cert']) + cert_pem(root['cert'])
+    return {'name': name, 'pem': pem.decode()}
 
 
-def issuer_of(cfg, ca, template):
-    """The certificate and key of the issuing CA, and the template, checked to be one the CA issues."""
+def authority_files(name):
+    """The PEM certificate and key of an issuing CA, for Caddy's ACME server; None when it has not both."""
+    with directory() as connection:
+        entry = authority(connection, name)
+    if not entry or entry['cert'] is None or entry['key'] is None:
+        return None
+    return cert_pem(entry['cert']), key_pem(entry['key'])
+
+
+def issuer_of(connection, cfg, ca, template):
+    """The entry of the issuing CA and the template, checked to be one the CA issues."""
     authorities = vpnrouter.issuing_cas(cfg)
     if ca not in authorities:
         raise Failure(f'no issuing CA {ca}', 3)
     if template not in authorities[ca]['templates']:
         raise Failure(f'issuing CA {ca} does not issue {template} certificates', 2)
-    if not ready(ca):
+    entry = authority(connection, ca)
+    if not entry or entry['cert'] is None or entry['key'] is None:
         raise Failure(f'issuing CA {ca} has no certificate yet', 4)
-    return read_cert(CA_DIR / ca / 'cert.pem'), read_key(CA_DIR / ca / 'key.pem'), \
-        vpnrouter.pki_templates(cfg)[template]
+    return entry, vpnrouter.pki_templates(cfg)[template]
 
 
 def issue(cfg, ca, template, csr=None, subject=None, sans=None, password=None):
@@ -664,100 +827,110 @@ def issue(cfg, ca, template, csr=None, subject=None, sans=None, password=None):
     """
     if template in vpnrouter.ROUTER_TEMPLATES:
         raise Failure(f'{template} certificates are issued by the router only', 2)
-    issuer, issuer_key, values = issuer_of(cfg, ca, template)
-    key = None
-    if csr is not None:
-        try:
-            request = x509.load_pem_x509_csr(csr.strip().encode() if isinstance(csr, str) else b'')
-        except ValueError:
-            raise Failure('the CSR is not a PEM certificate signing request', 2)
-        if not request.is_signature_valid:
-            raise Failure('the signature of the CSR is not valid', 2)
-        subject = common_name(request)
-        sans = [value.split(':', 1)[1] for value in san_values(request)]
-        public_key = request.public_key()
-    else:
-        if not isinstance(password, str) or not 1 <= len(password) <= PASSWORD_MAX:
-            raise Failure(f'the password of the PFX file must have 1 to {PASSWORD_MAX} characters', 2)
-        if sans is None:
-            sans = []
-        if not isinstance(sans, list):
-            raise Failure('sans must be a list of names', 2)
-        key = new_key(values['key'])
-        public_key = key.public_key()
-    subject = check_subject(values['subject'], subject)
-    names = general_names(([subject] if values['subject'] == 'dns' else []) + list(sans),
-                          set(values['sans']) | ({'dns'} if values['subject'] == 'dns' else set()))
-    cert = sign(subject, public_key, issuer, issuer_key, values['days'], leaf_extensions(values, names),
-                vpnrouter.pki_base_urls(cfg), ca)
-    state = read_state()
-    record(state, cert, ca, 'external', template)
-    write_state(state)
+    with directory() as connection:
+        issuer, values = issuer_of(connection, cfg, ca, template)
+        key = None
+        if csr is not None:
+            try:
+                request = x509.load_pem_x509_csr(csr.strip().encode() if isinstance(csr, str) else b'')
+            except ValueError:
+                raise Failure('the CSR is not a PEM certificate signing request', 2)
+            if not request.is_signature_valid:
+                raise Failure('the signature of the CSR is not valid', 2)
+            subject = common_name(request)
+            sans = [value.split(':', 1)[1] for value in san_values(request)]
+            public_key = request.public_key()
+        else:
+            if not isinstance(password, str) or not 1 <= len(password) <= PASSWORD_MAX:
+                raise Failure(f'the password of the PFX file must have 1 to {PASSWORD_MAX} characters', 2)
+            if sans is None:
+                sans = []
+            if not isinstance(sans, list):
+                raise Failure('sans must be a list of names', 2)
+            key = new_key(values['key'])
+            public_key = key.public_key()
+        subject = check_subject(values['subject'], subject)
+        names = general_names(([subject] if values['subject'] == 'dns' else []) + list(sans),
+                              set(values['sans']) | ({'dns'} if values['subject'] == 'dns' else set()))
+        cert = sign(subject, public_key, issuer['cert'], issuer['key'], values['days'], leaf_extensions(values, names),
+                    vpnrouter.pki_base_urls(cfg), ca)
+        record(connection, cert, ca, 'external', template)
+        root = authority(connection, 'root')['cert']
     serial = f'{cert.serial_number:X}'
     if key is None:
-        return {'serial': serial, 'certificate': cert_pem(cert).decode(), 'chain': chain_of(ca)}
+        return {'serial': serial, 'certificate': cert_pem(cert).decode(),
+                'chain': (cert_pem(issuer['cert']) + cert_pem(root)).decode()}
     encryption = (serialization.PrivateFormat.PKCS12.encryption_builder()
                   .kdf_rounds(50000)
                   .key_cert_algorithm(pkcs12.PBES.PBESv1SHA1And3KeyTripleDESCBC)
                   .hmac_hash(hashes.SHA1())
                   .build(password.encode()))
-    pfx = pkcs12.serialize_key_and_certificates(subject.encode(), key, cert,
-                                                [issuer, read_cert(ROOT_DIR / 'cert.pem')], encryption)
+    pfx = pkcs12.serialize_key_and_certificates(subject.encode(), key, cert, [issuer['cert'], root], encryption)
     return {'serial': serial, 'pfx': base64.b64encode(pfx).decode()}
 
 
-def user_files(name):
-    """The certificate and the key of a user."""
-    return USER_DIR / f'{name}_cert.pem', USER_DIR / f'{name}_key.pem'
+def user_dn(name):
+    return f'uid={ldap.dn.escape_dn_chars(name)},{vpnrouter_ldap.USERS}'
 
 
 def issue_user(cfg, name, email):
     """Issue the user's certificate from the P2S CA with the template vpn-user: the user name as the common name and a
-    DNS name, and the e-mail address; the certificate and the key are kept in USER_DIR."""
-    issuer, issuer_key, values = issuer_of(cfg, 'p2s', 'vpn-user')
-    key = new_key(values['key'])
-    cert = sign(name, key.public_key(), issuer, issuer_key, values['days'],
-                leaf_extensions(values, general_names([name, email], vpnrouter.SAN_TYPES)),
-                vpnrouter.pki_base_urls(cfg), 'p2s')
-    cert_path, key_path = user_files(name)
-    write(key_path, key_pem(key), 0o600)
-    write(cert_path, cert_pem(cert), 0o644)
-    state = read_state()
-    record(state, cert, 'p2s', 'user', 'vpn-user')
-    write_state(state)
+    DNS name, and the e-mail address; it is kept with its key, and is the userCertificate of the user's entry."""
+    with directory() as connection:
+        issuer, values = issuer_of(connection, cfg, 'p2s', 'vpn-user')
+        key = new_key(values['key'])
+        cert = sign(name, key.public_key(), issuer['cert'], issuer['key'], values['days'],
+                    leaf_extensions(values, general_names([name, email], vpnrouter.SAN_TYPES)),
+                    vpnrouter.pki_base_urls(cfg), 'p2s')
+        for dn, _, _ in holders(connection, 'p2s', user_condition(name)):
+            drop_key(connection, dn)
+        record(connection, cert, 'p2s', 'user', 'vpn-user', key)
+        connection.modify_s(user_dn(name), [(ldap.MOD_REPLACE, 'userCertificate;binary', [cert_der(cert)])])
 
 
-def revoke_entries(cfg, state, entries, reason):
+def user_credentials(name):
+    """The PEM certificate and key of the user's current certificate, None when the user has none."""
+    with directory() as connection:
+        current = holders(connection, 'p2s', user_condition(name))
+    if not current:
+        return None
+    _, cert, key = current[0]
+    return cert_pem(cert), key_pem(key)
+
+
+def revoke_entries(connection, cfg, entries, reason):
     """Mark the certificates revoked, sign new CRLs of their CAs, and publish and install them."""
-    for entry in entries:
-        entry['revoked'], entry['reason'] = iso(now()), reason
     names = {entry['ca'] for entry in entries}
     for name in names:
-        if not (directory(name) / 'key.pem').is_file():
+        current = authority(connection, name)
+        if not current or current['key'] is None:
             raise Failure(f'the key of {name} is not on the router, so it cannot sign its CRL', 4)
+    moment = generalized(now())
+    for entry in entries:
+        connection.modify_s(entry['dn'], [(ldap.MOD_REPLACE, 'vpnRouterRevoked', [moment]),
+                                          (ldap.MOD_REPLACE, 'vpnRouterRevocationReason', [reason.encode()]),
+                                          (ldap.MOD_REPLACE, 'vpnRouterPrivateKey', [])])
     for name in names:
-        sign_crl(cfg, name, state)
-    write_state(state)
-    publish()
-    reload_crls()
+        sign_crl(connection, cfg, name)
+    publish(connection)
+    reload_crls(connection)
 
 
 def revoke_user(cfg, name):
-    """Revoke the user's certificates and remove the certificate and the key."""
-    state = read_state()
-    entries = [entry for entry in state['certificates']
-               if entry['kind'] == 'user' and entry['subject'] == name and not entry['revoked']]
-    if entries:
-        revoke_entries(cfg, state, entries, 'cessation_of_operation')
-    for path in user_files(name):
-        path.unlink(missing_ok=True)
+    """Revoke the user's certificates, and remove the userCertificate of the user's entry."""
+    with directory() as connection:
+        entries = certificate_entries(connection, authority_dn('p2s'), f'{user_condition(name)}(!(vpnRouterRevoked=*))')
+        if entries:
+            revoke_entries(connection, cfg, entries, 'cessation_of_operation')
+        with contextlib.suppress(ldap.NO_SUCH_OBJECT):
+            connection.modify_s(user_dn(name), [(ldap.MOD_REPLACE, 'userCertificate;binary', [])])
 
 
 def revoke(cfg, serial, reason=None):
     """Revoke a certificate the router issued, by its serial number, for one of REASONS.
 
     A user's certificate is revoked by removing the user, and an issuing CA by removing it from pki.issuing_cas. A
-    revoked router certificate is removed, so that vpn-router-setup issues a new one; the answer says so with
+    revoked router certificate loses its key, so that vpn-router-setup issues a new one; the answer says so with
     reissue.
     """
     reason = reason or 'unspecified'
@@ -765,40 +938,40 @@ def revoke(cfg, serial, reason=None):
         raise Failure(f'the reason must be one of {", ".join(REASONS)}', 2)
     if not isinstance(serial, str) or not SERIAL.match(serial):
         raise Failure('the serial number must be hexadecimal', 2)
-    state = read_state()
-    entry = next((entry for entry in state['certificates'] if entry['serial'] == serial.upper().lstrip('0')), None)
-    if entry is None:
-        raise Failure(f'no certificate with the serial number {serial}', 3)
-    if entry['revoked']:
-        raise Failure(f'certificate {serial} is revoked', 4)
-    if entry['kind'] == 'user':
-        raise Failure(f'certificate {serial} is the certificate of user {entry["subject"]}; remove the user', 2)
-    if entry['kind'] == 'ca':
-        raise Failure(f'certificate {serial} is an issuing CA; remove it from pki.issuing_cas', 2)
-    revoke_entries(cfg, state, [entry], reason)
-    reissue = False
-    if entry['kind'] == 'router':
-        for name, (ca, _) in ROUTER_CERTS.items():
-            cert = read_cert(ROUTER_DIR / f'{name}_cert.pem')
-            if cert is not None and f'{cert.serial_number:X}' == entry['serial']:
-                remove(ROUTER_DIR / f'{name}_cert.pem')
-                reissue = True
-    return {**entry, 'reissue': reissue}
+    with directory() as connection:
+        found = certificate_entries(connection, vpnrouter_ldap.PKI, f'(serialNumber={serial.upper().lstrip("0")})')
+        if not found:
+            raise Failure(f'no certificate with the serial number {serial}', 3)
+        entry = found[0]
+        if entry['revoked']:
+            raise Failure(f'certificate {serial} is revoked', 4)
+        if entry['kind'] == 'user':
+            raise Failure(f'certificate {serial} is the certificate of user {entry["subject"]}; remove the user', 2)
+        if entry['kind'] == 'ca':
+            raise Failure(f'certificate {serial} is an issuing CA; remove it from pki.issuing_cas', 2)
+        revoke_entries(connection, cfg, [entry], reason)
+    return {**{key: value for key, value in entry.items() if key != 'dn'}, 'revoked': iso(now()), 'reason': reason,
+            'reissue': entry['kind'] == 'router'}
 
 
 def certificates():
     """The certificates the router issued, newest first, each with state: valid, expired or revoked."""
     moment = iso(now())
-    return [{**entry, 'state': 'revoked' if entry['revoked'] else 'expired' if entry['expires'] <= moment else 'valid'}
-            for entry in reversed(read_state()['certificates'])]
+    with directory() as connection:
+        entries = certificate_entries(connection, vpnrouter_ldap.PKI)
+    return [{**{key: value for key, value in entry.items() if key != 'dn'},
+             'ca': RETIRED_SUFFIX.sub('', entry['ca']),
+             'state': 'revoked' if entry['revoked'] else 'expired' if (entry['expires'] or '') <= moment else 'valid'}
+            for entry in entries]
 
 
 def csr(cfg, name):
     """The CSR of a pending issuing CA and the openssl extension section to sign it with: {name, csr, extensions}."""
     if name not in vpnrouter.issuing_cas(cfg):
         raise Failure(f'no issuing CA {name}', 3)
-    path = CA_DIR / name / 'csr.pem'
-    if not path.is_file():
+    with directory() as connection:
+        entry = authority(connection, name)
+    if not entry or entry['cert'] is not None or entry['csr'] is None:
         raise Failure(f'issuing CA {name} is not waiting for a certificate', 4)
     urls = vpnrouter.pki_base_urls(cfg)
     lines = ['[ issuing_ca ]', 'basicConstraints = critical, CA:TRUE, pathlen:0', 'keyUsage = critical, keyCertSign, cRLSign',
@@ -806,7 +979,7 @@ def csr(cfg, name):
     if urls:
         lines.append('authorityInfoAccess = ' + ', '.join(f'caIssuers;URI:{url}root.crt' for url in urls))
         lines.append('crlDistributionPoints = ' + ', '.join(f'URI:{url}root.crl' for url in urls))
-    return {'name': name, 'csr': path.read_text(encoding='utf-8'), 'extensions': '\n'.join(lines) + '\n'}
+    return {'name': name, 'csr': entry['csr'].decode(), 'extensions': '\n'.join(lines) + '\n'}
 
 
 def import_ca(cfg, name, text):
@@ -814,29 +987,26 @@ def import_ca(cfg, name, text):
     signed for the key of the CA's CSR."""
     if name not in vpnrouter.issuing_cas(cfg):
         raise Failure(f'no issuing CA {name}', 3)
-    folder = CA_DIR / name
-    if (folder / 'cert.pem').is_file():
-        raise Failure(f'issuing CA {name} has its certificate', 4)
-    key = read_key(folder / 'key.pem')
-    if key is None:
-        raise Failure(f'issuing CA {name} has no key; vpn-router-setup makes it with the CSR', 3)
-    try:
-        cert = x509.load_pem_x509_certificate(text.strip().encode() if isinstance(text, str) else b'')
-    except ValueError:
-        raise Failure('the certificate is not a PEM certificate', 2)
-    if not issued_by(cert, read_cert(ROOT_DIR / 'cert.pem')):
-        raise Failure('the certificate is not signed by the root CA', 2)
-    if not same_key(cert.public_key(), key.public_key()):
-        raise Failure(f'the certificate is not for the key of the CSR of {name}', 2)
-    if not is_ca(cert):
-        raise Failure('the certificate is not a CA certificate', 2)
-    write(folder / 'cert.pem', cert_pem(cert), 0o644)
-    remove(folder / 'csr.pem')
-    state = read_state()
-    record(state, cert, 'root', 'ca')
-    sign_crl(cfg, name, state)
-    write_state(state)
-    publish()
+    with directory() as connection:
+        entry = authority(connection, name)
+        if entry is not None and entry['cert'] is not None:
+            raise Failure(f'issuing CA {name} has its certificate', 4)
+        if entry is None or entry['key'] is None:
+            raise Failure(f'issuing CA {name} has no key; vpn-router-setup makes it with the CSR', 3)
+        try:
+            cert = x509.load_pem_x509_certificate(text.strip().encode() if isinstance(text, str) else b'')
+        except ValueError:
+            raise Failure('the certificate is not a PEM certificate', 2)
+        if not issued_by(cert, authority(connection, 'root')['cert']):
+            raise Failure('the certificate is not signed by the root CA', 2)
+        if not same_key(cert.public_key(), entry['key'].public_key()):
+            raise Failure(f'the certificate is not for the key of the CSR of {name}', 2)
+        if not is_ca(cert):
+            raise Failure('the certificate is not a CA certificate', 2)
+        update(connection, name, {'cACertificate;binary': cert_der(cert), 'vpnRouterCertificateRequest': None})
+        record(connection, cert, 'root', 'ca')
+        sign_crl(connection, cfg, name)
+        publish(connection)
     return {'name': name, 'subject': common_name(cert), 'expires': iso(utc(cert, 'not_valid_after'))}
 
 
@@ -849,80 +1019,66 @@ def import_root_crl(data):
         crl = x509.load_pem_x509_crl(data) if data.startswith(b'-----') else x509.load_der_x509_crl(data)
     except ValueError:
         raise Failure('the CRL is not a PEM or DER certificate revocation list', 2)
-    root = read_cert(ROOT_DIR / 'cert.pem')
-    if root is None:
-        raise Failure('there is no root CA', 3)
-    if crl.issuer != root.subject or not crl.is_signature_valid(root.public_key()):
-        raise Failure('the CRL is not signed by the root CA', 2)
-    current = read_crl(ROOT_DIR / 'crl.pem')
-    if current is not None and utc(crl, 'last_update') < utc(current, 'last_update'):
-        raise Failure('the CRL is older than the current one', 2)
-    write(ROOT_DIR / 'crl.pem', crl.public_bytes(serialization.Encoding.PEM), 0o644)
-    state = read_state()
-    state['root_crl'] = 'uploaded'
-    write_state(state)
-    publish()
-    reload_crls()
+    with directory() as connection:
+        root = authority(connection, 'root')
+        if root is None or root['cert'] is None:
+            raise Failure('there is no root CA', 3)
+        if crl.issuer != root['cert'].subject or not crl.is_signature_valid(root['cert'].public_key()):
+            raise Failure('the CRL is not signed by the root CA', 2)
+        if root['crl'] is not None and utc(crl, 'last_update') < utc(root['crl'], 'last_update'):
+            raise Failure('the CRL is older than the current one', 2)
+        update(connection, 'root', {'certificateRevocationList;binary': crl.public_bytes(serialization.Encoding.DER),
+                                    'vpnRouterCRLSource': b'uploaded'})
+        publish(connection)
+        reload_crls(connection)
     following = utc(crl, 'next_update')
     return {'next_update': iso(following) if following else None}
 
 
-def import_root_cert(data):
-    """Place an existing root CA's certificate, PEM, before the root exists: without its key the root is offline."""
-    if read_cert(ROOT_DIR / 'cert.pem') is not None or (ROOT_DIR / 'key.pem').exists():
-        raise Failure('the root CA exists', 4)
-    try:
-        cert = x509.load_pem_x509_certificate(data.strip() if isinstance(data, bytes) else data.strip().encode())
-    except ValueError:
-        raise Failure('the certificate is not a PEM certificate', 2)
-    if not is_ca(cert):
-        raise Failure('the certificate is not a CA certificate', 2)
-    write(ROOT_DIR / 'cert.pem', cert_pem(cert), 0o644)
-    return {'subject': common_name(cert), 'expires': iso(utc(cert, 'not_valid_after'))}
-
-
 def export_root_key(passphrase):
     """The root key in PEM, encrypted with the passphrase."""
-    key = read_key(ROOT_DIR / 'key.pem')
-    if key is None:
-        raise Failure('the root key is not on the router', 3)
     if not passphrase:
         raise Failure('the passphrase is required', 2)
-    return key_pem(key, passphrase.encode())
+    with directory() as connection:
+        root = authority(connection, 'root')
+    if root is None or root['key'] is None:
+        raise Failure('the root key is not on the router', 3)
+    return key_pem(root['key'], passphrase.encode())
 
 
 def remove_root_key():
-    if not remove(ROOT_DIR / 'key.pem'):
-        raise Failure('the root key is not on the router', 3)
+    with directory() as connection:
+        root = authority(connection, 'root')
+        if root is None or root['key'] is None:
+            raise Failure('the root key is not on the router', 3)
+        update(connection, 'root', {'vpnRouterPrivateKey': None})
 
 
 def import_root_key(data, passphrase=None):
     """Put the root key back, PEM, encrypted with the passphrase or not; it must be the key of the root certificate."""
-    root = read_cert(ROOT_DIR / 'cert.pem')
-    if root is None:
-        raise Failure('there is no root CA', 3)
     try:
         key = serialization.load_pem_private_key(data, passphrase.encode() if passphrase else None)
     except (ValueError, TypeError):
         raise Failure('the file is not a PEM private key, or the passphrase is wrong', 2)
-    if not same_key(key.public_key(), root.public_key()):
-        raise Failure('the key is not the key of the root CA', 2)
-    write(ROOT_DIR / 'key.pem', key_pem(key), 0o600)
+    with directory() as connection:
+        root = authority(connection, 'root')
+        if root is None or root['cert'] is None:
+            raise Failure('there is no root CA', 3)
+        if not same_key(key.public_key(), root['cert'].public_key()):
+            raise Failure('the key is not the key of the root CA', 2)
+        update(connection, 'root', {'vpnRouterPrivateKey': key_pem(key)})
 
 
 def maintain(cfg):
     """Sign the stale CRLs again, publish and install them; True when one of the router's certificates is due for
     renewal, which vpn-router-setup does."""
-    state = read_state()
-    refresh_crls(cfg, state)
-    write_state(state)
-    publish()
-    reload_crls()
-    for name in ROUTER_CERTS:
-        cert = read_cert(ROUTER_DIR / f'{name}_cert.pem')
-        if cert is not None and renewal_due(cert):
-            return True
-    return False
+    with directory() as connection:
+        refresh_crls(connection, cfg)
+        publish(connection)
+        reload_crls(connection)
+        due = [current[0][1] for current in (holders(connection, ROUTER_CERTS[name][0], router_condition(name))
+                                             for name in ROUTER_CERTS) if current]
+    return any(renewal_due(cert) for cert in due)
 
 
 def acme_url(cfg, name):
@@ -935,60 +1091,70 @@ def status(cfg):
     key on the router is a warning while pki.root_key_warning is true."""
     moment = now()
     soon = moment + datetime.timedelta(days=WARN_DAYS)
-    state = read_state()
     warnings = []
 
-    def crl_of(name):
+    def crl_of(entry):
         """The next update of the CA's CRL; a CRL the router signs warns once past half of its validity, which the timer
         renews before, and one signed offline WARN_DAYS before it expires."""
-        crl = read_crl(directory(name) / 'crl.pem')
+        crl = entry['crl']
         following = utc(crl, 'next_update') if crl is not None else None
-        signed_here = (directory(name) / 'key.pem').is_file()
         if crl is None:
-            warnings.append(f'{name} has no CRL')
-        elif following is not None and (crl_stale(directory(name) / 'crl.pem') if signed_here else following <= soon):
-            warnings.append(f'the CRL of {name} {"expired" if following <= moment else "expires"} on {iso(following)}')
+            warnings.append(f'{entry["name"]} has no CRL')
+        elif following is not None and (crl_stale(crl) if entry['key'] is not None else following <= soon):
+            warnings.append(f'the CRL of {entry["name"]} {"expired" if following <= moment else "expires"} on {iso(following)}')
         return iso(following) if following else None
 
-    root_cert = read_cert(ROOT_DIR / 'cert.pem')
+    with directory() as connection:
+        root_entry = authority(connection, 'root')
+        entries = {name: authority(connection, name) for name in vpnrouter.issuing_cas(cfg)}
+        retired_found = connection.search_s(vpnrouter_ldap.PKI, ldap.SCOPE_ONELEVEL,
+                                            '(&(objectClass=vpnRouterAuthority)(vpnRouterRetired=*))',
+                                            ['cn', 'vpnRouterRetired', 'cACertificate;binary'])
+        router_certs = [current[0][1] for current in (holders(connection, ROUTER_CERTS[name][0], router_condition(name))
+                                                      for name in ROUTER_CERTS) if current]
+
     root = None
-    if root_cert is not None:
-        key = (ROOT_DIR / 'key.pem').is_file()
-        root = {'subject': common_name(root_cert), 'expires': iso(utc(root_cert, 'not_valid_after')), 'key': key,
-                'crl_next_update': crl_of('root') if key or (ROOT_DIR / 'crl.pem').is_file() else None,
-                'crl_source': state['root_crl']}
+    if root_entry is not None and root_entry['cert'] is not None:
+        cert, key = root_entry['cert'], root_entry['key'] is not None
+        root = {'subject': common_name(cert), 'expires': iso(utc(cert, 'not_valid_after')), 'key': key,
+                'crl_next_update': crl_of(root_entry) if key or root_entry['crl'] is not None else None,
+                'crl_source': root_entry['crl_source']}
         if key and cfg['pki']['root_key_warning']:
             warnings.append('the root key is on the router; export it with vpn-router-ca root export-key and remove it '
                             'with vpn-router-ca root remove-key to keep the root offline')
-        elif not (ROOT_DIR / 'crl.pem').is_file():
+        elif not key and root_entry['crl'] is None:
             warnings.append('the root has no CRL; sign one offline and upload it with vpn-router-ca root import-crl')
-        if utc(root_cert, 'not_valid_after') <= soon:
+        if utc(cert, 'not_valid_after') <= soon:
             warnings.append(f'the root certificate expires on {root["expires"]}')
 
     authorities = []
-    for name, authority in vpnrouter.issuing_cas(cfg).items():
-        folder = CA_DIR / name
-        cert = read_cert(folder / 'cert.pem')
-        kind = 'active' if cert is not None else 'pending' if (folder / 'csr.pem').is_file() else 'missing'
-        entry = {'name': name, 'common_name': authority['name'], 'state': kind, 'builtin': authority['builtin'],
-                 'templates': authority['templates'], 'acme': authority['acme'],
-                 'subject': common_name(cert) if cert is not None else None,
-                 'expires': iso(utc(cert, 'not_valid_after')) if cert is not None else None,
-                 'key': (folder / 'key.pem').is_file(), 'crl_next_update': crl_of(name) if cert is not None else None,
-                 'acme_url': acme_url(cfg, name) if authority['acme'] and cert is not None else None}
+    for name, settings in vpnrouter.issuing_cas(cfg).items():
+        entry = entries[name]
+        cert = entry['cert'] if entry else None
+        kind = 'active' if cert is not None else 'pending' if entry and entry['csr'] is not None else 'missing'
+        authorities.append({
+            'name': name, 'common_name': settings['name'], 'state': kind, 'builtin': settings['builtin'],
+            'templates': settings['templates'], 'acme': settings['acme'],
+            'subject': common_name(cert) if cert is not None else None,
+            'expires': iso(utc(cert, 'not_valid_after')) if cert is not None else None,
+            'key': bool(entry and entry['key'] is not None), 'crl_next_update': crl_of(entry) if cert is not None else None,
+            'acme_url': acme_url(cfg, name) if settings['acme'] and cert is not None else None,
+        })
         if kind == 'pending':
             warnings.append(f'issuing CA {name} waits for its certificate signed by the root CA')
         if cert is not None and utc(cert, 'not_valid_after') <= soon:
-            warnings.append(f'the certificate of issuing CA {name} expires on {entry["expires"]}')
-        authorities.append(entry)
+            warnings.append(f'the certificate of issuing CA {name} expires on {authorities[-1]["expires"]}')
 
-    root_crl = read_crl(ROOT_DIR / 'crl.pem')
-    for retired in state['retired']:
-        if retired['serial'] and root_crl is not None and \
-                root_crl.get_revoked_certificate_by_serial_number(int(retired['serial'], 16)) is None:
-            warnings.append(f'the root CRL does not revoke retired issuing CA {retired["name"]}')
-    for name in ROUTER_CERTS:
-        cert = read_cert(ROUTER_DIR / f'{name}_cert.pem')
-        if cert is not None and utc(cert, 'not_valid_after') <= soon:
-            warnings.append(f'the router certificate {name} expires on {iso(utc(cert, "not_valid_after"))}')
-    return {'root': root, 'authorities': authorities, 'retired': state['retired'], 'warnings': warnings}
+    retired = []
+    for _, attributes in retired_found:
+        der = first(attributes, 'cACertificate;binary')
+        serial = f'{x509.load_der_x509_certificate(der).serial_number:X}' if der else None
+        name = RETIRED_SUFFIX.sub('', attributes['cn'][0].decode())
+        retired.append({'name': name, 'retired': from_generalized(first(attributes, 'vpnRouterRetired')), 'serial': serial})
+        root_crl = root_entry['crl'] if root_entry else None
+        if serial and root_crl is not None and root_crl.get_revoked_certificate_by_serial_number(int(serial, 16)) is None:
+            warnings.append(f'the root CRL does not revoke retired issuing CA {name}')
+    for cert in router_certs:
+        if utc(cert, 'not_valid_after') <= soon:
+            warnings.append(f'the router certificate {common_name(cert)} expires on {iso(utc(cert, "not_valid_after"))}')
+    return {'root': root, 'authorities': authorities, 'retired': retired, 'warnings': warnings}
diff --git a/debian-package/src/usr/lib/vpn-router/vpnrouter_users.py b/debian-package/src/usr/lib/vpn-router/vpnrouter_users.py
index c5e5f36..fb47f4c 100644
--- a/debian-package/src/usr/lib/vpn-router/vpnrouter_users.py
+++ b/debian-package/src/usr/lib/vpn-router/vpnrouter_users.py
@@ -3,7 +3,8 @@
 A user is an entry in ou=users of the router's directory, of one of two kinds, fixed when it is
 added. A VPN user is an inetOrgPerson with a first name, a last name and an e-mail address, whose
 password OpenVPN checks, and a client certificate of the P2S issuing CA (vpnrouter_pki) with the
-user name as its common name, which OpenVPN and IKEv2 accept. A Manager-only account is an account,
+user name as its common name, which OpenVPN and IKEv2 accept; the certificate is the entry's
+userCertificate, and the PKI keeps it with its key. A Manager-only account is an account,
 simpleSecurityObject and vpnRouterAccount (the package's schema) with a name, a password and
 optionally an e-mail address, no names, no certificate and so no VPN access; it is added when
 neither the first nor the last name is given, and can sign in to the web service. A service
@@ -68,7 +69,7 @@ PERSON = (('first_name', 'givenName'), ('last_name', 'sn'), ('email', 'mail'))
 LABELS = (('display_name', 'displayName'), ('description', 'description'))
 #: The attributes read for a user.
 ATTRIBUTES = ['uid', 'objectClass', 'pwdAccountLockedTime', 'givenName', 'sn', 'mail', 'oathTOTPToken', 'vpnRouterScope',
-              'displayName', 'description']
+              'displayName', 'description', 'userCertificate;binary']
 #: The vpnRouterScope of a service account.
 SERVICE_SCOPE = 'service'
 #: The object classes of a VPN user and of a Manager-only account.
@@ -173,9 +174,6 @@ def dn_of(name):
     return f'uid={name},{vpnrouter_ldap.USERS}'
 
 
-def certificate(name):
-    return vpnrouter_pki.user_files(name)
-
 
 def entry(connection, name):
     """The attributes of the user's entry; Failure with status 3 when there is none."""
@@ -234,7 +232,7 @@ def summary(attributes):
         'internal': service(attributes) and name in internal_accounts(),
         'enabled': lock != LOCKED,
         'locked': lock not in (None, LOCKED) and locked_since(lock) > time.time() - vpnrouter_ldap.LOCKOUT_SECONDS,
-        'certificate': certificate(name)[0].is_file(),
+        'certificate': 'userCertificate;binary' in attributes,
         'otp': 'oathTOTPToken' in attributes,
     }
     for key, attribute in PERSON + LABELS:
@@ -468,9 +466,10 @@ def profile(connection, name):
     cfg = vpnrouter.load_config()
     if not cfg['openvpn']['enabled']:
         raise Failure('OpenVPN is not enabled', 2)
-    cert, key = certificate(name)
-    if not cert.is_file() or not key.is_file():
+    credentials = vpnrouter_pki.user_credentials(name)
+    if credentials is None:
         raise Failure(f'user {name} has no certificate')
+    cert, key = (value.decode() for value in credentials)
     fqdn = cfg['wan']['local_fqdn'].strip()
     text = '\n'.join([
         'client',
@@ -486,8 +485,8 @@ def profile(connection, name):
         'auth-nocache',
         'verb 3',
         '<ca>', extract_pem(vpnrouter_pki.OPENVPN_CA.read_text(encoding='utf-8')), '</ca>',
-        '<cert>', extract_pem(cert.read_text(encoding='utf-8')), '</cert>',
-        '<key>', key.read_text(encoding='utf-8').strip(), '</key>',
+        '<cert>', extract_pem(cert), '</cert>',
+        '<key>', key.strip(), '</key>',
         '',
     ])
     return {'name': name, 'profile': text}
diff --git a/debian-package/src/usr/lib/vpn-router/web b/debian-package/src/usr/lib/vpn-router/web
index 2fef06c..833186d 100644
--- a/debian-package/src/usr/lib/vpn-router/web
+++ b/debian-package/src/usr/lib/vpn-router/web
@@ -788,6 +788,8 @@ def ca(method, path, body):
                                                 "certificate", "chain"}; {"ca", "template", "subject", "sans",
                                                 "password"} answers {"serial", "pfx"}, a PKCS#12 file in base64
       POST /ca/certificates/<serial>/revoke     revoke a certificate: {"reason"?}
+      GET  /ca/bundle/<name>                    the PEM certificates a client trusts the CA with: {"name", "pem"}; for
+                                                root the root alone, for an issuing CA the issuing CA and the root
       GET  /ca/issuing/<name>/csr               the CSR of an issuing CA that waits for the offline root, with the
                                                 openssl extensions to sign it with: {"name", "csr", "extensions"}
       PUT  /ca/issuing/<name>/certificate       take its certificate signed by the root: {"certificate"}
@@ -803,6 +805,8 @@ def ca(method, path, body):
     route = (method, *parts[1:])
     try:
         cfg = vpnrouter.load_config()
+        if len(route) == 3 and route[:2] == ('GET', 'bundle'):
+            return 200, vpnrouter_pki.bundle(route[2])
         if route == ('GET',):
             return 200, {'settings': cfg['pki'], 'templates': vpnrouter.pki_templates(cfg),
                          'status': vpnrouter_pki.status(cfg), 'certificates': vpnrouter_pki.certificates()}
@@ -836,6 +840,8 @@ def ca(method, path, body):
         return 400, {'error': str(exc)}
     except vpnrouter_pki.Failure as failure:
         return PKI_STATUS.get(failure.status, 500), {'error': str(failure)}
+    except ldap.LDAPError as exc:
+        return 500, {'error': f'the directory, which holds the PKI, failed: {exc}'}
     except OSError as exc:
         return 500, {'error': f'the PKI cannot be changed: {exc}'}
     except SystemExit as exc:
diff --git a/debian-package/src/usr/sbin/vpn-router-ca b/debian-package/src/usr/sbin/vpn-router-ca
index fd36623..f3a960a 100755
--- a/debian-package/src/usr/sbin/vpn-router-ca
+++ b/debian-package/src/usr/sbin/vpn-router-ca
@@ -1,13 +1,13 @@
 #!/usr/bin/python3
-"""Manage the router's PKI from the command line, with vpnrouter_pki.
+"""Manage the router's PKI, which the router's directory holds, from the command line, with vpnrouter_pki.
 
 status shows the root, the issuing CAs and the warnings; list the certificates the router issued. issue signs a CSR,
 or makes a key and writes a PFX file whose password is read from the first line of standard input. ca csr prints the
 CSR of an issuing CA that waits for the offline root, with the openssl extensions to sign it with, and ca import takes
 the signed certificate. root export-key writes the root key encrypted with the passphrase read from standard input,
-root remove-key removes it from the router, root import-key puts it back, root import-cert places an existing root's
-certificate before the root exists, and root import-crl takes a root CRL signed offline. maintain signs the stale CRLs
-again; vpn-router-pki.service runs it daily. A change that needs vpn-router-setup restarts it without waiting.
+root remove-key removes it from the router, root import-key puts it back, and root import-crl takes a root CRL signed
+offline. maintain signs the stale CRLs again; vpn-router-pki.service runs it daily. A change that needs
+vpn-router-setup restarts it without waiting.
 
 The answer is text for people on standard output, and a failure is a message on standard error. With --json the answer
 is JSON on standard output, and a failure is {"error": ...} there too. The exit status says what failed: 2 the request
@@ -22,7 +22,6 @@ commands and their options.
   vpn-router-ca [--json] maintain
   vpn-router-ca [--json] ca csr NAME
   vpn-router-ca [--json] ca import NAME FILE
-  vpn-router-ca [--json] root import-cert FILE
   vpn-router-ca [--json] root export-key --out FILE   (passphrase on stdin)
   vpn-router-ca [--json] root remove-key [--yes]
   vpn-router-ca [--json] root import-key FILE   (passphrase on stdin, an empty line for none)
@@ -39,6 +38,8 @@ import sys
 
 sys.path.insert(0, '/usr/lib/vpn-router')
 
+import ldap
+
 import vpnrouter
 import vpnrouter_pki
 from vpnrouter_pki import Failure
@@ -125,10 +126,6 @@ def run(options):
             document = vpnrouter_pki.import_ca(cfg, options.name, pathlib.Path(options.file).read_text(encoding='ascii'))
             restart_setup()
             return document, f'Issuing CA {options.name} has its certificate, which expires {document["expires"]}.'
-        if options.action == 'import-cert':
-            document = vpnrouter_pki.import_root_cert(pathlib.Path(options.file).read_bytes())
-            restart_setup()
-            return document, f'Root CA {document["subject"]} placed, without its key.'
         if options.action == 'export-key':
             data = vpnrouter_pki.export_root_key(secret())
             out = pathlib.Path(options.out)
@@ -177,7 +174,6 @@ def main(argv):
     importer.add_argument('file')
     root = commands.add_parser('root', help='the root CA')
     root_actions = root.add_subparsers(dest='action', required=True, parser_class=Parser)
-    root_actions.add_parser('import-cert', help="place an existing root's certificate").add_argument('file')
     exporter = root_actions.add_parser('export-key', help='write the root key encrypted with the passphrase from stdin')
     exporter.add_argument('--out', required=True, help='the file to write')
     remover = root_actions.add_parser('remove-key', help='remove the root key from the router')
@@ -193,6 +189,8 @@ def main(argv):
         code, message = failure.status, str(failure)
     except OSError as exc:
         code, message = 1, str(exc)
+    except ldap.LDAPError as exc:
+        code, message = 1, f'the directory, which holds the PKI, failed: {exc}'
     except SystemExit as exc:
         code, message = 1, str(exc.code)
     else: