Displaying 1 to 20 from 34 results

Keywhiz - A system for distributing and managing secrets


Keywhiz is a system for managing and distributing secrets. Keywhiz servers in a cluster centrally store secrets encrypted in a database. Clients use mutually authenticated TLS (mTLS) to retrieve secrets they have access to. Authenticated users administer Keywhiz via CLI or web app UI. To enable workflows, Keywhiz has automation APIs over mTLS and support for simple secret generation plugins.

Vault - A tool for managing secrets


Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Vault handles leasing, key revocation, key rolling, and auditing. Vault presents a unified API to access multiple backends: HSMs, AWS IAM, SQL databases, raw key/value, and more.

acme - :lock: acmetool, an automatic certificate acquisition tool for ACME (Let's Encrypt)


acmetool is an easy-to-use command line tool for automatically acquiring certificates from ACME servers (such as Let's Encrypt). Designed to flexibly integrate into your webserver setup to enable automatic verification. Unlike the official Let's Encrypt client, this doesn't modify your web server configuration.You can perform verifications using port 80 or 443 (if you don't yet have a server running on one of them); via webroot; by configuring your webserver to proxy requests for /.well-known/acme-challenge/ to a special port (402) which acmetool can listen on; or by configuring your webserver not to listen on port 80, and instead running acmetool's built in HTTPS redirector (and challenge responder) on port 80. This is useful if all you want to do with port 80 is redirect people to port 443.

dehydrated - letsencrypt/acme client implemented as a shell-script – just add water


It uses the openssl utility for everything related to actually handling keys and certificates, so you need to have that installed. Please keep in mind that this software and even the acme-protocol are relatively young and may still have some unresolved issues. Feel free to report any issues you find with this script or contribute by submitting a pull request.




boulder - An ACME-based CA, written in Go.


This is an implementation of an ACME-based CA. The ACME protocol allows the CA to automatically verify that an applicant for a certificate actually controls an identifier, and allows domain holders to issue and revoke certificates for their domains.Boulder has a Dockerfile to make it easy to install and set up all its dependencies. This is how the maintainers work on Boulder, and is our main recommended way to run it.

forge - A native implementation of TLS in Javascript and tools to write crypto-based and network-heavy webapps


A native implementation of TLS (and various other cryptographic tools) in JavaScript. The Forge software is a fully native implementation of the TLS protocol in JavaScript, a set of cryptography utilities, and a set of tools for developing Web Apps that utilize many network resources.

Confidant - Your Secret Keeper. Stores secrets in DynamoDB, encrypted at rest.


Confidant is a open source secret management service that provides user-friendly storage and access to secrets in a secure way, from the developers at Lyft. Confidant stores secrets in an append-only way in DynamoDB, generating a unique KMS data key for every revision of every secret, using Fernet symmetric authenticated cryptography.

certstrap - Tools to bootstrap CAs, certificate requests, and signed certificates.


A simple certificate manager written in Go, to bootstrap your own certificate authority and public key infrastructure. Adapted from etcd-ca.certstrap is a very convenient app if you don't feel like dealing with openssl, its myriad of options or config files.



Ejbca - PKI Certificate Authority software


EJBCA is an enterprise class PKI Certificate Authority software. It supports SSL/TLS, Smart card logon to Windows and/or Linux, Signing and encrypting email (SMIME), Mobile PKI, Secure mobile networks and lot more.

PolarSSL library - Crypto and SSL made easy


Download PolarSSL PolarSSL is an SSL library written in ANSI C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) products with as little hassle as possible. It is designed to be readable, documented, tested, loosely coupled and portable. It supports Symmetric encryption algorithms, hash algorithms, RSA with PKCS and X.509 certificate, SSL and TLS.

Dogtag - Certificate System


The Dogtag Certificate System is an enterprise-class open source Certificate Authority (CA). It is a full-featured system, and has been hardened by real-world deployments. It supports all aspects of certificate lifecycle management, including key archival, OCSP and smartcard management, and much more. It supports Certificate issuance, revocation, and retrieval, Certificate Revocation List (CRL) generation and publishing, Encryption key archival and recovery and lot more.

OpenCA - PKI Management Software


The OpenCA PKI Development Project is a collaborative effort to develop a robust, full-featured and Open Source out-of-the-box Certification Authority implementing the most used protocols with full-strength cryptography world-wide. The project development is divided in two main tasks: studying and refining the security scheme that guarantees the best model to be used in a CA and developing software to easily setup and manage a Certification Authority.

certigo - A utility to examine and validate certificates in a variety of formats


Certigo is a utility to examine and validate certificates to help with debugging SSL/TLS issues.Supports all common file formats: Certigo can read and dump certificates in various formats. It can automatically detect and read from X.509 (DER/PEM), JCEKS, PKCS7 and PKCS12 files. Certificates can be dumped to a human-readable format, a set of PEM blocks, or a JSON object for use in scripting.

sharkey - Sharkey is a service for managing certificates for use by OpenSSH


Sharkey is a service for managing certificates for use by OpenSSH.Sharkey has a client component and a server component. The server is responsible for issuing signed host certificates, the client is responsible for installing host certificates on machines. Sharkey builds on the trust relationships of your existing X.509 PKI to manage trusted SSH certificates. Existing X.509 certificates can be minted into SSH certificates, so you don't have to maintain two separate PKI hierarchies.

EasyCert - EasyCert quickly generates web server TLS certificates that have been self-signed by a private certificate authority that it also creates


Use EasyCert to easily generate webserver certificates against a private certificate authority that is also generated by this tool. Why would you want to use this? This should only be used within company networks, never public facing. You would use this to implement your own TLS connections where you are dealing in a test environment where the security doesn't really matter. This is more about making sure things work across https correctly. In other words, when you are working on anything production-level you'd want to acquire a genuine certificate from a trusted certificate authority and probably pay for it or better yet use LetsEncrypt.This has been tested and run on OSX which is comes pre-installed with openssl, that is all you need.

https-pem - Self-signed PEM key and certificate ready for use in your HTTPS server


Self-signed PEM key and certificate ready for use in your HTTPS server.A dead simple way to get an HTTPS server running in development with no need to generate the self signed PEM key and certificate.

create-cert - Super simple self signed certificates


create-cert is a convenient wrapper around the pem module. It generates a self signed certificate with sensible defaults along with an associated CA certificate to validate against. It has a Promise based API and returns the keys in a format that can be passed directly into https.createServer.Returns a Promise which resolves to a keys object.

peerca - generate ssl certificates for authentication


Instead of paying a lot of money to get a certificate signed by an NSA-approved certificate authority, with peerca each server explicitly signs the certificates that are allowed to connect to it. This is similar to how the authorized_keys file works in ssh but for TLS certificates.This package mostly shells out to openssl commands.