Keywhiz - A system for distributing and managing secrets

---

Keywhiz is a system for managing and distributing secrets. Keywhiz servers in a cluster centrally store secrets encrypted in a database. Clients use mutually authenticated TLS (mTLS) to retrieve secrets they have access to. Authenticated users administer Keywhiz via CLI or web app UI. To enable workflows, Keywhiz has automation APIs over mTLS and support for simple secret generation plugins.

secret-store password-management certificate-management tokens certificate secret

Vault - A tool for managing secrets

---

Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Vault handles leasing, key revocation, key rolling, and auditing. Vault presents a unified API to access multiple backends: HSMs, AWS IAM, SQL databases, raw key/value, and more.

secret-store password-management certificate-management tokens certificate secret

acme - :lock: acmetool, an automatic certificate acquisition tool for ACME (Let's Encrypt)

---

acmetool is an easy-to-use command line tool for automatically acquiring certificates from ACME servers (such as Let's Encrypt). Designed to flexibly integrate into your webserver setup to enable automatic verification. Unlike the official Let's Encrypt client, this doesn't modify your web server configuration.You can perform verifications using port 80 or 443 (if you don't yet have a server running on one of them); via webroot; by configuring your webserver to proxy requests for /.well-known/acme-challenge/ to a special port (402) which acmetool can listen on; or by configuring your webserver not to listen on port 80, and instead running acmetool's built in HTTPS redirector (and challenge responder) on port 80. This is useful if all you want to do with port 80 is redirect people to port 443.

acmetool certificate acme-server acme letsencrypt ssl tls x509 security

dehydrated - letsencrypt/acme client implemented as a shell-script – just add water

---

It uses the openssl utility for everything related to actually handling keys and certificates, so you need to have that installed. Please keep in mind that this software and even the acme-protocol are relatively young and may still have some unresolved issues. Feel free to report any issues you find with this script or contribute by submitting a pull request.

certificate signing letsencrypt acme bash

boulder - An ACME-based CA, written in Go.

---

This is an implementation of an ACME-based CA. The ACME protocol allows the CA to automatically verify that an applicant for a certificate actually controls an identifier, and allows domain holders to issue and revoke certificates for their domains.Boulder has a Dockerfile to make it easy to install and set up all its dependencies. This is how the maintainers work on Boulder, and is our main recommended way to run it.

boulder acme certificate-authority tls lets-encrypt ca pki certificate security

forge - A native implementation of TLS in Javascript and tools to write crypto-based and network-heavy webapps

---

A native implementation of TLS (and various other cryptographic tools) in JavaScript. The Forge software is a fully native implementation of the TLS protocol in JavaScript, a set of cryptography utilities, and a set of tools for developing Web Apps that utilize many network resources.

crypto cryptography x509 message-digest aes asn1 cipher pkcs tls certificate pkcs7 pkcs1 pkcs12 pbkdf2 csr hmac sha1 sha256 md5 asn asn.1 cbc des gcm http https network pki prng rc2 rsa sha384 sha512 ssh x.509

Confidant - Your Secret Keeper. Stores secrets in DynamoDB, encrypted at rest.

---

Confidant is a open source secret management service that provides user-friendly storage and access to secrets in a secure way, from the developers at Lyft. Confidant stores secrets in an append-only way in DynamoDB, generating a unique KMS data key for every revision of every secret, using Fernet symmetric authenticated cryptography.

secret-store password-management certificate-management tokens certificate secret aws kms

certstrap - Tools to bootstrap CAs, certificate requests, and signed certificates.

---

A simple certificate manager written in Go, to bootstrap your own certificate authority and public key infrastructure. Adapted from etcd-ca.certstrap is a very convenient app if you don't feel like dealing with openssl, its myriad of options or config files.

crypto certificate bootstrap certificate-authority ssl csr tls

Lego - Let's Encrypt client and ACME library

---

Let's Encrypt client and ACME library written in Go.

letsencrypt acme certificate security letsencrypt-client

Ejbca - PKI Certificate Authority software

---

EJBCA is an enterprise class PKI Certificate Authority software. It supports SSL/TLS, Smart card logon to Windows and/or Linux, Signing and encrypting email (SMIME), Mobile PKI, Secure mobile networks and lot more.

certificate-authority certificate s-mime pki cryptography security ssl

PolarSSL library - Crypto and SSL made easy

---

Download PolarSSL PolarSSL is an SSL library written in ANSI C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) products with as little hassle as possible. It is designed to be readable, documented, tested, loosely coupled and portable. It supports Symmetric encryption algorithms, hash algorithms, RSA with PKCS and X.509 certificate, SSL and TLS.

crypto security certificate ssl tls

Dogtag - Certificate System

---

The Dogtag Certificate System is an enterprise-class open source Certificate Authority (CA). It is a full-featured system, and has been hardened by real-world deployments. It supports all aspects of certificate lifecycle management, including key archival, OCSP and smartcard management, and much more. It supports Certificate issuance, revocation, and retrieval, Certificate Revocation List (CRL) generation and publishing, Encryption key archival and recovery and lot more.

certificate-authority certificate certificate-management pki cryptography security

OpenCA - PKI Management Software

---

The OpenCA PKI Development Project is a collaborative effort to develop a robust, full-featured and Open Source out-of-the-box Certification Authority implementing the most used protocols with full-strength cryptography world-wide. The project development is divided in two main tasks: studying and refining the security scheme that guarantees the best model to be used in a CA and developing software to easily setup and manage a Certification Authority.

certificate-authority certificate pki cryptography digital-signature security

certigo - A utility to examine and validate certificates in a variety of formats

---

Certigo is a utility to examine and validate certificates to help with debugging SSL/TLS issues.Supports all common file formats: Certigo can read and dump certificates in various formats. It can automatically detect and read from X.509 (DER/PEM), JCEKS, PKCS7 and PKCS12 files. Certificates can be dumped to a human-readable format, a set of PEM blocks, or a JSON object for use in scripting.

tls certificate ssl command-line-app crypto keystore pem x509 pkcs12 jceks pkcs7 cli

sharkey - Sharkey is a service for managing certificates for use by OpenSSH

---

Sharkey is a service for managing certificates for use by OpenSSH.Sharkey has a client component and a server component. The server is responsible for issuing signed host certificates, the client is responsible for installing host certificates on machines. Sharkey builds on the trust relationships of your existing X.509 PKI to manage trusted SSH certificates. Existing X.509 certificates can be minted into SSH certificates, so you don't have to maintain two separate PKI hierarchies.

openssh certificate enterprise-software trust-on-first-use tofu crypto ssh certificates pki

EasyCert - EasyCert quickly generates web server TLS certificates that have been self-signed by a private certificate authority that it also creates

---

Use EasyCert to easily generate webserver certificates against a private certificate authority that is also generated by this tool. Why would you want to use this? This should only be used within company networks, never public facing. You would use this to implement your own TLS connections where you are dealing in a test environment where the security doesn't really matter. This is more about making sure things work across https correctly. In other words, when you are working on anything production-level you'd want to acquire a genuine certificate from a trusted certificate authority and probably pay for it or better yet use LetsEncrypt.This has been tested and run on OSX which is comes pre-installed with openssl, that is all you need.

certificate-authority certificate cli openssl

app-certificate-requests - 🎖 Repository for requesting app certificates

---

🎖 Repository for requesting app certificates

nextcloud certificate appstore

https-pem - Self-signed PEM key and certificate ready for use in your HTTPS server

---

Self-signed PEM key and certificate ready for use in your HTTPS server.A dead simple way to get an HTTPS server running in development with no need to generate the self signed PEM key and certificate.

tls https pem key keys cert certificate selfsigned self-signed development options server

create-cert - Super simple self signed certificates

---

create-cert is a convenient wrapper around the pem module. It generates a self signed certificate with sensible defaults along with an associated CA certificate to validate against. It has a Promise based API and returns the keys in a format that can be passed directly into https.createServer.Returns a Promise which resolves to a keys object.

ssl ssl-certificates ssl-certificate https self-signed self-signed-certificate certificate self signed cert

peerca - generate ssl certificates for authentication

---

Instead of paying a lot of money to get a certificate signed by an NSA-approved certificate authority, with peerca each server explicitly signs the certificates that are allowed to connect to it. This is similar to how the authorized_keys file works in ssh but for TLS certificates.This package mostly shells out to openssl commands.

certificate ca tls ssl authentication auth authorized_keys authorize https docker