Keywhiz - A system for distributing and managing secrets

•    Java

---

Keywhiz is a system for managing and distributing secrets. Keywhiz servers in a cluster centrally store secrets encrypted in a database. Clients use mutually authenticated TLS (mTLS) to retrieve secrets they have access to. Authenticated users administer Keywhiz via CLI or web app UI. To enable workflows, Keywhiz has automation APIs over mTLS and support for simple secret generation plugins.

secret-store password-management certificate-management tokens certificate secret

Vault - A tool for managing secrets

•    Go

---

Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Vault handles leasing, key revocation, key rolling, and auditing. Vault presents a unified API to access multiple backends: HSMs, AWS IAM, SQL databases, raw key/value, and more.

secret-store password-management certificate-management tokens certificate secret

acme - :lock: acmetool, an automatic certificate acquisition tool for ACME (Let's Encrypt)

•    Go

---

acmetool is an easy-to-use command line tool for automatically acquiring certificates from ACME servers (such as Let's Encrypt). Designed to flexibly integrate into your webserver setup to enable automatic verification. Unlike the official Let's Encrypt client, this doesn't modify your web server configuration.You can perform verifications using port 80 or 443 (if you don't yet have a server running on one of them); via webroot; by configuring your webserver to proxy requests for /.well-known/acme-challenge/ to a special port (402) which acmetool can listen on; or by configuring your webserver not to listen on port 80, and instead running acmetool's built in HTTPS redirector (and challenge responder) on port 80. This is useful if all you want to do with port 80 is redirect people to port 443.

acmetool certificate acme-server acme letsencrypt ssl tls x509 security

dehydrated - letsencrypt/acme client implemented as a shell-script – just add water

•    Shell

---

It uses the openssl utility for everything related to actually handling keys and certificates, so you need to have that installed. Please keep in mind that this software and even the acme-protocol are relatively young and may still have some unresolved issues. Feel free to report any issues you find with this script or contribute by submitting a pull request.

certificate signing letsencrypt acme bash

boulder - An ACME-based CA, written in Go.

•    Go

---

This is an implementation of an ACME-based CA. The ACME protocol allows the CA to automatically verify that an applicant for a certificate actually controls an identifier, and allows domain holders to issue and revoke certificates for their domains.Boulder has a Dockerfile to make it easy to install and set up all its dependencies. This is how the maintainers work on Boulder, and is our main recommended way to run it.

boulder acme certificate-authority tls lets-encrypt ca pki certificate security

forge - A native implementation of TLS in Javascript and tools to write crypto-based and network-heavy webapps

•    Javascript

---

A native implementation of TLS (and various other cryptographic tools) in JavaScript. The Forge software is a fully native implementation of the TLS protocol in JavaScript, a set of cryptography utilities, and a set of tools for developing Web Apps that utilize many network resources.

crypto cryptography x509 message-digest aes asn1 cipher pkcs tls certificate pkcs7 pkcs1 pkcs12 pbkdf2 csr hmac sha1 sha256 md5 asn asn.1 cbc des gcm http https network pki prng rc2 rsa sha384 sha512 ssh x.509

docker-compose-letsencrypt-nginx-proxy-companion - Automated docker nginx proxy integrated with letsencrypt

•    Shell

---

With this repo you will be able to set up your server with multiple sites using a single NGINX proxy to manage your connections, automating your apps container (port 80 and 443) to auto renew your ssl certificates with Let´s Encrypt. Update this file with your preferences.

nginx-proxy certificate letsencrypt docker docker-compose nginx letsencrypt-certificates

certbot - Certbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server

•    Python

---

Certbot is part of EFF’s effort to encrypt the entire Internet. Secure communication over the Web relies on HTTPS, which requires the use of a digital certificate that lets browsers verify the identity of web servers (e.g., is that really google.com?). Web servers obtain their certificates from trusted third parties called certificate authorities (CAs). Certbot is an easy-to-use client that fetches a certificate from Let’s Encrypt—an open certificate authority launched by the EFF, Mozilla, and others—and deploys it to a web server. Anyone who has gone through the trouble of setting up a secure website knows what a hassle getting and maintaining a certificate is. Certbot and Let’s Encrypt can automate away the pain and let you turn on and manage HTTPS with simple commands. Using Certbot and Let's Encrypt is free, so there’s no need to arrange payment.

acme acme-client certbot certificate letsencrypt

cert-manager - Automatically provision and manage TLS certificates in Kubernetes

•    Go

---

cert-manager is a Kubernetes add-on to automate the management and issuance of TLS certificates from various issuing sources. It will ensure certificates are valid and up to date periodically, and attempt to renew certificates at an appropriate time before expiry.

kubernetes letsencrypt tls certificate crd

WeIdentity - 基于区块链的符合W3C DID和Verifiable Credential规范的分布式身份解决方案

•    Java

---

基于区块链的符合W3C DID和Verifiable Credential规范的分布式身份解决方案

identity certificate w3c blockchain distributed digital-signature data-exchange consortium kyc did privacy-protection privacy-preserving distributed-identity verifiable-credentials dpki selective-disclosure verifiable-presentation weid weidentity weid-java-sdk

certstrap - Tools to bootstrap CAs, certificate requests, and signed certificates.

•    Go

---

A simple certificate manager written in Go, to bootstrap your own certificate authority and public key infrastructure. Adapted from etcd-ca.certstrap is a very convenient app if you don't feel like dealing with openssl, its myriad of options or config files.

crypto certificate bootstrap certificate-authority ssl csr tls

Lego - Let's Encrypt client and ACME library

•    Go

---

Let's Encrypt client and ACME library written in Go.

letsencrypt acme certificate security letsencrypt-client

Ejbca - PKI Certificate Authority software

•    Java

---

EJBCA is an enterprise class PKI Certificate Authority software. It supports SSL/TLS, Smart card logon to Windows and/or Linux, Signing and encrypting email (SMIME), Mobile PKI, Secure mobile networks and lot more.

certificate-authority certificate s-mime pki cryptography security ssl

PolarSSL library - Crypto and SSL made easy

•    C

---

Download PolarSSL PolarSSL is an SSL library written in ANSI C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) products with as little hassle as possible. It is designed to be readable, documented, tested, loosely coupled and portable. It supports Symmetric encryption algorithms, hash algorithms, RSA with PKCS and X.509 certificate, SSL and TLS.

crypto security certificate ssl tls

kube-cert-manager - Manage Lets Encrypt certificates for a Kubernetes cluster.

•    Go

---

This project is loosely based on https://github.com/kelseyhightower/kube-cert-manager It took over most of its documentation, license, as well as the general approach to how things work. The code itself however, was entirely reimplemented to use xenolf/lego as the basis, instead of reimplementing an ACME client and DNS plugins.

certificate kubernetes tls letsencrypt

Confidant - Your Secret Keeper. Stores secrets in DynamoDB, encrypted at rest.

•    Python

---

Confidant is a open source secret management service that provides user-friendly storage and access to secrets in a secure way, from the developers at Lyft. Confidant stores secrets in an append-only way in DynamoDB, generating a unique KMS data key for every revision of every secret, using Fernet symmetric authenticated cryptography.

secret-store password-management certificate-management tokens certificate secret aws kms

Dogtag - Certificate System

•    Java

---

The Dogtag Certificate System is an enterprise-class open source Certificate Authority (CA). It is a full-featured system, and has been hardened by real-world deployments. It supports all aspects of certificate lifecycle management, including key archival, OCSP and smartcard management, and much more. It supports Certificate issuance, revocation, and retrieval, Certificate Revocation List (CRL) generation and publishing, Encryption key archival and recovery and lot more.

certificate-authority certificate certificate-management pki cryptography security

OpenCA - PKI Management Software

•    Javascript

---

The OpenCA PKI Development Project is a collaborative effort to develop a robust, full-featured and Open Source out-of-the-box Certification Authority implementing the most used protocols with full-strength cryptography world-wide. The project development is divided in two main tasks: studying and refining the security scheme that guarantees the best model to be used in a CA and developing software to easily setup and manage a Certification Authority.

certificate-authority certificate pki cryptography digital-signature security

pem - Create private keys and certificates with node.js

•    Javascript

---

Here are some examples for creating an SSL key/cert on the fly, and running an HTTPS server on port 443. 443 is the standard HTTPS port, but requires root permissions on most systems. To get around this, you could use a higher port number, like 4300, and use https://localhost:4300 to access your server. Please have a look into the API documentation.

certificate csr certificate-signing-request tls-certificate tls signing pem ssl-certificate ssl nodejs signing-certificates

letsencrypt-webfaction - LetsEncrypt utility client for WebFaction hosts.

•    Ruby

---

LetsEncrypt utility client for WebFaction hosts. NOTE: Version 3 is out and requires some manual changes. See the upgrade guide for details.

webfaction letsencrypt certificate cron