Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Vault handles leasing, key revocation, key rolling, and auditing. Vault presents a unified API to access multiple backends: HSMs, AWS IAM, SQL databases, raw key/value, and more. 

Vault - A tool for managing secrets

cert-manager is a Kubernetes add-on to automate the management and issuance of TLS certificates from various issuing sources. It will ensure certificates are valid and up to date periodically, and attempt to renew certificates at an appropriate time before expiry.
<BR><BR>
It is easy to use Kubernetes-native certificate management. It supports Let's Encrypt, HashiCorp Vault, Venafi and private PKI. 

cert-manager is a Kubernetes add-on to automate the management and issuance of TLS certificates from various issuing sources. It will ensure certificates are valid and up to date periodically, and attempt to renew certificates at an appropriate time before expiry.

cert-manager - Automatically provision and manage TLS certificates in Kubernetes

Keywhiz is a system for managing and distributing secrets.  Keywhiz servers in a cluster centrally store secrets encrypted in a database. Clients use mutually authenticated TLS (mTLS) to retrieve secrets they have access to. Authenticated users administer Keywhiz via CLI or web app UI. To enable workflows, Keywhiz has automation APIs over mTLS and support for simple secret generation plugins.

Keywhiz -  A system for distributing and managing secrets

Download PolarSSL PolarSSL is an SSL library written in ANSI C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) products with as little hassle as possible. It is designed to be readable, documented, tested, loosely coupled and portable. It supports Symmetric encryption algorithms, hash algorithms, RSA with PKCS and X.509 certificate, SSL and TLS.

PolarSSL library - Crypto and SSL made easy

EJBCA is an enterprise class PKI Certificate Authority software. It supports SSL/TLS, Smart card logon to Windows and/or Linux, Signing and encrypting email (SMIME), Mobile PKI, Secure mobile networks and lot more.

Ejbca - PKI Certificate Authority software

Let's Encrypt client and ACME library written in Go.
<BR><BR>
Its feature include: 
<ul>
<li>Register with CA</li>
<li>Obtain certificates, both from scratch or with an existing CSR</li>
<li>Renew certificates</li>
<li>Revoke certificates</li>
<li>Robust implementation of all ACME challenges
<ul>
<li>HTTP (http-01)</li>
<li>TLS with Server Name Indication (tls-sni-01)</li>
<li>DNS (dns-01)</li>
</ul>
</li>
<li>SAN certificate support</li>
<li>Comes with multiple optional <a href="https://github.com/xenolf/lego/tree/master/providers/dns">DNS providers</a></li>
<li><a href="https://github.com/xenolf/lego/wiki/Writing-a-Challenge-Solver">Custom challenge solvers</a></li>
<li>Certificate bundling</li>
<li>OCSP helper function</li>
</ul>

Let's Encrypt client and ACME library written in Go.

Lego - Let's Encrypt client and ACME library

Confidant is a open source secret management service that provides user-friendly storage and access to secrets in a secure way, from the developers at Lyft.  Confidant stores secrets in an append-only way in DynamoDB, generating a unique KMS data key for every revision of every secret, using Fernet symmetric authenticated cryptography. 

Confidant - Your Secret Keeper. Stores secrets in DynamoDB, encrypted at rest.

The Dogtag Certificate System is an enterprise-class open source Certificate Authority (CA). It is a full-featured system, and has been hardened by real-world deployments. It supports all aspects of certificate lifecycle management, including key archival, OCSP and smartcard management, and much more. It supports Certificate issuance, revocation, and retrieval, Certificate Revocation List (CRL) generation and publishing, Encryption key archival and recovery and lot more.

Dogtag - Certificate System

Websockify is a WebSocket to TCP proxy/bridge. This allows a browser to connect to any application/server/service. Implementations in Python, C, Node.js and Ruby. websockify just translates WebSockets traffic to normal socket traffic. Websockify accepts the WebSockets handshake, parses it, and then begins forwarding traffic between the client and the target in both directions.

websockify - WebSockets support for any application/server


The OpenCA PKI Development Project is a collaborative effort to develop a robust, full-featured and Open Source out-of-the-box Certification Authority implementing the most used protocols with full-strength cryptography world-wide.  The project development is divided in two main tasks: studying and refining the security scheme that guarantees the best model to be used in a CA and developing software to easily setup and manage a Certification Authority. 

OpenCA - PKI Management Software

webpki is a library that validates Web PKI (TLS/SSL) certificates. webpki is designed to provide a full implementation of the client side of the Web PKI to a diverse range of applications and devices, including embedded (IoT) applications, mobile apps, desktop applications, and server infrastructure.

webpki - WebPKI X.509 Certificate Validation in Rust

Discover open source projects across all platforms

Projects