Infisical is an open-source platform to manage and deliver app secrets, certificates (PKI), SSH credentials, and encryption keys across teams and infrastructure.
29k stars2.2k forkslast commit Actively maintained
5 self-hosted HashiCorp Vault alternatives
Secrets management and encryption platform for securely storing, controlling, and auditing access to secrets (API keys, passwords, tokens), certificates, and encryption keys. Provides dynamic secret generation, leasing/rotation, policy-based access control, and audit logging.
Alternatives to HashiCorp Vault
#2
step-ca is a private CA and ACME server for issuing and automating X.509 TLS and SSH certificates, enabling short-lived credentials and secure enrollment for teams.
8.8k stars580 forksApache-2.0last commit Actively maintained
#3
OpenBao is an open source secrets management platform to securely store, generate, lease, and revoke secrets, certificates, and encryption keys with auditing and access control.
7.2k stars546 forksMPL-2.0last commit Actively maintained
Open-source centralized ACME client to manage TLS certificates with automated renewals, API-key retrieval for clients, http-01/dns-01 challenge support, Go backend and React UI.
602 stars25 forkslast commit Actively maintained
Web-based UI for mkcert to generate, download, and monitor locally-trusted development TLS/SSL certificates with SCEP, authentication, Docker deployment, and email alerts.
222 stars12 forksGPL-3.0last commit Actively maintained
What replacing HashiCorp Vault actually involves
Every option on this page is open source and free to run on your own hardware, so you own the data and there is no subscription to cancel. 5 of 5 shipped a commit in the last six months. Licences in this list: Apache-2.0, MPL-2.0, GPL-3.0. In exchange you take on hosting, backups and updates yourself.
Browse everything in Certificates, PKI & TLS Automation.
