VaulTLS
Web application to generate and manage mTLS certificates.
876 stars 43 forks last commit first released GPL-3.0
Actively maintained
Last commit 21 Aug 2026.
VaulTLS is a self-hosted web application for generating, managing and distributing mutual TLS (mTLS) certificates. It provides a central UI and REST API to create client and server certificates, manage a local Certificate Authority, and monitor certificate expirations.
Key Features
- mTLS client and CA certificate management with UI-driven workflows
- Server certificate support (SANs) and PKCS#12 export options
- OpenID Connect (OIDC) authentication integration for SSO
- Email notifications for upcoming certificate expiration
- RESTful API for automation and integration with tooling
- Container-first distribution (Docker image) and simple reverse-proxy integration
- Optional database encryption via an environment variable to encrypt stored data
Use Cases
- Centralized issuance and distribution of client certificates for a home lab or small infrastructure
- Integrating with a reverse proxy (example Caddy configuration provided) to enforce client certificate authentication
- Automating certificate issuance and expiry notifications via the provided REST API
Limitations and Considerations
- Automatic certificate regeneration/auto-renew is listed on the roadmap and is not guaranteed in older releases
- Targeted primarily at home-lab / small deployments; lacks built-in clustering/HA storage features
VaulTLS is intended as a practical, lightweight tool to simplify mTLS workflows and certificate lifecycle management for self-hosted environments. It focuses on ease of use, container deployment, and integrations for authentication and reverse-proxy setups.
Categories:
Tags:
Tech Stack:
Similar to VaulTLS
Cert Warden
Centralized ACME certificate manager with REST API and UI
Open-source centralized ACME client to manage TLS certificates with automated renewals, API-key retrieval for clients, http-01/dns-01 challenge support, Go backend and React UI.
Kanidm
Simple, secure identity management and SSO provider
Kanidm is a secure identity management platform providing SSO, passkeys (WebAuthn), and integrations like OAuth2/OIDC, RADIUS, and LDAP gateway for legacy apps.
AuthPortal
Self-hosted SSO gateway for Plex, Jellyfin and Emby
Lightweight Go-based authentication gateway that provides unified SSO for Plex, Jellyfin, and Emby users with OIDC, MFA and an admin console. Runs in Docker and stores profiles in Postgres.
GiftManager
Web app to organize and track gift ideas for families
Manage gift ideas, avoid duplicate purchases, coordinate Secret Santa, track bought gifts, support multiple families with admin dashboard and OIDC authentication.
Authelia
Self-hosted IAM with SSO and multi-factor authentication
Authelia is an open-source IAM and authentication server providing SSO, MFA, and access control for web apps, with OpenID Connect/OAuth 2.0 and reverse-proxy integration.
OAuth2 Proxy
Reverse proxy and middleware for OAuth2/OIDC authentication
OAuth2 Proxy is a reverse proxy and middleware that protects web apps with OAuth2/OIDC login and forwards authenticated user identity to upstream services.