← Directory

CertVault

CertVault is a self-hosted platform that automates the issuance, renewal, and lifecycle management of self-signed SSL/TLS certificates.

  • Tools & Utilities
CertVault is a self-hosted platform that automates the issuance, renewal, and lifecycle management of self-signed SSL/TLS certificates. It pairs a Vue.js web interface with a Spring Boot backend and adds role-based access control (RBAC), multi-environment deployment, built-in Prometheus metrics, and OpenID Connect (OIDC) authentication. Deploy it with Docker Compose or a Helm chart to issue and track internal certificates without relying on a public certificate authority.

Platform availability

Available on 1 of 9 platforms

  • Unraid (not listed)
  • TrueNAS (not listed)
  • Umbrel (not listed)
  • ZimaOS (not listed)
  • Proxmox (not listed)
  • Helm
  • Mac (not listed)
  • Windows (not listed)
  • Linux (not listed)

Health score

Not enough data yet for a health score. It needs at least 2 of 4 factors: maintenance, popularity, ease of install, resource needs.

Availability: platform listings confirmed today

GitHub stars
7
Open issues
1
Last commit
2025-12-16
Latest release
v2.11.0
License
Apache-2.0
Activity
stale

Checked today - source: GitHub (gregPerlinLi/CertVault)

Resources & Compatibility

Requirements not published yet.

First-install notes

  • Have a working Kubernetes cluster first Cert-manager is installed inside a Kubernetes cluster (a group of machines that run containers), so make sure that cluster is running and that kubectl (the command-line tool that talks to it) can connect. Without that, the install command fails and cert-manager has nowhere to create or manage certificates. source
  • Use one install method, not both For a standard Helm install (Helm is a Kubernetes package manager), use the OCI command (OCI is a container-image registry) that creates the cert-manager namespace (a named area in the cluster) and enables CRDs (the custom Kubernetes objects that let cert-manager track certificates). Stick to either Helm or the static manifest so duplicate cert-manager controllers do not compete and cause confusin source
  • Static manifest is the no-Helm option If you do not want to use Helm, apply the official single-file cert-manager.yaml with kubectl. This is a simple all-in-one install, but it still installs the same core parts, so do not apply it on top of a Helm installation. source
  • Docker Compose or Helm, with MySQL or PostgreSQL CertVault ships deployment solutions via Docker Compose for standalone setups and Helm charts for Kubernetes environments, and requires a MySQL or PostgreSQL database. The web interface is built with Vue.js 3 and the backend with Spring Boot 3. source

Fetched today - each note links to its source

Alternatives (3)

  • Arca Secrets - The local secrets manager for humans and AI agents.
  • Infisical - Infisical is the open-source platform for secrets, certificates, and privileged access management.
  • Passbolt - Passbolt Community Edition (CE) API.

Checked 11 days ago - source: AlternativeTo

Common questions

When using self-signed certificates, do I have to trust the certificate on every device?

It depends. You can either manually trust the certificate on each device or deal with browser warnings. The traffic is encrypted whether the certificate is publicly trusted or self-signed.

Why might mTLS or client certificate authentication be impractical for a self-hosted service?

Distributing certificates to users can be cumbersome, especially for larger organizations. It is more practical when the self-hosted service is used by only a few trusted people.

What should I do if I cannot sign in or register for CertVault?

Contact the CertVault helpdesk if you have trouble signing in or registering.

Answers sourced from certvault.org, www.reddit.com, www.redditmedia.com

Community

Collected 7 days ago - public community threads