Skip to content
CertVaultCertVault
CertVault certificate inventory dashboard

CertVault

One focused control plane for issuing, renewing, protecting, and distributing every TLS certificate in your homelab.
Get startedView on GitHub

One vault for every TLS certificate

Section titled “One vault for every TLS certificate”

CertVault automates DNS-01 issuance while keeping certificate material protected and distribution tightly scoped.

Automated issuance

Obtain wildcard and multi-domain certificates through any DNS provider supported by lego.

Protected material

Keep ACME account keys and certificate private keys authenticated-encrypted at rest.

Controlled delivery

Give clients only the operations and certificate artifacts they are explicitly allowed to use.

Operational clarity

Section titled “Operational clarity”

The responsive console brings validity, renewal activity, version history, ACME accounts, API keys, and audit events into one place. Explore operations.

Simple by design

Section titled “Simple by design”
DNS provider ── DNS-01 ──> CertVault ── encrypted versions ──> persistent volume
                              │
                              ├── web console for administrators
                              └── scoped HTTPS API for certificate consumers