Ultimate Certificate Manager, or UCM, runs your own certificate authority from a web interface, so issuing, renewing, and revoking certificates stops being a pile of OpenSSL commands. Create root and intermediate CAs, arrange them in a hierarchy, and manage every certificate through its life: issue, sign, renew in place, revoke with a reason, and export as PEM, DER, PKCS#12, or JKS. Devices and servers enroll themselves through ACME, SCEP, and EST endpoints, while OCSP answers status checks in real time and CRL distribution points publish revocations on schedule. Network discovery scans your address space and reports the certificates it finds, so expiring or unknown certificates surface before they cause an outage. Templates define server, client, code-signing, email, and smartcard profiles, with key types from RSA and elliptic curves to post-quantum ML-DSA, and issuance policies can route sensitive requests through an approval queue. Signing keys can live in an HSM so private material never leaves the hardware, and every key at rest can be encrypted under a master key. Operators sign in with passwords, TOTP, WebAuthn, mTLS, LDAP, OAuth2, or SAML, and role-based permissions decide who may issue, approve, or merely audit. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Your internal services deserve certificates your browsers actually trust, without a spreadsheet tracking when each one expires. mkcertWeb wraps the mkcert tool in a web interface where you generate certificates for any mix of hostnames, wildcards, and IP addresses, then download them as PEM, CRT, or PKCS#12 bundles for servers and client authentication. The certificate list groups everything by state, needs attention, healthy, read-only, or archived, showing days remaining, subject alternative names, and SHA-256 fingerprints at a glance. You can upload existing certificate and key files for viewing, attach a free-text note to each certificate, and archive or restore entries without ever overwriting a certificate of the same name. The root CA page offers downloads and install instructions for macOS, Linux, and Windows, and can generate a fresh CA for a new deployment. Devices enroll through the built-in SCEP server using one-time challenge passwords and templates, with an optional enterprise CA signing manual enrollments. A scheduled monitor checks expiry daily and sends alerts through SMTP email, ntfy, or an HTTP webhook, with test buttons for every channel. Settings save from the browser with secret masking, sign-in supports passwords or OpenID Connect single sign-on, and light and dark themes work down to phone width. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Automate your entire SSL and TLS lifecycle with Certimate, an infrastructure-grade certificate management platform that handles domain verification, ACME issuance, scheduled renewals, and multi-cloud deployment from one unified control plane. A drag-and-drop workflow designer lets administrators construct visual pipelines linking domain validation, certificate issuance from Let's Encrypt or ZeroSSL, and automated distribution to edge destinations. Built-in automation interfaces connect with over seventy DNS providers to handle automated DNS-01 challenge record creation and cleanup without manual API scripting. Engineers can deploy renewed certificates directly to Nginx, Apache, Traefik, and Caddy instances via automated SSH commands or native webhooks. Cloud delivery workflows push updated certificates to AWS CloudFront, Cloudflare, Alibaba Cloud, Tencent Cloud, and Kubernetes Ingress secrets without service interruption. The web management console tracks expiration dates across multiple domains, highlights failing renewal attempts, and dispatches instant alerts through email, Telegram, DingTalk, and enterprise webhooks before outages occur. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Certificate lifetimes are collapsing toward 47 days, which turns TLS from a yearly chore into a weekly one, and CertMate is the control plane that makes that schedule boring. It issues and renews certificates from Let's Encrypt, ZeroSSL, Google Trust Services, Actalis, DigiCert, SSL.com, Sectigo, or your own private CA, validating by DNS-01 through 29 DNS providers, HTTP-01, or a CSR whose private key never leaves the device. Renewals run automatically, earlier when a certificate's life is short or the CA moves the date through ARI, and deploy hooks push each renewed certificate where it is actually served, then probe the live endpoint to prove the new certificate answers. Discovery watches hosts and certificate transparency logs for certificates you did not issue, folding them into one inventory of what is served where and when it expires. Certificates rest on local disk or in Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, Infisical, or S3 storage, with encrypted backups copied off-site. Its built-in CA issues client certificates for mTLS with OCSP and CRL, and can serve ACME itself, so certbot, lego, acme.sh, and cert-manager get internal certificates under EAB rules you define. Every action lands in a tamper-evident, hash-chained audit trail you can export and verify independently. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 36,000 GitHub stars and adoption by organizations including Adobe, Shopify, and Roblox, HashiCorp Vault is the industry-standard platform for secrets management, encryption services, and privileged access control across hybrid and multi-cloud infrastructure. The key/value secrets engine stores arbitrary secrets with full versioning, soft-delete, and metadata tracking, while dynamic secrets engines generate on-demand, short-lived credentials for AWS, Azure, GCP, databases including PostgreSQL, MySQL, MongoDB, and MSSQL, and SSH access with automatic revocation after configurable lease periods. The PKI secrets engine dynamically issues X.509 certificates on demand with automatic rotation and ACME protocol support, eliminating manual certificate management workflows entirely. Encryption as a service through the transit secrets engine lets applications encrypt, decrypt, sign, verify, and generate HMACs without managing cryptographic keys directly, supporting AES-GCM-256, ChaCha20-Poly1305, RSA-2048/4096, ECDSA-P256/P384, and ED25519 algorithms. Authentication integrates with LDAP, OIDC/OAuth2, SAML, AppRole for machine-to-machine access, Kubernetes service accounts, AWS IAM, Azure Active Directory, and GitHub tokens. Fine-grained ACL policies use path-based rules with glob patterns and sentinel policies for programmatic enforcement. The integrated Raft storage backend provides high-availability clustering without external dependencies, while alternative backends include Consul, S3, DynamoDB, PostgreSQL, and MySQL. The built-in web UI provides a visual interface for browsing secrets, managing policies, configuring auth methods, and monitoring cluster health. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSL 1.1 licensed.

TLSPROXY puts automatic Let's Encrypt TLS in front of every service on your server, so many names can share one port while each backend gets exactly the encryption treatment it needs. Terminate TLS and hand plain text to a local service. Pass raw TLS straight through when the proxy should see nothing. Or terminate and re-encrypt towards a TLS backend, with client certificates checked on the way in. QUIC and HTTP/3 connections terminate here too, and Encrypted Client Hello keeps even the handshake private. Certificates arrive and renew by themselves through http-01 and tls-alpn-01 challenges, PROXY protocol headers preserve real client addresses, and SNI routing with round-robin balancing spreads names across backends. People get in with OpenID Connect, SAML, or passkeys; the same sign-in can mint short-lived SSH user certificates, and built-in certificate authorities manage client and backend credentials for you. Static sites can be served straight from disk, TPM-backed keys keep private material in hardware, and a built-in console shows what the proxy is doing. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Providing an intuitive control plane for modern reverse proxy infrastructure, CaddyUI enables system administrators to manage proxy hosts, automated TLS certificates, and traffic routing without hand-editing configuration files. Operators can create and adjust reverse proxy destinations, URL path rewrites, custom headers, and redirection rules using structured forms that validate against the proxy engine before saving. The platform coordinates automatic ACME certificate requests and renewals, displaying live certificate expiration timelines, validation stages, and internal self-signed certificate authority options for local network services. Fleet management tools synchronize proxy rules across multiple distributed server instances, preventing configuration drift across staging and production clusters. Automated post-deployment health checks verify upstream endpoint availability, HTTP status codes, and latency thresholds, instantly rolling back to the previous configuration if an expectation fails. An integrated observability suite delivers real-time visitor traffic analytics, geographic maps, HTTP response code breakdowns, and single-click client IP blocking to counter malicious probing attempts. Administrators can schedule automated database backups, configure multi-user access with role permissions, and integrate CrowdSec threat intelligence to protect backends. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Ferron is a web server and reverse proxy that serves your sites and applications with automatic HTTPS, a configuration file you can read at a glance, and logs that explain exactly why a request failed. Declare a hostname with a root directive and it serves files from disk; swap in a proxy directive and the same block forwards traffic to your application on localhost, with PHP handled through one fcgi_php line to PHP-FPM. Every public hostname receives a TLS certificate automatically, issued and renewed without certificate paths or renewal scripts in your config. The differentiator is debugging: each request carries a trace ID printed in the access log, repeated in the error log lines it generates, and returned to the client inside JSON error responses, so one grep reconstructs the whole failure. The ferron doctor command validates a configuration before you reload it, pointing at the file, line, and column of each mistake and flagging violations like an overexposed directory listing. Its admin API answers /config and /status queries with live running state, and metrics and traces flow to Grafana or any OpenTelemetry collector through OTLP. Reverse proxying spreads requests across backend upstreams with health awareness and circuit breaker events you can watch live. HTTP/2 and HTTP/3 are on by default, and there are no worker counts or pool sizes waiting to be tuned. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Gately keeps your domain names current, forwards ports, terminates HTTPS, and blocks hostile traffic from one admin console, so a server or home network needs no pile of separate gateway tools. Dynamic DNS updates records at Cloudflare, Alibaba Cloud, Tencent Cloud, DNSPod, Huawei Cloud, Route 53, OVHcloud, Gandi, Namecheap, DuckDNS, and other providers, finding the public address over IPv4 or IPv6 by URL, network interface, or command. Port forwarding relays TCP and UDP with port ranges, failover targets, connection limits, traffic statistics, and PROXY protocol, while SNI routing lets several services share port 443. Certificates are issued and renewed through ACME with DNS-01 wildcards or HTTP-01, then pushed to other hosts over SSH. Web services add per-domain reverse proxies, redirects, and static sites with HTTP/3, WebSocket, load balancing, health checks, rate limiting, caching, and sign-in through OIDC, GitHub, Google, or TOTP-protected shared users. A WAF running the OWASP Core Rule Set and fail2ban-style jails with trap ports and nftables bans guard the edge. Manage Docker containers and Compose projects with one-click upgrades and rollback, open SSH sessions with an SFTP file manager, run ping, traceroute, and speed tests, and receive alerts in Telegram, Discord, Slack, ntfy, or email. An audit log, config history with diff and rollback, encrypted backups, scoped API tokens, and Prometheus metrics round it out. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Hand-editing nginx configuration files to run a firewall is nobody's idea of a good afternoon, and Nginx-Love turns that chore into a dashboard. You manage domains, load balancing upstreams, and HTTPS backends through forms instead of config syntax, and the platform writes and reloads the underlying configuration for you. A ModSecurity firewall with the OWASP Core Rule Set inspects traffic to your sites, and you tune its rules from the interface rather than a text editor. Certificates arrive two ways: automated through Let's Encrypt, or uploaded manually when you bring your own. A Bot Manager fingerprints visitors with JA4 signals so you can welcome good crawlers, challenge suspicious automation, and block hostile bots by policy. Access lists filter by IP address, geography, and user agent, and multi-user roles let administrators, moderators, and viewers each see the controls appropriate to their job. Monitoring watches performance and attack patterns, sending alerts by email or Telegram when something needs attention. Configuration exports back up your setup, restores bring it back, and multi-node sync keeps a cluster of servers enforcing the same policy. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Tag a Docker container with two labels, and AutoXpose turns it into a published service with a DNS record, a reverse proxy route, and HTTPS, without you opening a single provider dashboard. From the web dashboard you connect one of six DNS providers, Cloudflare, Netlify, DigitalOcean, Porkbun, Aliyun, or Tencent DNSPod, and point it at the Nginx Proxy Manager or Caddy instance you already run. It watches your containers continuously after that: a new label creates the record, propagation is verified before the service shows as live, and removing the container removes its public entries too. Auto-expose mode publishes containers the moment they appear, while manual mode stages them in the dashboard for approval first. Color-coded service tags sort what you run into web, database, and media groups at a glance, and dashboard warnings flag misconfigurations before they become broken links. Nginx Proxy Manager access lists attach by label, so an admin panel stays reachable only from the networks you trust. When containers vanish, orphaned cleanup hunts down the stale DNS records and proxy hosts they left behind. Settings and state live inside the same single container, so the publishing pipeline for a homelab or a small fleet stays one compose service you can back up as a unit. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

The renewal notice always seems to land in an inbox nobody checks anymore, so Domain Monitor tracks every domain you own from your own server and warns you long before each expiry date arrives. It pulls expiration dates and registrar details automatically through WHOIS and RDAP across more than 1,400 supported TLDs, keeping the whole portfolio current without anyone remembering to look. Add domains one at a time or import them in bulk, group them with tags and watchlists, and let scheduled cron checks refresh the data on their own. Alerts escalate on your schedule, at 60, 30, 21, 14, 7, 5, 3, 2, and 1 day before expiry, and arrive through email, Telegram, Discord, Slack, Mattermost, Pushover, or webhooks, routed by notification groups so the right people hear about the right domains. Each domain also gets tabbed views for its DNS records, SSL certificate validity, billing notes, notification history, and raw WHOIS output, with per-domain toggles for DNS and certificate monitoring. The dashboard surfaces what expires soon, how domains distribute across registrars, and whether every domain is actually covered by an alert channel. Multiple users get their own accounts with two-factor authentication, tracked sessions, and an in-app notification center. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Continuous infrastructure monitoring meets automated SSL expiration tracking in Kuvasz, a self-hosted uptime platform that alerts DevOps teams before outages disrupt production operations. Operators can configure granular health checks across HTTP endpoints, ICMP ping targets, and raw TCP ports with custom polling intervals down to seconds. Automated SSL inspectors track certificate validity, issuing early warning notices before cryptographic chains expire and disrupt production traffic. A push monitoring system receives incoming heartbeat signals from background cron jobs, database backups, and recurring automation scripts, triggering alerts whenever expected pings fail to arrive on schedule. Multi-channel dispatchers route incident notifications through Slack, Discord, Telegram, Microsoft Teams, PagerDuty, and custom webhook payloads with adjustable failure count thresholds to eliminate transient false alarms. Maintenance windows let teams schedule planned downtime through one-off intervals or recurring cron expressions, automatically muting notifications during deployment cycles. Public and private status pages publish categorized system health metrics, historical latency charts, and incident timelines to keep internal stakeholders and end users informed. An integrated Model Context Protocol server allows AI assistants to query monitoring states and toggle checks directly via conversational interfaces. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

When the domain you want is already taken, Domain Watchdog tracks its history, warns you as it changes, and can try to register it as soon as it becomes available. Searching any domain returns its registrar, status, nameservers, and registration events from RDAP, the structured JSON successor to WHOIS. A timeline lays out the full lifecycle, from creation through renewals and transfers to final deletion, while deletion forecasting orders tracked domains by their expected drop window. Watchlists group domains with the events that matter, send alerts by email or as webhooks to Slack, Mattermost, or Discord, and publish an iCal feed plus RSS feeds for events and EPP status. Attach a connector for OVH, Gandi, Namecheap, AutoDNS, or Name.com, and an expired domain on the watchlist triggers an order attempt through that provider's API. The app also lists ICANN-accredited registrars and TLDs, and rate limiting with caching minimizes RDAP requests. Administrators can cap watchlists, domains per watchlist, and webhooks per watchlist, toggle public RDAP lookups, and add custom static content to the instance. Scripts can manage watchlists and connectors, search domains, and request user tokens through the documented REST API. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.