Ghostunnel open-source TLS proxy supports mutual authentication
Original title: Ghostunnel: Open-source TLS proxy with mutual authentication
Ghostunnel enables plaintext services to use mutual TLS without code changes via SPIFFE IDs and Open Policy Agent policies.
Ghostunnel is an open-source TLS proxy for applications lacking native TLS support. In server mode it accepts TLS connections, validates client certificates against configurable policies including SPIFFE, and forwards plaintext over TCP or UNIX sockets. Client mode wraps local connections in TLS with a presented certificate. Certificates reload on SIGHUP or timer and can originate from multiple sources including hardware modules.
- Validates certificates via common name, OU, DNS/URI or public key pins.
- Supports Open Policy Agent policies for complex access control.
- Single static Go binary with no runtime dependencies.
- Includes systemd and launchd socket activation plus PROXY protocol v2.
- Sandboxes with Landlock on Linux by default.
From the original article
2 min read at helpnetsecurity.com
Ghostunnel is an open-source proxy that handles TLS for programs that cannot handle it themselves. It works in two directions. In server mode it sits in front of a backend, accepts TLS connections, checks the client’s certificate, then passes traffic to the service behind it over TCP or a UNIX socket.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.