Ghostunnel: Open-Source Mutual TLS Proxy Tool Released
Help Net Security profiles Ghostunnel, a free, open-source TLS proxy designed to add mutual TLS (mTLS) authentication to applications that cannot handle encryption themselves. The tool operates in both server and client modes, validating certificates via common name, organizational unit, SPIFFE IDs, or Open Policy Agent (OPA) policies before passing traffic to backend services. This is a product/tooling announcement rather than a security incident, with no vulnerabilities, exploitation, or threat activity involved.
Detalhes técnicos
Ghostunnel supports certificate sourcing from PEM/PKCS#12 files, macOS Keychain, Windows Certificate Store, the SPIFFE Workload API, PKCS#11 hardware modules (including YubiKey), and Let's Encrypt via ACME. Certificates reload automatically on SIGHUP or timer, enabling short-lived credential rotation without restarts. By default, the tool restricts listening to localhost or UNIX sockets unless --unsafe-listen is specified, and sandboxes itself using Landlock on Linux unless disabled. It exposes a status port with JSON and Prometheus metrics for monitoring integration, is distributed as a single static Go binary for Linux, macOS, Windows, and BSD under the Apache 2.0 license, and supports systemd/launchd socket activation and PROXY protocol v2.
Remediação
Organizations seeking to add mutual TLS to legacy or third-party applications lacking native TLS support can evaluate Ghostunnel, available free on GitHub, as a lightweight proxy-based solution.
Linha do tempo
-
Ghostunnel: Open-Source Mutual TLS Proxy Tool Released
ler a análise desta fonte ocultar
Help Net Security profiles Ghostunnel, a free, open-source TLS proxy designed to add mutual TLS (mTLS) authentication to applications that cannot handle encryption themselves. The tool operates in both server and client modes, validating certificates via common name, organizational unit, SPIFFE IDs, or Open Policy Agent (OPA) policies before passing traffic to backend services. This is a product/tooling announcement rather than a security incident, with no vulnerabilities, exploitation, or threat activity involved.
Technical Details
Ghostunnel supports certificate sourcing from PEM/PKCS#12 files, macOS Keychain, Windows Certificate Store, the SPIFFE Workload API, PKCS#11 hardware modules (including YubiKey), and Let's Encrypt via ACME. Certificates reload automatically on SIGHUP or timer, enabling short-lived credential rotation without restarts. By default, the tool restricts listening to localhost or UNIX sockets unless
--unsafe-listenis specified, and sandboxes itself using Landlock on Linux unless disabled. It exposes a status port with JSON and Prometheus metrics for monitoring integration, is distributed as a single static Go binary for Linux, macOS, Windows, and BSD under the Apache 2.0 license, and supports systemd/launchd socket activation and PROXY protocol v2.Remediation
Organizations seeking to add mutual TLS to legacy or third-party applications lacking native TLS support can evaluate Ghostunnel, available free on GitHub, as a lightweight proxy-based solution.