The problem it solves
Certificates and secrets sprawl across servers, load balancers, pipelines, and cloud accounts. They’re issued by different teams, stored in different places, and forgotten until something breaks — an expired cert takes down a service, or a leaked key becomes an incident. KryptoVault replaces that sprawl with a single inventory, a consistent set of controls, and automation around the parts that fail silently.The platform
KryptoVault is organized into two live modules and a shared platform layer, with a third module planned.Certificate Management (CLM)
Discover certificates across your network, build a single inventory, issue and renew through your CAs, and track every certificate through its lifecycle.
Secrets Management (Key Vault)
Store secrets in access-controlled vaults, versioned and typed, encrypted under protection keys you choose — local, AWS KMS, or HashiCorp Vault Transit.
Non-Human Identity (NHI)
Planned. Lifecycle and risk management for non-human identities. Not yet available — see the roadmap placeholder.
What runs across both modules
- Access Management — users, role-based access control, MFA, SSO (LDAP, Microsoft Entra, Google), session policy, and password policy. Service accounts issue machine credentials for calling the KryptoVault API.
- Events & audit — every meaningful action raises an event with a type and severity, queryable as an audit trail and forwardable to webhook, syslog, or Azure Queue.
- Notifications, Gateways, Recycle Bin, Diagnostics — email and policy-based alerts, connectivity to on-prem CAs and infrastructure, soft-delete with retention, and system health.
Certificate lifecycle, end to end
KryptoVault tracks each certificate through a defined lifecycle — Discovered, Generated, Enrolled, Renewal, Expired, Revocation — so inventory state always reflects reality, whether a certificate was found by a network scan or issued through the platform.Secrets, built for a credential store
Secrets live in vaults and are versioned, typed (token, API key, password, encryption key, SSH key, generic, OAuth), and environment-scoped (dev through production). Each vault binds to a protection key at creation and enforces its own network and user access controls.Deployment
KryptoVault runs as a fully containerized, stateless application — every component (API, UI, workers) holds no local state, with all state in MongoDB and Redis. Run it as a managed SaaS or self-hosted in your own environment, with or without an orchestrator.Next steps
Quickstart
Issue your first certificate and create your first vault and secret.
Core concepts
The vocabulary: identities, vaults, protection keys, issuers, gateways, events.
Architecture
How the API, workers, MongoDB, Redis, and gateways fit together.