Ghostunnel: Open-source TLS proxy with mutual authentication
Ghostunnel is an open-source proxy that handles TLS for programs that cannot handle it themselves.
It works in two directions. In server mode it sits in front of a backend, accepts TLS connections, checks the client’s certificate, then passes traffic to the service behind it over TCP or a UNIX socket. In client mode it does the reverse, listening for plain local connections, wrapping them in TLS and presenting a client certificate to the remote service. Put one at each end and both sides prove who they are while the applications keep speaking plaintext.
An internal service talks plaintext, someone decides that link now needs mutual TLS, and the code to add it either does not exist or belongs to a vendor. Ghostunnel takes that job off the application and gives it a process of its own.
Who gets in
In server mode the proxy will not start until you say who is allowed through. You pick at least one check: common name, organizational unit, a DNS or URI name in the certificate, a public key pin, or a policy. Several can be combined, and they are ORed. Ghostunnel understands SPIFFE IDs, and for anything more involved it evaluates an Open Policy Agent policy, which can be reloaded while the tunnel is running.
Where the certificates come from
Keys and certificates can come from PEM or PKCS#12 files, the macOS Keychain, the Windows Certificate Store, the SPIFFE Workload API, a PKCS#11 hardware module including a YubiKey, or from Let’s Encrypt over ACME in server mode. Certificates reload on SIGHUP or on a timer, which is what makes short-lived credentials practical: the certificate rotates, the proxy picks up the new one, and nothing restarts.
Two defaults are worth knowing. Ghostunnel refuses to listen on anything other than localhost or a UNIX socket unless you pass --unsafe-listen, with the same rule for targets and --unsafe-target. On Linux it sandboxes itself with Landlock unless you turn that off. A status port exposes JSON and Prometheus metrics, so the tunnel is visible to existing monitoring.
You get one static Go binary with no runtime dependencies, builds for Linux, macOS, Windows and the BSDs, and an Apache 2.0 license. There is systemd and launchd socket activation, plus PROXY protocol v2 for backends that want to know about the original connection.
Ghostunnel is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
