VaulTLS

v1.3.0 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 16d Network Security

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

mtls oidc rust vue

Affected surfaces

auth crypto_tls

Summary

AI summary

Adds Key Revocation Lists (KRL) for OpenSSL certificates, TLS CA/certificate import support, and bug fixes across Others, KRL, and user.pub.

Changes in this release

Type	Severity	Summary	CVE
Feature
Feature	Medium	Adds Key Revocation Lists (KRL) support for OpenSSL certificates Adds Key Revocation Lists (KRL) support for OpenSSL certificates Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Adds ability to import TLS CAs and certificates into VaulTLS Adds ability to import TLS CAs and certificates into VaulTLS Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	Adds default SSH extensions for certificates (issue #198) Adds default SSH extensions for certificates (issue #198) Source: llm_adapter@2026-07-15 Confidence: high	—
Dependency	Low	Updated dependencies to latest versions Updated dependencies to latest versions Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fixes bug with the ACME server (issue #200) Fixes bug with the ACME server (issue #200) Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Adds proper SIGTERM handling for graceful shutdown (issue #215) Adds proper SIGTERM handling for graceful shutdown (issue #215) Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

v1.3.0

Welcome to the next release of VaulTLS. This release adds Key Revocation Lists (KRL) for OpenSSL certificates and the ability to import TLS CAs and certificates,

Key Revocation Lists

When adding support for TLS Certificate Revocation Lists I completely forgot about my dear SSH users. For some reason I thought it wasn't really possible which is of course wrong! To implement KRLs I had to manually implement the KRL protocol since the SSH cert library I used in Rust didn't support it.

You can check if a certificate is revoked for example with ssh-keygen:

❯ ssh-keygen -Q -f test.krl user.pub
user.pub (user.pub): REVOKED

Import TLS CAs and Certificates

As requested in #193 you can now import existing TLS CAs (including CRL) and certificates to VaulTLS. Please make sure any data you import is sane. If you find any issues, please don't hesitate to open an issue.

Others

@jordanruthe fixed a bug with the ACME server in #200
Added proper SIGTERM handling as requested in #215
Added some default SSH extensions for certificates as requested in #198
Updated dependencies

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track VaulTLS

Get notified when new releases ship.

About VaulTLS

Selfhostable web app to make managing mTLS certificates a breeze

All releases →