Ghostunnel Open Source TLS Proxy with Mutual Authentication

Ghostunnel is an open-source TLS proxy tool that enables secure communication between systems using mutual authentication.

Overview

Ghostunnel is an open-source intermediary tool designed to manage TLS protocols for applications that lack native support. It operates in dual modes, enabling secure communication between systems. In server mode, it acts as an intermediary, receiving TLS-encrypted connections, validating client certificates, and forwarding unencrypted traffic to the underlying service via TCP or a UNIX socket. Conversely, in client mode, it accepts unsecured local connections, encrypts them using TLS, and presents a client certificate to the remote service. Deploying Ghostunnel at both ends establishes mutual authentication, allowing applications to communicate using plaintext while ensuring identity verification.

Key Features

Dual Modes

Ghostunnel operates in two modes: server and client. In server mode, it validates client certificates and forwards traffic to the target service. In client mode, it encrypts local connections and presents client certificates to remote services.

Authentication Flexibility

The tool enforces strict access controls in server mode, requiring administrators to define authentication criteria. Users can configure checks based on common names, organizational units, DNS or URI attributes in certificates, public key pins, or custom policies. Multiple conditions can be combined, with results evaluated as logical ORs.

Certificate Management

Ghostunnel supports flexible certificate management, drawing from PEM or PKCS#12 files, macOS Keychain, Windows Certificate Store, SPIFFE Workload API, PKCS#11 hardware modules (including YubiKey), or Let’s Encrypt via ACME in server mode. Certificates are automatically reloaded upon receiving a SIGHUP signal or according to a scheduled interval.

Security Defaults

Ghostunnel restricts listening interfaces to localhost or UNIX sockets unless explicitly overridden with the –unsafe-listen flag. Similar restrictions apply to target connections using –unsafe-target. On Linux systems, it employs Landlock sandboxing to limit capabilities unless disabled. A dedicated status port provides JSON and Prometheus metrics for monitoring.

Deployment and Compatibility

The tool is distributed as a single static Go binary with no runtime dependencies, supporting Linux, macOS, Windows, and BSD platforms. It includes systemd and launchd socket activation support, along with PROXY protocol v2 compatibility for backend systems requiring original connection details.

Use Cases

Ghostunnel addresses scenarios where native TLS implementation is impractical or unavailable. By decoupling authentication logic from application code, it simplifies deployment of mutual TLS without requiring modifications to existing systems. Its architecture prioritizes flexibility, security, and ease of integration into existing infrastructure.

Conclusion

Ghostunnel is released under the Apache 2.0 license and available on GitHub. It provides a robust solution for securing communication between systems, offering a balance of security, flexibility, and ease of use for developers and administrators.