qwacamole.

EXPERIMENTAL · UNPUBLISHED ALPHA

Your identity.
Bound to your TLS.

Bring your 2-QWAC credential. Qwacamole connects it to the TLS certificates you actually serve, with Caddy or Certbot and Nginx.

Choose your integration Understand the binding

ONE CONNECTION. TWO DISTINCT JOBS.

OPERATOR-SUPPLIED 2-QWACOrganization identity

Your certificate, chain and signing key.

signed binding
ORDINARY TLS CERTIFICATEThe HTTPS connection

The certificate presented to the browser.

Published and verified before TLS activation.
Discovered at /bindings/current.jose.

THE CONNECTION BETWEEN THE TWO

Keep the identity.
Renew the connection.

Your ordinary TLS certificate protects HTTPS. Your supplied 2-QWAC credential signs a document that binds your organization identity to that certificate.

Qwacamole manages the binding as TLS certificates renew. It retains coverage for held connections, refreshes independently and rejects new protected responses when a binding becomes unavailable.

Explore discovery and rebinding

START WITH YOUR SERVER

Two integrations.
One credential workflow.

Explicit trust, local state and a supplied signing key. Choose the deployment you operate.

01 / CADDY

Build it into Caddy.

A plugin that pairs a gated ACME issuer with binding discovery and HTTP middleware. Configure one hostname per state.

qwac.example.com {
    qwac { … }
    reverse_proxy 127.0.0.1:8080
}

Directive shape; the quickstart includes the complete configuration.

Caddy quickstart
02 / CERTBOT + NGINX

Gate the TLS deployment.

A standalone agent for one dedicated Nginx master. Certbot's deploy hook publishes the binding before activating a TLS generation.

qwacamole-agent status \
  -config /etc/qwacamole/agent.json
qwacamole-agent check \
  -config /etc/qwacamole/agent.json

Private control and a fresh, normally verified TLS connection.

Certbot / Nginx quickstart

BRING YOUR OWN CREDENTIAL

Start locally.
Keep your key local.

Prepare a dedicated RSA key and CSR. Once an issuer supplies the certificate, inspect its profile, hostname coverage, key match and chain against your explicitly selected authority.

Prepare, inspect and import
  1. 01

    Prepare

    Create a key and signed CSR with the production CLI.

  2. 02

    Validate

    Check the supplied 2-QWAC and chain before activation.

  3. 03

    Operate

    Renew TLS and replace credentials without dropping coverage.