The Selfauthority Toolkit

The primary tool for provisioning, renewing, and managing mTLS identities from the command line. Built in Go - compile once for any platform.

• Enroll any device or service agent using an autoprovisioning token
• Renew certificates on demand or via cron - continuity without manual intervention
• Issue service identity server certificates signed by the Identity Plus Private CA
• Assist Enroll managed services - delegate provisioning without sharing credentials
• CI / CD ready - self-provision X.509 certificates in any pipeline, OS-agnostic

GitHub Repository

A transparent TCP forwarder that gives any legacy client a full mTLS identity with no code modifications. The application believes it communicates locally over plain text; Persona wraps that traffic in a mutually authenticated TLS channel before it leaves the machine.

• No code changes to the client - works with databases, queues, any TCP service
• Identity at the perimeter of one - Persona is logically part of the client it represents
• Multiple mappings per instance - one Persona, many upstream connections
• High performance event-driven, threaded, hardware-accelerated encryption where available
• Works alongside the CLI for automatic certificate rotation

GitHub Repository

The human-facing Self-Authority identity. A cryptographic mTLS ID that lives on the phone to enable connection level, the TLS layer authentication - before any application, login page, or session is involved.

• Personal mTLS identity the phone is the certified identity carrier, not the password
• Enroll and manage your Self-Authority identity on the go
• Works with any mTLS-aware service including those gated by the mTLS Gateway
• Same uniform identity architecture as machines and AI agents - mobile browsers can use the identity for transparent authentication

Google Play

A high-precision reverse proxy built natively on mTLS. Drop it in front of any HTTP or TCP service and enforce Identity Gated Execution - no code changes to the upstream service required. Authentication happens at the connection layer, before any application data is exchanged.

• Turnkey IGE - gate any legacy HTTP or TCP service with zero upstream changes
• Flexible access control full Gateway RBAC, application mode, or hybrid per route
• Built-in OIDC / OAuth2 provider translate mTLS identity into corporate SSO with automatic account provisioning
• Trusted Headres inject verified identity and role into HTTP headers for instant zero-trust integration with legacy apps
• Per-path access control - enforce mTLS on specific URL prefixes, define role requirements per route
• Multi-perimeter - gate any number of upstream services from a single Gateway instance, each independently configured
• Certificate automation - server and agent certificates rotate automatically; Let's Encrypt and Identity Plus private CA supported
• Full audit logging - configurable verbosity and retention, log files available on host for long-term storage

Documentation
GitHub Repository

Brings mTLS identity directly into WordPress. Authentication happens at the TLS layer before the login page loads. The admin panel becomes structurally inaccessible to any device without a valid mTLS ID, regardless of application-layer vulnerabilities.

• Pre-login authentication - TLS-layer check before any page renders; no login page, no brute-force surface
• Device-bound access - the admin panel is only reachable from enrolled devices, not from stolen credentials alone
• Automatic SSO enrolled devices are signed in silently; two and three factor authentication without a separate app
• Zero-redirect corporate SSO maps mTLS identity to WordPress accounts via organisational relationships
• Legacy redirect fallback device verification and automatic login via Identity Plus

GitHub Repository