VaulTLS Hosting Live In 5 Minutes

Deploy VaulTLS on xCloud and get VaulTLS hosting to run your own certificate authority on your own domain. xCloud runs the pinned official image, creates the administrator and the first CA at install, mounts a persistent volume for the database and CA keys, and publishes the web UI and API over HTTPS in minutes, so there are no OpenSSL shell scripts to maintain and no setup form open to strangers.

Deploy your VaulTLS

No terminal
No technical skills needed
No lock-in, cancel anytime

What is VaulTLS?

VaulTLS is a self-hosted solution for managing mTLS (mutual TLS) certificates, and a self-hosted VaulTLS gives your home lab or small team a centralised platform for generating, managing and distributing TLS certificates. Upstream was built because its author did not like messing with shell scripts and OpenSSL and had no overview of expiry. It lists X.509 and SSH certificate management, OpenID Connect, expiry email notifications, a REST API and ACME CA support. It is licensed under GPL-3.0.

On xCloud the install runs VaulTLS v1.4.0 from the official image, pinned by digest, with a SQLite database. A one-shot setup container creates the administrator and the first CA, VaulTLS CA with a five-year lifetime, then exits. The vaultls_data volume holds the database and the CA private keys. Revocation lists are public by design, and administrators can download private keys.

From Sign-Up to Your Own CA In Just 3 Easy Steps

A private certificate authority normally means a container, a reverse proxy, a certificate for the UI, a volume for the CA keys and a safe first-run setup. This is the same result without assembling any of it.

Step 01
Sign Up
Create your xCloud account and pick VaulTLS from the OneClick catalog. Choose your domain and target server — there are no extra fields to fill in.
Step 02
We Deploy It For You
One click. We bring up the official VaulTLS image, pinned by immutable digest, mount the vaultls_data volume that holds the SQLite database and CA private keys, and publish the web UI and API over HTTPS on your domain. A one-shot setup container creates the administrator and the first CA ("VaulTLS CA", 5 years), then exits.
Step 03
Issue Your First Certificate
Save the admin email and password from the protected installation credentials, open your HTTPS VaulTLS URL and sign in. Change the password in your profile, then create your first client certificate.

Everything VaulTLS Does, On Your Own Server

VaulTLS runs in full here: a web UI and API for your own certificate authority, with the CA and its keys on a server you control.

Issue And Revoke Certificates
Generate TLS X.509 client and server certificates from a web UI and revoke them later, instead of scripting OpenSSL by hand.
Built-In ACME CA
ACME clients such as Traefik and acme.sh can request certificates from your VaulTLS instance.
OpenID Connect Login
Sign users in through your own OpenID Connect provider, configured in the app's Settings page.
Expiry Notifications By E-Mail
VaulTLS can send e-mail notifications for certificate expiration once SMTP is configured in Settings, so you have an overview of what is about to lapse.
REST API For Automation
A RESTful API lets scripts and tooling manage certificates without clicking through the UI.
Administrator Created At Install
The administrator and first CA exist before anyone else can reach the page, so the first-run setup form is never open to strangers.

Everything You Need To Run Your Certificate Authority 24/7

Managed hosting for VaulTLS, so the parts that keep it online are not your problem.

VaulTLS v1.4.0 deployed instantly
Official image pinned by digest
Admin and first CA created at install
Persistent CA and database volume
Free SSL certificate
Server backups and snapshots
Server security updates included
30+ server locations
Unused balance refunded

What You Can Do With VaulTLS

Require client certificates at your proxy
Give each device or person a client certificate and require it at your reverse proxy, with certificates issued and revoked from one place.
Run an internal ACME authority
Point Traefik, acme.sh or another ACME client at your own CA so internal services get certificates without a public authority.
Hand out certificates as downloads
Create users, issue their certificates and hand them out as downloads, instead of passing OpenSSL output around.
Watch for expiring certificates
Keep track of which certificates are about to expire and get e-mail notifications once SMTP is set up in Settings.

VaulTLS Screenshots

The VaulTLS overview page after signing in, listing issued certificates.

A client certificate created in the VaulTLS web interface.

VaulTLS vs Alternatives

OpenSSL and shell scripts: This is the command-line route VaulTLS was written to replace. It works, but you track issued certificates and expiry yourself, whereas VaulTLS adds a web UI, an API and expiry notifications.
Smallstep step-ca: In a VaulTLS vs Smallstep step-ca comparison, step-ca is another open-source private certificate authority with ACME support. VaulTLS adds a web interface, user management and expiry e-mail notifications in front of its CA.
Public ACME authorities such as Let's Encrypt: They issue publicly trusted certificates for public domain names. A private CA like VaulTLS issues certificates that only the devices you configure will trust, which suits internal services and client certificates.
Self-signed certificates made by hand: A hand-made self-signed certificate has no revocation list or inventory. VaulTLS keeps users, issued certificates and revocation in one place, with the CA key on your server.

Simple Pricing. Everything Included.

Dedicated Cloud VPS sizes, pre-configured for VaulTLS hosting. Pick the one that fits, and resize any time.

Cloud VPS 6 GB

Cloud VPS 16 GB

More headroom if VaulTLS sits alongside other self-hosted services.

$59.99per month

16 GB RAM
6 vCPU cores
200 GB NVMe SSD
30 TB
Unlimited

Get started

Every size is a dedicated Cloud VPS we provision, patch, monitor and restore. Billed monthly with no lock-in — delete the server and the unused balance comes back to your account. VaulTLS itself is licensed by its maintainers under GPL-3.0.

Docker hosting

Already Have a Server? Bring Your Own

Connect any VPS — DigitalOcean, Vultr, Linode, AWS, Hetzner or bare metal — and deploy VaulTLS on it through the same panel, for a per-server management fee instead of a Cloud VPS rental.

Free

Start your journey without cost.

$0forever

1 server
10 sites

Start free

Starter

Professional

The same platform, discounted at 6–10 servers.

$4per server / month

6–10 servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Agency

The same platform, discounted at 11+ servers.

$3per server / month

11+ servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Priced per connected server, so your rate adjusts automatically as you add or remove servers. You pay your own provider for the server itself.

Self-managed hosting

Ready To Run Your Own Certificate Authority?

VaulTLS on xCloud runs on a dedicated Cloud VPS that we provision, patch, monitor and restore. Deploy faster. Own the server. Stay in control.

Fast Provisioning
Deploy faster using an xCloud Managed Server built with optimized stacks and high-speed SSDs.
Enterprise-grade security
Protect your infrastructure with a free SSL certificate and more advanced security features at no additional cost.
Intuitive Control Panel
From Server creation to application deployment, everything can be managed from our intuitive control panel.

Hear what people are saying about us

See why agencies, developers, startups, and growing businesses choose xCloud to power their projects.

xCloud works really well, I am surprised by its performance being this the release version, I have tried many paid platforms such as runcloud, cloudpages or serveravatar, as well as free platforms such as CyberPanel, CloudPanel or Hestia Control Panel and direct competitors such as SpinupWP and FlyWP. Of all those that I have tried, the platform that works best for WordPress is SpinupWP and I believe that xCloud can reach and surpass that development, its roadmap is promising. Congratulations to the xCloud team, I hope they become the leading platform in the segment, it has all the potential to achieve it!

Brian Geovanny

I've been with runcloud for the last 3 years. However, after trying xcloud for the last month, I'm switching over. They are on a roll with their setup.

Kevin Pineda

I'm moving my servers to xCloud, a cloud control panel by M Asif Rahman and the WPDeveloper team. Their roadmap looks interesting and no, there are no team mates nor API limits with xCloud! #xCloud #wordpress #hosting

Leo Koo

How Cloud Nine Web Elevated Client Experience While Streamlining Hosting Operations using xCloud

Ed Ellingham

xCloud is like having an expert server team on call — without the big agency costs. It's given me back my time and given my clients peace of mind. Highly recommended for freelancers and small teams who want reliable performance and security.

Dumitru Butucel

xCloud isn't just a solution. It's like one of that friend who got your back when you screw things up pretty bad.

Waqar Ahmed

Trust me when I say, once people explore the potential of xCloud they gonna switch from other panels, just keep delivering the best tech, lots of love for the team 😍😍

Rahul Singh

So far my experience has been smooth like silk. I didn't imagine that configuring and managing a VPS would be so easy. As of today, I have deployed 8 sites. The support is good, and they treat users with respect, even if they ask stupid questions (myself included). For the future, I hope for greater flexibility in scheduled backups and more comprehensive and consistent documentation. I'm sure that within a few months, xCloud will become the leader in its segment. This community is amazing, and the Staff here is super helpful.

Massimo Villa

Came from cloudways then to runcloud then to xcloud. Looks like I'm staying here.

Gerson El

I've recently taken all of my Vultr-hosted sites and gotten rid of cPanel for them to substitute it with xCloud. I have to say, I'm really impressed with xCloud so far! The interface is definitely the standout feature for me.

Tony Lewis

I came from Cloudways and won't go back. Highly impressed with xCloud. Glad I gave them a chance.

Jared McDowell

I like xCloud better than RunCloud, but one thing I'll point out is that some years ago RunCloud was hungry for business, the support was outstanding, and the community was active and helped each other. Maybe it was sold, there was a change in management, or they stopped being hungry, but the quality of the RunCloud offering declined and it hasn't been moving forward quickly. My point is that currently the xCloud team has the edge and it is theirs to keep or lose

David McCan

How Kevin Heinrichs Cut Hosting Costs by 84% While Running WooCommerce & Node.js Sites Efficiently

Kevin Heinrichs

I had 150 sites on cloudways and am in the process of moving them to xcloud. Much faster and better priced.

Dan Spinoza

Dear xCloud Team, I have been using xCloud for some time now and am genuinely impressed with its capabilities and the flexibility it offers by allowing users to bring their own VPS for management. It's a fantastic service, and my experience so far has been very positive. Successful migrated 5 sites on a single server. Xcloud migration tool worked great. There were few hiccups with security plugin like MalCare but disabling the plugin prior to migration worked just fine.

Rahil Maknojia

Came from runcloud. Tried xcloud and never came back.

Karl Fanega

How Advanced Web Strategies Saved Over $2,000 & Recovered 56 Hours per Month Managing 70+ Client Websites

Gary Moody

xCloud gave me what no other hosting platform could: the flexibility of a VPS with the convenience of managed WordPress. As a solo founder running an entire business on one server, that combination is an important unfair advantage.

Jorge de los Reyes Martínez

I use Server Avatar and xCloud and I'll sooner use xCloud than Server Avatar personally.

Jay Pagano

How Newman Web Solutions Ensured Perfect Uptime and Seamless Scaling For 120+ WordPress Sites with xCloud

Lori Newman

I too have moved over to xCloud. It's pretty sweet. One click n8n and uptime Kuma apps

John Aperture

I went from Cloudways to xCloud. No intention on switching in the foreseeable future.

Blaine Moore

Frequently Asked Questions

Feel free to contact us with any questions or concerns you may have.

Can you self-host VaulTLS with Docker?

Yes, and this template is VaulTLS Docker hosting without the setup. Upstream supports Docker and Podman; here xCloud runs the pinned ghcr.io v1.4.0 image, adds a one-shot setup container, mounts vaultls_data and publishes the UI and API over HTTPS.

How much RAM does VaulTLS need?

Very little: the template floor is 256 MB of RAM, 1 CPU core and 1 GB of disk, and QA measured about 11 MiB idle. The 6 GB plan is the entry rung here, which leaves room for other apps on the server.

How do I sign in to VaulTLS?

Use the admin email and password from the protected installation credentials. There is no separate setup form, because the administrator is created at install. Change the password in your profile, and keep it private since it unlocks private keys.

Why can't a stranger claim the VaulTLS setup form?

Because the administrator and first CA are created during install, before anyone else can reach the page. In QA, a setup request and a login from an unauthenticated client were both rejected with a 401.

Can VaulTLS use OpenID Connect and e-mail notifications?

Yes. OIDC and SMTP are configured in the app's Settings page, and the commented keys in the environment file are an alternative that is re-applied on every start. Disable password login only after OIDC works.

Is the VaulTLS certificate revocation list public?

Yes, by design: revocation lists are served at /api/certificates/ca/ followed by the CA id and /crl on your VaulTLS URL without a login, so validators can fetch them. The optional separate CRL port is not published.

What should I back up on a VaulTLS server?

Back up the vaultls_data volume, which holds the SQLite database and the CA private keys. Keep an off-server copy, because certificates already issued stop validating if the CA key is lost, and treat the backup as highly sensitive.

Backups in xCloud

How do I upgrade VaulTLS?

v1.4.0 remains pinned until you take a newer template version. Copy vaultls_data beforehand and skim the project's notes. Running sites are never upgraded by xCloud, and a domain change means updating ACME client directory URLs.

Is VaulTLS free?

Yes. VaulTLS is GPL-3.0 licensed, so the software costs nothing. The only expense is the dedicated Cloud VPS that holds the CA keys, a small server that stays lightly loaded, and its disk mostly holds the database and CA keys.

Does VaulTLS have an ACME server?

Upstream lists ACME CA support for clients such as Traefik and acme.sh, switched on with VAULTLS_ACME_ENABLED in the environment. It issues certificates from your private CA, which only devices you configure will trust, so it does not replace a public authority for public sites.

Is there a VaulTLS cloud service?

Not through this page. VaulTLS cloud hosting here means your own CA runs on a Cloud VPS that xCloud prepares, with the CA keys on a volume you own and an administrator account created at install.

Can I cancel anytime?

Yes. There is no lock-in — cancel any time. Hosting is billed monthly and charged for what you actually use, so when you delete the server the unused balance is refunded to your account, less up to 10% in payment-processing fees.