CURSE is an SSH certificate signing server, built as an alternative to Netflix's BLESS tool, but without a dependency on AWS.
Version 0.9 adds easy-to-use TLS mutual authentication and pre-configured PAM authentication, and removes the requirement for installing nginx.