cfssl

CFSSL (CloudFlare's PKI/TLS swiss army knife) is an open-source toolkit designed for managing Public Key Infrastructure (PKI) and Transport Layer Security (TLS). It functions as both a command-line interface (CLI) tool and an HTTP API server, enabling users to sign, verify, and bundle TLS certificates efficiently. Key Components: - cfssl: The primary CLI utility for performing various PKI operations such as signing certificates, generating keys, creating bundles, and starting the API server. - multirootca: A certificate authority server capable of using multiple signing keys, offering endpoints for signing, authenticated signing, and information retrieval. - mkbundle: A utility for building root and intermediate certificate bundles by checking for revocation and expiration. - cfssljson: A helper tool that converts JSON output from CFSSL into separate PEM files for keys, certificates, CSRs, and bundles. Core Capabilities: 1. Certificate Signing: Users can sign Certificate Signing Requests (CSRs) using a local or remote CA. The tool allows overriding hostnames and specifying subject details via JSON configuration. 2. Certificate Bundling: CFSSL can build certificate chains with different flavors (optimal, ubiquitous, force) based on cryptographic strength and browser compatibility. It supports fetching certificates directly from domains. 3. Key and CSR Generation: Generate private keys and corresponding CSRs or self-signed certificates using JSON templates that define key algorithms, sizes, and subject information. 4. OCSP Support: Generate OCSP responses for issued certificates and serve them via an OCSP responder. 5. API Server: Start an HTTP-based API server for remote certificate operations, configurable with custom addresses, ports, logging levels, and database configurations. Installation requires Go 1.20+ due to cgo dependencies. Prebuilt binaries are available on GitHub releases. The toolkit is widely used in infrastructure for automating TLS certificate lifecycle management.