CFSSL is Cloudflare's PKI and TLS toolkit, written in Go and designed to serve as a comprehensive swiss army knife for certificate operations. The project provides both a command-line utility and an HTTP API server for signing, verifying, and bundling TLS certificates. It requires Go 1.20 or later to build, with a note that certain Linux distributions, particularly RHEL-based systems, may have algorithms removed from their official Go repositories, necessitating manual Go installation for those users.
The toolkit consists of several integrated components. The main cfssl program is the canonical command-line utility that leverages the CFSSL packages for core functionality. The multirootca program extends capabilities by providing a certificate authority server capable of using multiple signing keys, addressing scenarios where single-key operations are insufficient. The mkbundle program constructs certificate pool bundles for root and intermediate certificates, while cfssljson processes JSON output from cfssl and multirootca to write certificates, keys, certificate signing requests, and bundles to disk.
The command-line interface supports diverse operations including signing certificate bundles, generating private keys and certificate requests, creating self-signed certificates, bundling certificates with configurable flavors for different use cases, and starting an API server. The signing functionality accepts certificate signing requests with customizable hostname overrides for SAN extensions. Certificate bundling offers three flavors: optimal for shortest chains with advanced cryptography, ubiquitous for broad browser and OS compatibility, and force for bundles matching input certificate content exactly. The API server listens on a configurable address and port, defaulting to 127.0.0.1:8888, and supports remote signature forwarding, OCSP responder configuration, and adjustable logging levels from DEBUG to CRITICAL.
The mkbundle utility validates certificates against CRL revocation lists and checks for expiration before combining them into single bundle files, with configurable worker counts for revocation checking. The cfssljson tool maps JSON keys to appropriately named output files, supporting both file output and standard output modes. Static binary builds are supported through resource embedding using the go.rice tool.
The repository shares contributors with microsoft/vscode, golang/go, and rust-lang/rust according to GitGenius cross-repository analysis.
