cfssl

Initialize a new CA

$ cfssl gencert -initca [ca-csr.json] | cfssljson -bare [ca]

$ cfssl gencert -ca [ca.pem] -ca-key [ca-key.pem] [csr.json] | cfssljson -bare [cert]

$ cfssl sign -ca [ca.pem] -ca-key [ca-key.pem] [request.csr]

$ cfssl selfsign [hostname] [csr.json] | cfssljson -bare [cert]

$ cfssl serve -ca [ca.pem] -ca-key [ca-key.pem]

$ cfssl bundle -cert [cert.pem]

$ cfssl print-defaults config

cfssl command [options] [arguments]

cfssl is CloudFlare's PKI/TLS toolkit for signing, verifying, and bundling TLS certificates. It provides both a command-line tool and an HTTP API server for running a complete certificate authority.
The toolkit handles the full certificate lifecycle: generating root and intermediate CAs, signing certificate requests, creating self-signed certificates, and building certificate bundles for deployment. Configuration files define signing profiles with specific expiry periods, key usages, and authentication requirements.
The companion tool cfssljson extracts certificates and keys from cfssl's JSON output into PEM files. The multirootca component allows running a CA server with multiple signing keys for different purposes.

-ca file

CA certificate file (default: ca.pem)

CA private key file (default: ca_key.pem)

Path to configuration file

Comma-separated hostnames for SAN

Initialize new CA

Remote CFSSL server address

ca-csr.json

Certificate Signing Request defaults (key algorithm, size, names, hosts).

Signing profiles defining certificate expiry, usages, and auth keys for the CA.

gencert

Generate new key and signed certificate

Sign a certificate signing request

Generate self-signed certificate

Build certificate bundle

Generate private key and CSR

Start HTTP API server

Get info about remote signer

Print default configurations

Print version

Default address: 127.0.0.1:8888

$ cfssl serve -address [0.0.0.0] -port [8888] -ca [ca.pem] -ca-key [ca-key.pem]

cfssljson

Write certificates/keys from JSON output

Multi-signing-key CA server

Build certificate bundles

Requires Go 1.20+ to build from source. Private keys should be protected. Use configuration files for complex signing policies.

openssl(1), certbot(1)