cloudflare/cfssl
Cfssl
This project is a toolkit for creating and managing X.509 certificate authorities, providing tools for the issuance, signing, and management of TLS certificates and private keys. It includes a command-line utility for generating certificate signing requests, bundling certificate chains, and parsing PEM or DER files.
The system features an HTTP API server that allows for remote signing and verification of certificates using JSON requests and responses. This architecture supports automated certificate provisioning and includes a signing proxy to forward requests to remote backend services.
The project covers a broad range of PKI infrastructure capabilities, including root and intermediate authority creation, certificate revocation, and the construction of compatible trust chains. It also provides utilities for the Online Certificate Status Protocol to sign and cache responses for verifying the revocation status of certificates.
The toolkit manages the certificate lifecycle through database-backed state tracking and supports various data encoding transformations for system compatibility.
Features
- Certificate Authorities - Provides a full toolkit for creating and managing root and intermediate certificate authorities to issue and sign TLS certificates.
- PKI Management - Provides a complete toolkit for creating and managing root and intermediate certificate authorities.
- Root Authority Creation - Provides a utility for generating a self-signed root CA certificate along with a private key and certificate request.
- Server Certificate Generators - Provides an HTTP server to remotely generate and sign certificates via JSON-based requests.
- Automated Certificate Issuance - Automates the process of requesting and issuing certificates via an HTTP API server.
- Certificate Lifecycle Management - Tracks the state, issuance, and revocation of certificates through a persistent database.
- Programmatic Certificate Management APIs - Provides a RESTful API for automating the issuance, signing, and management of X.509 certificates.
- Certificate Revocations - Provides a mechanism for marking certificates as invalid in a database with a specific reason to prevent further trust.
- Certificate Signing - Validates and signs certificate requests using a CA certificate and private key.
- Remote Signing - Exposes a network interface for remote signing of certificates without requiring private key distribution.
- TLS Certificate Signing - Signs certificate requests using a CA certificate and private key with subject information overrides.
- Certificate State Tracking - Records issued and revoked certificates in a persistent store to manage the PKI lifecycle.
- CSR Generators - Includes a utility for creating private keys and certificate signing requests based on hostnames and subject information.
- Certificate Verification - Validates the authenticity of TLS certificates and verifies revocation status via OCSP.
- X.509 Management Utilities - Provides a comprehensive command-line utility for generating CSRs, bundling certificate chains, and parsing PEM or DER files.
- TLS Chain Construction - Bundles certificates into contiguous chains to ensure compatibility across various client trust stores.
- Chain Bundle Construction - Assembles leaf, intermediate, and root certificates into compatible chains for client trust stores.
- TLS Certificate Issuance - Generates private keys and signs requests to produce valid certificates for securing services.
- PEM Formatting - Provides utilities to convert certificates and keys between binary DER and human-readable PEM formats.
- OCSP - Stores pre-signed OCSP responses to enable fast verification of certificate revocation status.
- Chain Construction - Combines leaf, root, and intermediate certificates into a chain optimized for browser and operating system compatibility.
- Signing Proxies - Implements a signing proxy that forwards certificate requests to remote backend services.
- Certificate Verification - Checks the validity and chain of trust of TLS certificates to ensure authenticity.
- OCSP Response Caching - Caches and exports certificate status protocol responses to provide fast verification of certificate validity.
- OCSP Response Signing - Generates and signs OCSP responses to verify the real-time revocation status of certificates.
- Self-Signed Certificate Generators - Generates root CA certificates and private keys signed by their own private key.
- Hardware and PKI Security - Provides a command-line toolkit and API for PKI and TLS operations.
- Sicherheit und Datenschutz - PKI and TLS toolkit.
