cloudflare/cfssl

Features

• Certificate Authorities - Provides a full toolkit for creating and managing root and intermediate certificate authorities to issue and sign TLS certificates.
• PKI Management - Provides a complete toolkit for creating and managing root and intermediate certificate authorities.
• Root Authority Creation - Provides a utility for generating a self-signed root CA certificate along with a private key and certificate request.
• Server Certificate Generators - Provides an HTTP server to remotely generate and sign certificates via JSON-based requests.
• Automated Certificate Issuance - Automates the process of requesting and issuing certificates via an HTTP API server.
• Certificate Lifecycle Management - Tracks the state, issuance, and revocation of certificates through a persistent database.
• Programmatic Certificate Management APIs - Provides a RESTful API for automating the issuance, signing, and management of X.509 certificates.
• Certificate Revocations - Provides a mechanism for marking certificates as invalid in a database with a specific reason to prevent further trust.
• Certificate Signing - Validates and signs certificate requests using a CA certificate and private key.
• Remote Signing - Exposes a network interface for remote signing of certificates without requiring private key distribution.
• TLS Certificate Signing - Signs certificate requests using a CA certificate and private key with subject information overrides.
• Certificate State Tracking - Records issued and revoked certificates in a persistent store to manage the PKI lifecycle.
• CSR Generators - Includes a utility for creating private keys and certificate signing requests based on hostnames and subject information.
• Certificate Verification - Validates the authenticity of TLS certificates and verifies revocation status via OCSP.
• X.509 Management Utilities - Provides a comprehensive command-line utility for generating CSRs, bundling certificate chains, and parsing PEM or DER files.
• TLS Chain Construction - Bundles certificates into contiguous chains to ensure compatibility across various client trust stores.
• Chain Bundle Construction - Assembles leaf, intermediate, and root certificates into compatible chains for client trust stores.
• TLS Certificate Issuance - Generates private keys and signs requests to produce valid certificates for securing services.
• PEM Formatting - Provides utilities to convert certificates and keys between binary DER and human-readable PEM formats.
• OCSP - Stores pre-signed OCSP responses to enable fast verification of certificate revocation status.
• Chain Construction - Combines leaf, root, and intermediate certificates into a chain optimized for browser and operating system compatibility.
• Signing Proxies - Implements a signing proxy that forwards certificate requests to remote backend services.
• Certificate Verification - Checks the validity and chain of trust of TLS certificates to ensure authenticity.
• OCSP Response Caching - Caches and exports certificate status protocol responses to provide fast verification of certificate validity.
• OCSP Response Signing - Generates and signs OCSP responses to verify the real-time revocation status of certificates.
• Self-Signed Certificate Generators - Generates root CA certificates and private keys signed by their own private key.
• Hardware and PKI Security - Provides a command-line toolkit and API for PKI and TLS operations.
• Private Key Infrastructure - Command line tool and HTTP API for PKI and TLS management.
• Security And Privacy - PKI and TLS toolkit.

Star history