How to use Cloudflare’s PKI and TLS toolkit

Use Cloudflare’s PKI and TLS toolkit to quickly generate self-signed certificates.

Installation

Inspect golang-cfssl package.

$ apt info golang-cfssl

Package: golang-cfssl
Version: 1.2.0+git20160825.89.7fb22c8-3.1
Built-Using: golang-1.15 (= 1.15.4-1ubuntu1), golang-github-cloudflare-go-metrics (= 0.0~git20151117.0.6a9aea3-3), golang-github-cloudflare-redoctober (= 0.0~git20161017.0.78e9720-5), golang-github-daaku-go.zipexe (= 1.0.1-1), golang-github-geertjohan-go.rice (= 1.0.0+git20191102.d954009-1build2), golang-github-go-sql-driver-mysql (= 1.5.0-1), golang-github-google-certificate-transparency (= 0.0~git20160709.0.0f6e3d1~ds1-3), golang-github-jmhodges-clock (= 1.0-3), golang-github-jmoiron-sqlx (= 1.1+git20160206.61.398dd58-2), golang-github-kisielk-sqlstruct (= 0.0~git20150917.0.0b86a3e-2), golang-github-kisom-goutils (= 0.0~git20161101.0.858c9cb-2), golang-github-lib-pq (= 1.3.0-1), golang-github-mattn-go-sqlite3 (= 1.6.0~ds1-2), golang-go.crypto (= 1:0.0~git20201221.eec23a3-1), golang-golang-x-net (= 1:0.0+git20201031.ff519b6+dfsg-1)
Priority: extra
Section: universe/devel
Source: golang-github-cloudflare-cfssl
Origin: Ubuntu
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Original-Maintainer: Debian Go Packaging Team <pkg-go-maintainers@lists.alioth.debian.org>
Bugs: https://bugs.launchpad.net/ubuntu/+filebug
Installed-Size: 44.7 MB
Depends: libc6 (>= 2.32), libsqlite3-0 (>= 3.7.15)
Homepage: https://github.com/cloudflare/cfssl
Download-Size: 8725 kB
APT-Sources: http://pl.archive.ubuntu.com/ubuntu jammy/universe amd64 Packages
Description: CloudFlare's PKI and TLS toolkit
 CFSSL is CloudFlare's PKI/TLS swiss army knife. It is both a command
 line tool and an HTTP API server for signing, verifying, and bundling
 TLS certificates. CFSSL can be used to build custom TLS PKI tools as
 well as create and manipulate traditional certificate structures
 using code or on the command line.
 .
 This package contains the command line executables.

Install golang-cfssl package.

$ sudo apt install golang-cfssl

Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
  golang-cfssl
0 upgraded, 1 newly installed, 0 to remove and 5 not upgraded.
Need to get 8725 kB of archives.
After this operation, 44.7 MB of additional disk space will be used.
Get:1 http://pl.archive.ubuntu.com/ubuntu jammy/universe amd64 golang-cfssl amd64 1.2.0+git20160825.89.7fb22c8-3.1 [8725 kB]
Fetched 8725 kB in 2s (4525 kB/s)       
Selecting previously unselected package golang-cfssl.
(Reading database ... 303188 files and directories currently installed.)
Preparing to unpack .../golang-cfssl_1.2.0+git20160825.89.7fb22c8-3.1_amd64.deb ...
Unpacking golang-cfssl (1.2.0+git20160825.89.7fb22c8-3.1) ...
Setting up golang-cfssl (1.2.0+git20160825.89.7fb22c8-3.1) ...

Inspect cfssl version.

$ cfssl version

Version: 1.2.0
Revision: dev
Runtime: go1.15.4

Basic usage

Store default cofiguration.

$ cfssl print-defaults config | tee config.json

{
    "signing": {
        "default": {
            "expiry": "168h"
        },
        "profiles": {
            "www": {
                "expiry": "8760h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth"
                ]
            },
            "client": {
                "expiry": "8760h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "client auth"
                ]
            }
        }
    }
}

Customize defined profiles.

$ cat config.json

{
    "signing": {
        "default": {
            "expiry": "168h"
        },
        "profiles": {
            "intermediate": {
                "expiry": "8760h",
                "usages": [
                    "cert sign",
                    "crl sign"
                ],
                "ca_constraint": {
                   "is_ca": true,
                   "max_path_len":1
                }
            },
            "server": {
                "expiry": "8760h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth"
                ]
            },
            "client": {
                "expiry": "8760h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "client auth"
                ]
            }
        }
    }
}

Create ca directory for certificate authority.

$ mkdir ca

Generate default certificate signing request.

$ cfssl print-defaults csr | tee ca/ca.json

{
    "CN": "example.net",
    "hosts": [
        "example.net",
        "www.example.net"
    ],
    "key": {
        "algo": "ecdsa",
        "size": 256
    },
    "names": [
        {
            "C": "US",
            "ST": "CA",
            "L": "San Francisco"
        }
    ]
}

Update certificate signing request for certificate authority.

$ cat ca/ca.json

{
    "CN": "CA",
    "key": {
        "algo": "ecdsa",
        "size": 256
    }
}

Generate certificate authority.

$ cfssl genkey -config config.json -initca ca/ca.json | cfssljson -bare ca/ca

2022/08/09 23:08:12 [INFO] generate received request
2022/08/09 23:08:12 [INFO] received CSR
2022/08/09 23:08:12 [INFO] generating key: ecdsa-256
2022/08/09 23:08:12 [INFO] encoded CSR
2022/08/09 23:08:12 [INFO] signed certificate with serial number 522304223956609469872673890562035558319492295545

Inspect created files.

$ cat ca/ca-key.pem

$ cat ca/ca.pem

$ cat ca/ca.csr

Display certificate signing request details.

$ cfssl certinfo -csr ca/ca.csr

{
  "Raw": "MIHGMG8CAQAwDTELMAkGA1UEAxMCQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARC4b5qhh6JPDBMduuSxhhftKUcJ/x+BnG2tq8eymELvLZ+tM4+SqTk2mXbT0GMC/sqSBH1JeB8ibaPIe3nkB9joAAwCgYIKoZIzj0EAwIDRwAwRAIgLjX6tD3CZbC8OUfslt56CigtOwnX8OlghzfvEM5BZY0CIFLg2iWsoipyDP6HCledhwu9VxYoSZxSgpy9YeHYA5cx",
  "RawTBSCertificateRequest": "MG8CAQAwDTELMAkGA1UEAxMCQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARC4b5qhh6JPDBMduuSxhhftKUcJ/x+BnG2tq8eymELvLZ+tM4+SqTk2mXbT0GMC/sqSBH1JeB8ibaPIe3nkB9joAA=",
  "RawSubjectPublicKeyInfo": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQuG+aoYeiTwwTHbrksYYX7SlHCf8fgZxtravHsphC7y2frTOPkqk5Npl209BjAv7KkgR9SXgfIm2jyHt55AfYw==",
  "RawSubject": "MA0xCzAJBgNVBAMTAkNB",
  "Version": 0,
  "Signature": "MEQCIC41+rQ9wmWwvDlH7JbeegooLTsJ1/DpYIc37xDOQWWNAiBS4NolrKIqcgz+hwpXnYcLvVcWKEmcUoKcvWHh2AOXMQ==",
  "SignatureAlgorithm": 10,
  "PublicKeyAlgorithm": 3,
  "PublicKey": {
    "Curve": {
      "P": 115792089210356248762697446949407573530086143415290314195533631308867097853951,
      "N": 115792089210356248762697446949407573529996955224135760342422259061068512044369,
      "B": 41058363725152142129326129780047268409114441015993725554835256314039467401291,
      "Gx": 48439561293906451759052585252797914202762949526041747995844080717082404635286,
      "Gy": 36134250956749795798585127919587881956611106672985015071877198253568414405109,
      "BitSize": 256,
      "Name": "P-256"
    },
    "X": 30251502799755363927972087438779104029159549838866690506724075781343993203644,
    "Y": 82544809046968063736120571004889741174050166087270672368870795144509531365219
  },
  "Subject": {
    "Country": null,
    "Organization": null,
    "OrganizationalUnit": null,
    "Locality": null,
    "Province": null,
    "StreetAddress": null,
    "PostalCode": null,
    "SerialNumber": "",
    "CommonName": "CA",
    "Names": [
      {
        "Type": [
          2,
          5,
          4,
          3
        ],
        "Value": "CA"
      }
    ],
    "ExtraNames": null
  },
  "Attributes": null,
  "Extensions": null,
  "ExtraExtensions": null,
  "DNSNames": null,
  "EmailAddresses": null,
  "IPAddresses": null,
  "URIs": null
}

Display certificate authority details.

$ cfssl certinfo -cert ca/ca.pem

{
  "subject": {
    "common_name": "CA",
    "names": [
      "CA"
    ]
  },
  "issuer": {
    "common_name": "CA",
    "names": [
      "CA"
    ]
  },
  "serial_number": "522304223956609469872673890562035558319492295545",
  "not_before": "2022-08-09T21:03:00Z",
  "not_after": "2027-08-08T21:03:00Z",
  "sigalg": "ECDSAWithSHA256",
  "authority_key_id": "",
  "subject_key_id": "7:1A:79:18:71:B1:A2:C:78:23:3B:B7:E4:A8:F4:EE:DA:28:C0:A8",
  "pem": "-----BEGIN CERTIFICATE-----\nMIIBXjCCAQSgAwIBAgIUW3zuca3VICpWoTQd9wniw5zt63kwCgYIKoZIzj0EAwIw\nDTELMAkGA1UEAxMCQ0EwHhcNMjIwODA5MjEwMzAwWhcNMjcwODA4MjEwMzAwWjAN\nMQswCQYDVQQDEwJDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABELhvmqGHok8\nMEx265LGGF+0pRwn/H4Gcba2rx7KYQu8tn60zj5KpOTaZdtPQYwL+ypIEfUl4HyJ\nto8h7eeQH2OjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0G\nA1UdDgQWBBQHGnkYcbGiDHgjO7fkqPTu2ijAqDAKBggqhkjOPQQDAgNIADBFAiAi\nlFQVyYdCiCAFJIShCU6R6ICdAPZOv0TDlaePialABgIhALqjP1/EFMgidw+lghPd\nyBqWCh/3YfXT1UPK7mhhkLWX\n-----END CERTIFICATE-----\n"
}

Create certificate signing request for intermediate certificate.

$ cat ca/intermediate.json

{
    "CN": "Intermediate CA",
    "key": {
        "algo": "ecdsa",
        "size": 256
    }
}

Generate intermediate certificate.

$ cfssl gencert -config config.json -ca ca/ca.pem -ca-key ca/ca-key.pem -profile intermediate ca/intermediate.json | cfssljson -bare ca/intermediate

2022/08/09 23:46:44 [INFO] generate received request
2022/08/09 23:46:44 [INFO] received CSR
2022/08/09 23:46:44 [INFO] generating key: ecdsa-256
2022/08/09 23:46:44 [INFO] encoded CSR
2022/08/09 23:46:44 [INFO] signed certificate with serial number 722720822862120708336239517806371808811307146170
2022/08/09 23:46:44 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").

Display generated files.

$ cat ca/intermediate.csr

$ cat ca/intermediate.pem

$ cat ca/intermediate-key.pem

Display certificate signing request details.

$ cfssl certinfo -csr ca/intermediate.csr

{
  "Raw": "MIHVMHwCAQAwGjEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlIENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZgGvEBQ/FlPEUunzr1X+Qd/xm88mLjEahMQfmk0Dss6OzX53rutP1yetdrxAbHEZ6b7mGVOFYJk104MVweI7eKAAMAoGCCqGSM49BAMCA0kAMEYCIQCdmciYbhTfTA3rrrWvBgRuWl/DJZKBRBaefXZmaMc16QIhAP7yNyaJ2Dxw8DHM5OLA5hueKDi0bGoEzllvxnrvD5NM",
  "RawTBSCertificateRequest": "MHwCAQAwGjEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlIENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZgGvEBQ/FlPEUunzr1X+Qd/xm88mLjEahMQfmk0Dss6OzX53rutP1yetdrxAbHEZ6b7mGVOFYJk104MVweI7eKAA",
  "RawSubjectPublicKeyInfo": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZgGvEBQ/FlPEUunzr1X+Qd/xm88mLjEahMQfmk0Dss6OzX53rutP1yetdrxAbHEZ6b7mGVOFYJk104MVweI7eA==",
  "RawSubject": "MBoxGDAWBgNVBAMTD0ludGVybWVkaWF0ZSBDQQ==",
  "Version": 0,
  "Signature": "MEYCIQCdmciYbhTfTA3rrrWvBgRuWl/DJZKBRBaefXZmaMc16QIhAP7yNyaJ2Dxw8DHM5OLA5hueKDi0bGoEzllvxnrvD5NM",
  "SignatureAlgorithm": 10,
  "PublicKeyAlgorithm": 3,
  "PublicKey": {
    "Curve": {
      "P": 115792089210356248762697446949407573530086143415290314195533631308867097853951,
      "N": 115792089210356248762697446949407573529996955224135760342422259061068512044369,
      "B": 41058363725152142129326129780047268409114441015993725554835256314039467401291,
      "Gx": 48439561293906451759052585252797914202762949526041747995844080717082404635286,
      "Gy": 36134250956749795798585127919587881956611106672985015071877198253568414405109,
      "BitSize": 256,
      "Name": "P-256"
    },
    "X": 46138885641659983430080903485448755337896834096028214294563990680908322812622,
    "Y": 64591500993797885380266791737762276863124256044322382082031650206363506850680
  },
  "Subject": {
    "Country": null,
    "Organization": null,
    "OrganizationalUnit": null,
    "Locality": null,
    "Province": null,
    "StreetAddress": null,
    "PostalCode": null,
    "SerialNumber": "",
    "CommonName": "Intermediate CA",
    "Names": [
      {
        "Type": [
          2,
          5,
          4,
          3
        ],
        "Value": "Intermediate CA"
      }
    ],
    "ExtraNames": null
  },
  "Attributes": null,
  "Extensions": null,
  "ExtraExtensions": null,
  "DNSNames": null,
  "EmailAddresses": null,
  "IPAddresses": null,
  "URIs": null
}

Display certificate details.

$ cfssl certinfo -cert ca/intermediate.pem

{
  "subject": {
    "common_name": "Intermediate CA",
    "names": [
      "Intermediate CA"
    ]
  },
  "issuer": {
    "common_name": "CA",
    "names": [
      "CA"
    ]
  },
  "serial_number": "722720822862120708336239517806371808811307146170",
  "not_before": "2022-08-09T21:42:00Z",
  "not_after": "2023-08-09T21:42:00Z",
  "sigalg": "ECDSAWithSHA256",
  "authority_key_id": "7:1A:79:18:71:B1:A2:C:78:23:3B:B7:E4:A8:F4:EE:DA:28:C0:A8",
  "subject_key_id": "B5:9C:16:2B:7B:57:5:37:EB:72:BE:F8:93:2C:57:F1:5D:46:A1:66",
  "pem": "-----BEGIN CERTIFICATE-----\nMIIBkDCCATWgAwIBAgIUfpfsKz16JaERgfN9yTA5k0dKm7owCgYIKoZIzj0EAwIw\nDTELMAkGA1UEAxMCQ0EwHhcNMjIwODA5MjE0MjAwWhcNMjMwODA5MjE0MjAwWjAa\nMRgwFgYDVQQDEw9JbnRlcm1lZGlhdGUgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMB\nBwNCAARmAa8QFD8WU8RS6fOvVf5B3/GbzyYuMRqExB+aTQOyzo7Nfneu60/XJ612\nvEBscRnpvuYZU4VgmTXTgxXB4jt4o2YwZDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0T\nAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUtZwWK3tXBTfrcr74kyxX8V1GoWYwHwYD\nVR0jBBgwFoAUBxp5GHGxogx4Izu35Kj07toowKgwCgYIKoZIzj0EAwIDSQAwRgIh\nAP/Ebo5OvshsBN2xG+4s48lX55HrDrjY+NppuNSouFsNAiEArVa2amMKyKH4lJ9G\nUZsn8hugqXk7DxnDUJ7eCP5lDNQ=\n-----END CERTIFICATE-----\n"
}

Create servers directory.

$ mkdir servers

Create certificate signing request for specific server.

$ cat  servers/octocat.cloud.json

{
    "CN": "octocat.cloud",
    "hosts": [
        "octocat.cloud",
        "*.octocat.cloud"
    ],
    "key": {
        "algo": "ecdsa",
        "size": 256
    }
}

Generate server certificate.

$ cfssl gencert -config config.json -ca ca/intermediate.pem -ca-key ca/intermediate-key.pem -profile server servers/octocat.cloud.json | cfssljson -bare servers/octocat.cloud

2022/08/09 23:48:16 [INFO] generate received request
2022/08/09 23:48:16 [INFO] received CSR
2022/08/09 23:48:16 [INFO] generating key: ecdsa-256
2022/08/09 23:48:16 [INFO] encoded CSR
2022/08/09 23:48:16 [INFO] signed certificate with serial number 598061817172767418647975386187038228727111508845

Display certificate signing request details.

$ cat servers/octocat.cloud.csr

$ cat servers/octocat.cloud.pem

$ cat servers/octocat.cloud-key.pem

Decode certificate signing request.

$ cfssl certinfo -csr servers/octocat.cloud.csr

{
  "Raw": "MIIBDjCBtgIBADAYMRYwFAYDVQQDEw1vY3RvY2F0LmNsb3VkMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgrcIzcmAD8evqNt6o78A/exJDJNVdfJFw8i0fQMQjHEaAnSUV648v2HdOby3QaH16w5NCu4ajc82fxqMH4RIbqA8MDoGCSqGSIb3DQEJDjEtMCswKQYDVR0RBCIwIIINb2N0b2NhdC5jbG91ZIIPKi5vY3RvY2F0LmNsb3VkMAoGCCqGSM49BAMCA0cAMEQCICif3KFMw1fzt46r8lOcJMtKi1BALD+lfNzJmJNlaz5CAiBAIcFpMRkodiGfeJ9aZzE7guhVNNjgVgslDY6i1odRjA==",
  "RawTBSCertificateRequest": "MIG2AgEAMBgxFjAUBgNVBAMTDW9jdG9jYXQuY2xvdWQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASCtwjNyYAPx6+o23qjvwD97EkMk1V18kXDyLR9AxCMcRoCdJRXrjy/Yd05vLdBofXrDk0K7hqNzzZ/GowfhEhuoDwwOgYJKoZIhvcNAQkOMS0wKzApBgNVHREEIjAggg1vY3RvY2F0LmNsb3Vkgg8qLm9jdG9jYXQuY2xvdWQ=",
  "RawSubjectPublicKeyInfo": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgrcIzcmAD8evqNt6o78A/exJDJNVdfJFw8i0fQMQjHEaAnSUV648v2HdOby3QaH16w5NCu4ajc82fxqMH4RIbg==",
  "RawSubject": "MBgxFjAUBgNVBAMTDW9jdG9jYXQuY2xvdWQ=",
  "Version": 0,
  "Signature": "MEQCICif3KFMw1fzt46r8lOcJMtKi1BALD+lfNzJmJNlaz5CAiBAIcFpMRkodiGfeJ9aZzE7guhVNNjgVgslDY6i1odRjA==",
  "SignatureAlgorithm": 10,
  "PublicKeyAlgorithm": 3,
  "PublicKey": {
    "Curve": {
      "P": 115792089210356248762697446949407573530086143415290314195533631308867097853951,
      "N": 115792089210356248762697446949407573529996955224135760342422259061068512044369,
      "B": 41058363725152142129326129780047268409114441015993725554835256314039467401291,
      "Gx": 48439561293906451759052585252797914202762949526041747995844080717082404635286,
      "Gy": 36134250956749795798585127919587881956611106672985015071877198253568414405109,
      "BitSize": 256,
      "Name": "P-256"
    },
    "X": 59124064090659368039972684833048761796286291427904476664394940453950382443633,
    "Y": 11764472359176663751076283782292254787550789644624181651413856393211328874606
  },
  "Subject": {
    "Country": null,
    "Organization": null,
    "OrganizationalUnit": null,
    "Locality": null,
    "Province": null,
    "StreetAddress": null,
    "PostalCode": null,
    "SerialNumber": "",
    "CommonName": "octocat.cloud",
    "Names": [
      {
        "Type": [
          2,
          5,
          4,
          3
        ],
        "Value": "octocat.cloud"
      }
    ],
    "ExtraNames": null
  },
  "Attributes": [
    {
      "Type": [
        1,
        2,
        840,
        113549,
        1,
        9,
        14
      ],
      "Value": [
        [
          {
            "Type": [
              2,
              5,
              29,
              17
            ],
            "Value": "MCCCDW9jdG9jYXQuY2xvdWSCDyoub2N0b2NhdC5jbG91ZA=="
          }
        ]
      ]
    }
  ],
  "Extensions": [
    {
      "Id": [
        2,
        5,
        29,
        17
      ],
      "Critical": false,
      "Value": "MCCCDW9jdG9jYXQuY2xvdWSCDyoub2N0b2NhdC5jbG91ZA=="
    }
  ],
  "ExtraExtensions": null,
  "DNSNames": [
    "octocat.cloud",
    "*.octocat.cloud"
  ],
  "EmailAddresses": null,
  "IPAddresses": null,
  "URIs": null
}

Display certificate details.

$ cfssl certinfo -cert servers/octocat.cloud.pem

{
  "subject": {
    "common_name": "octocat.cloud",
    "names": [
      "octocat.cloud"
    ]
  },
  "issuer": {
    "common_name": "Intermediate CA",
    "names": [
      "Intermediate CA"
    ]
  },
  "serial_number": "598061817172767418647975386187038228727111508845",
  "sans": [
    "octocat.cloud",
    "*.octocat.cloud"
  ],
  "not_before": "2022-08-09T21:43:00Z",
  "not_after": "2023-08-09T21:43:00Z",
  "sigalg": "ECDSAWithSHA256",
  "authority_key_id": "B5:9C:16:2B:7B:57:5:37:EB:72:BE:F8:93:2C:57:F1:5D:46:A1:66",
  "subject_key_id": "3C:94:B4:1E:D:C4:EB:47:EC:F0:F6:D7:35:BE:EC:A8:D1:84:94:5F",
  "pem": "-----BEGIN CERTIFICATE-----\nMIIB1jCCAXygAwIBAgIUaMIE9tKft5MLlZR/G5keER3+Y20wCgYIKoZIzj0EAwIw\nGjEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlIENBMB4XDTIyMDgwOTIxNDMwMFoXDTIz\nMDgwOTIxNDMwMFowGDEWMBQGA1UEAxMNb2N0b2NhdC5jbG91ZDBZMBMGByqGSM49\nAgEGCCqGSM49AwEHA0IABIK3CM3JgA/Hr6jbeqO/AP3sSQyTVXXyRcPItH0DEIxx\nGgJ0lFeuPL9h3Tm8t0Gh9esOTQruGo3PNn8ajB+ESG6jgaEwgZ4wDgYDVR0PAQH/\nBAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0O\nBBYEFDyUtB4NxOtH7PD21zW+7KjRhJRfMB8GA1UdIwQYMBaAFLWcFit7VwU363K+\n+JMsV/FdRqFmMCkGA1UdEQQiMCCCDW9jdG9jYXQuY2xvdWSCDyoub2N0b2NhdC5j\nbG91ZDAKBggqhkjOPQQDAgNIADBFAiEAoxH057bLSqSzgLPZaU/sySih88cWsiVu\npzaBHAtQ8lICICTVp6wBAO5iARU6e0fh69jOSjDQkhKtm9IT7aZJrw/u\n-----END CERTIFICATE-----\n"
}

Create bundle directory.

$ mkdir bundle

Create certificate bundle.

$ cfssl bundle -config config.json -cert servers/octocat.cloud.pem -key servers/octocat.cloud-key.pem -ca-bundle ca/ca.pem  -int-bundle ca/intermediate.pem | cfssljson -bare bundle/octocat.cloud

2022/08/10 00:55:59 [INFO] bundling certificate for CN=octocat.cloud
2022/08/10 00:55:59 [WARNING] No metadata, Ubiquitous falls back to Optimal.
2022/08/10 00:55:59 [INFO] the anchoring root is CN=CA

Inspect created files.

$  cat bundle/octocat.cloud-bundle.pem

$ cat bundle/octocat.cloud-key.pem

Additional notes

The way to generate client certificates should be obvious at this moment.

You can also use sqlite database, HTTP server handles CF SSL requests and OCSP.

Installation#

Basic usage#

Additional notes#

Installation

Basic usage

Additional notes