CFSSL

At a glance

• Editor score
  7.5 / 10
• Pricing
  Open source
• Best for
  Open-source CA tooling and certificate operations
• Paid from
  Free
• Deployment model
  On_premises
• Facts checked
  21 Sep 2026

• Where it wins

  • Covers signing, CSR and private-key generation, bundling, and verification
  • Includes an HTTP API, CA server operation, OCSP, and TLS scanning
  • Supports configurable profiles, multiroot signing, and JSON file conversion

• Where it doesn't

  • Requires teams to operate and maintain their own PKI deployment
  • Command-line and API workflows may demand engineering expertise
  • Teams needing ACME, SCEP, EST, or current HSM integration should compare alternatives

Our verdict on CFSSL

CFSSL is Cloudflare’s open-source PKI and TLS toolkit for developers and operators building or managing self-hosted certificate workflows. It runs on Windows, macOS, and Linux, and also provides an API-based option. The toolkit covers private-key and CSR generation, certificate signing and issuance, certificate bundling, chain verification, and JSON output conversion into certificate-related files. Its on-premises deployment model suits organizations that want control over certificate authority operations rather than a hosted PKI service.

The feature set reaches beyond basic issuance. CFSSL includes an HTTP API server, certificate authority server operation, OCSP signing and serving, TLS security scanning, and configurable certificate signing profiles. The multirootca component supports multiple signing keys, while mkbundle handles trust bundles. These capabilities make CFSSL a practical fit for teams assembling certificate operations from command-line utilities and APIs, especially where custom profiles and self-managed CA services matter.

CFSSL is free and open source, but the operational responsibility remains with the team deploying it. Its workflow is centered on toolkit components rather than a broad platform ecosystem or managed enrollment experience. Organizations that want to build and maintain their own PKI should consider it; teams seeking a service-led experience or requirements centered on ACME, SCEP, EST, or current HSM integration should compare alternatives before choosing it. The published project includes v1.6.5 as its latest release, so release governance should also be part of the evaluation.

Your product? Our editors can test CFSSL in depth and publish a review, labelled as paid · from $149/mo →

CFSSL pricing

CFSSL fact sheet

Alternatives to CFSSL

• EJBCAA broad, self-hosted PKI platform with deep certificate and deployment support.9.4
• DigiCert Private CAA flexible private CA for enterprises managing certificates across hybrid and air-gapped environments.9.2
• SSL.com Private Enterprise PKIManaged private PKI with broad enrollment protocols, lifecycle controls, and published plan pricing.9.1

See all CFSSL alternatives →

Featured on iTechGuides

CFSSL is listed in our Public Key Infrastructure Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/cfssl/"><img src="https://www.itechguides.com/best/badge/cfssl.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update