CFSSL review
A free, self-hosted toolkit for teams operating certificate authorities and TLS workflows.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
CFSSL is Cloudflare’s open-source PKI and TLS toolkit for developers and operators building or managing self-hosted certificate workflows. It runs on Windows, macOS, and Linux, and also provides an API-based option. The toolkit covers private-key and CSR generation, certificate signing and issuance, certificate bundling, chain verification, and JSON output conversion into certificate-related files. Its on-premises deployment model suits organizations that want control over certificate authority operations rather than a hosted PKI service.
The feature set reaches beyond basic issuance. CFSSL includes an HTTP API server, certificate authority server operation, OCSP signing and serving, TLS security scanning, and configurable certificate signing profiles. The multirootca component supports multiple signing keys, while mkbundle handles trust bundles. These capabilities make CFSSL a practical fit for teams assembling certificate operations from command-line utilities and APIs, especially where custom profiles and self-managed CA services matter.
CFSSL is free and open source, but the operational responsibility remains with the team deploying it. Its workflow is centered on toolkit components rather than a broad platform ecosystem or managed enrollment experience. Organizations that want to build and maintain their own PKI should consider it; teams seeking a service-led experience or requirements centered on ACME, SCEP, EST, or current HSM integration should compare alternatives before choosing it. The published project includes v1.6.5 as its latest release, so release governance should also be part of the evaluation.
CFSSL pros and cons
- Where it wins
- Covers signing, CSR and private-key generation, bundling, and verification
- Includes an HTTP API, CA server operation, OCSP, and TLS scanning
- Supports configurable profiles, multiroot signing, and JSON file conversion
- Where it doesn't
- Requires teams to operate and maintain their own PKI deployment
- Command-line and API workflows may demand engineering expertise
- Teams needing ACME, SCEP, EST, or current HSM integration should compare alternatives
CFSSL fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update