CFSSL: The Evolution of an Open-Source PKI Toolkit
Cloudflare head of cryptography Nick Sullivan introduces CFSSL, an open-source Go toolkit for automated TLS certificate authority operations and PKI bundling.
Summary
The Operational Pain of Legacy Certificate Management
Managing Public Key Infrastructure (PKI) with traditional OpenSSL command-line tools is notoriously error-prone, resulting in expired certificates and insecure TLS configurations.
Introducing Cloudflare's Open-Source CFSSL
Nick Sullivan presents CFSSL, a lightweight, modular Go framework designed for programmatic certificate generation, signing, and verification via REST APIs.
Automating Certificate Bundling and Chain Validation
Sullivan explains CFSSL's intelligent bundling engine, which automatically constructs optimal intermediate certificate chains and detects revocation statuses.
Deploying Internal Microservice Mutual TLS (mTLS)
The author demonstrates deploying CFSSL as an internal Certificate Authority to automate secure mutual TLS authentication across distributed microservices.
Related talks
Cloud Village·12 min
Kevin Chen
Kevin Chen breaks down Public Key Infrastructure (PKI) concepts, removing the intimidation around TLS certificates, trust chains, and cloud CAs.
Main Stage·50 min
Aapo Oksman
Aapo Oksman introduces certmitm, an automated tool designed to discover and exploit insecure TLS client certificate validation flaws across iOS, Windows 11, and embedded devices.
Crypto and Privacy Village·44 min
Analyzing certificate revocation protocols including CRL and OCSP, exploring the systemic vulnerabilities and privacy leaks undermining public PKI.