Personal tools
Skip to content. | Skip to navigation
Golang core compiler tools
Alibaba Cloud (Aliyun) CLI.
Alibaba Cloud (Aliyun) Object Storage Service (OSS) CLI.
certmgr is a tool for managing certificates using CFSSL. It does the following: Ensures certificates are present. Renews certificates before they expire. Triggering a service reload or restart on certificate updates. It operates on certificate specs, which are JSON files containing the information needed to generate a certificate. These are currently JSON due to the way CFSSL works; a future update can add YAML tags to the relevant CFSSL structures to allow these to be YAML files. If a certificate can't be renewed (i.e. there's a problem talking to the CA), the certificate is kept in the renewal queue and will be attempted later. When run without any subcommands, certmgr will start monitoring certificates. The configuration and specifications can be validated using the check subcommand.
CFSSL is CloudFlare's PKI/TLS swiss army knife. It is both a command line tool and an HTTP API server for signing, verifying, and bundling TLS certificates. It requires Go 1.11+ to build. Note that certain linux distributions have certain algorithms removed (RHEL-based distributions in particular), so the golang from the official repositories will not work. Users of these distributions should install go manually to install CFSSL. CFSSL consists of: a set of packages useful for building custom TLS PKI tools the cfssl program, which is the canonical command line utility using the CFSSL packages. the multirootca program, which is a certificate authority server that can use multiple signing keys. the mkbundle program is used to build certificate pool bundles. the cfssljson program, which takes the JSON output from the cfssl and multirootca programs and writes certificates, keys, CSRs, and bundles to disk.
This is the trust stores Cloudflare uses for CFSSL. It also includes the sources of the trust chain that can be built using the mkbundle utility from CFSSL. The ca-bundle.crt file contains the trusted roots. CFSSL uses the ca-bundle.crt.metadata when building bundles to assist in building bundles that need to verified in the maximum number of trust stores on different systems. The int-bundle.crt file contains a number of known intermediates; these are preloaded for performance reasons and occasionally updated as CFSSL finds more intermediates. If an intermediate isn't in this bundle, but can be found through following the AIA CA Issuers fields, it will be downloaded and eventually merged into here. The trusted_roots directory contains the root stores from a number of systems. Currently, we have trust stores from NSS (Firefox, Chrome) OS X Windows Android 2.2 (Frozen Yogurt) Android 2.3 (Gingerbread) Android 3.x (Honeycomb) Android 4.0 (Ice Cream Sandwich) Android 4.4 (KitKat)
CFSSL's CA trust store repository
Go server for two-man rule style file encryption and decryption.
The official command line interface for the DigitalOcean API