Build a certificate authority hierarchy with CFSSL

Thu, 12 Jan 2023 00:00:00 +0000

A server certificate is only one part of a trust chain. The server presents it, an intermediate CA signs it, and the client needs a trusted root to verify the chain.

This 2023 lab uses CFSSL, Cloudflare’s PKI toolkit, to create those three certificates. The example domain is example.com. Creating this private CA does not make browsers trust it, and generating the files does not configure a web server.

Example CA (root)
└── Example Intermediate CA
 └── example.com (server)

The original article did not record its CFSSL version. Keep that limit in mind when reproducing it. You’ll need cfssl and cfssljson; use the upstream installation instructions for your platform.

PKI on Thalamus

Build a certificate authority hierarchy with CFSSL