1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
|
Bootstrapping CFSSL
====================
CFSSL has no other dependencies besides a working Go 1.4 installation.
It uses only standard library components, besides those packages
included in the software.
1. Installing CFSSL
```
go get -u github.com/cloudflare/cfssl/cmd/cfssl
```
The `cfssl` binary may now be found in the `$GOPATH/bin` directory.
1.1 Installing mkbundle
Installing the `mkbundle` utility is similar:
```
go get -u github.com/cloudflare/cfssl/cmd/mkbundle
```
1.2 Installing cfssljson
The `cfssljson` utility is installed with:
```
go get -u github.com/cloudflare/cfssl/cmd/cfssljson
```
Alternatively, all three can be accomplished in one pass:
```
go get -u github.com/cloudflare/cfssl/cmd/...
```
All three binaries will now be in the `$GOPATH/bin` directory.
2. Set up the intermediate and root certificate bundles
The pre-built default CloudFlare bundles may be found in the
[cfssl_trust](https://github.com/cloudflare/cfssl_trust) repository.
`cfssl` will, by default, look for these bundles in `/etc/cfssl/`;
it will look for a `ca-bundle.crt` and `int-bundle.crt`.
3. [Optional] Set up the CA certificate and key
First, create a JSON file containing the key request similar to the
following (perhaps in `ca.json`):
```
{
"hosts": [
"ca.example.com"
],
"key": {
"algo": "rsa",
"size": 4096
},
"names": [
{
"C": "US",
"L": "San Francisco",
"O": "Internet Widgets, LLC",
"OU": "Certificate Authority",
"ST": "California"
}
]
}
```
Then, initialise the CA:
```
cfssl genkey -initca ca.json | cfssljson -bare ca
```
When `cfssl` starts up, it will look by default for a CA key named
`ca-key.pem` and a certificate named `ca.pem` in `/etc/cfssl`; this may
be changed via the command line options. If it can't find the key and
certificate mentioned, it start up without the CA functionality enabled.
4. Start up the server
```
cfssl serve
```
The endpoints for the server are described in `doc/api.txt`.
|
