cli

certificate distribution, root federation, root certificate (un)installation[3], certificate renewal, and (passive) revocation - `step` is also useful as a generic swiss army knife for security tech like JWTs, JWKs, NaCl, OAuth, and more... not necessary relevant for this comparison, but useful[4] This might be unfair... but I think philosophically the projects serve different purposes. CFSSL was created to serve CloudFlare's specific internal PKI needs, and it does that well, and it was awesome of them to open source it. `step` & `step-ca` was created because we believe everyone deserves great internal public key infrastructure and there's a tooling gap. So I think we're more interested in addressing a broader variety of use cases than CFSSL is. There are some definite advantages of CFSSL though. Someone can probably extend this list and I'd love to discuss, but some obvious ones from my perspective are: - They have a bigger community (at least for now :) - They've been around longer - There's more documentation out there about how to do things with CFSSL (see point #1) Functionally, I think the only thing that CFSSL has that we don't at the moment is "active" certificate revocation -- CRLs & OCSP. We think short-lived certificates[5] are a better approach, and design for that primarily, but we're planning to fill this gap soon so at that point I think we'll be parity+ with CFSSL. [1] https://smallstep.com/blog/easily-curl-services-secured-by-h... [2] https://smallstep.com/docs/cli/ca/#commands [3] https://smallstep.com/docs/cli/certificate/install/ [4] https://github.com/smallstep/cli/blob/master/README.md#Featu... [5] https://smallstep.com/blog/passive-revocation/