tools: add cfssl
diff --git a/WORKSPACE b/WORKSPACE
index 11ce1b8..5f65be1 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -87,3 +87,9 @@
     commit = "2cbc9195c892b304060269ef280375236d2fcac9",
     importpath = "github.com/shirou/gopsutil",
 )
+
+go_repository(
+    name = "com_github_cloudflare_cfssl",
+    commit = "768cd563887febaad559b511aaa5964823ccb4ab",
+    importpath = "github.com/cloudflare/cfssl",
+)
diff --git a/tools/BUILD b/tools/BUILD
index 2be1cea..d80ad4d 100644
--- a/tools/BUILD
+++ b/tools/BUILD
@@ -49,3 +49,9 @@
     srcs = ["calicoctl.sh"],
     data = [":calicoctl.bin", ":secretstore"],
 )
+
+copy_go_binary(
+    name = "cfssl",
+    src = "@com_github_cloudflare_cfssl//cmd/cfssl:cfssl",
+    visibility = ["//visibility:public"],
+)
diff --git a/tools/install.sh b/tools/install.sh
index 6a9bec1..5d611e6 100755
--- a/tools/install.sh
+++ b/tools/install.sh
@@ -9,4 +9,4 @@
 
 bazel build \
         //tools:kubectl //tools:kubecfg //tools:secretstore \
-        //tools:pass //tools:calicoctl.bin
+        //tools:pass //tools:calicoctl.bin //tools:cfssl