diff --git a/tools/BUILD b/tools/BUILD
index 2be1cea..d80ad4d 100644
--- a/tools/BUILD
+++ b/tools/BUILD
@@ -49,3 +49,9 @@
     srcs = ["calicoctl.sh"],
     data = [":calicoctl.bin", ":secretstore"],
 )
+
+copy_go_binary(
+    name = "cfssl",
+    src = "@com_github_cloudflare_cfssl//cmd/cfssl:cfssl",
+    visibility = ["//visibility:public"],
+)
diff --git a/tools/install.sh b/tools/install.sh
index 6a9bec1..5d611e6 100755
--- a/tools/install.sh
+++ b/tools/install.sh
@@ -9,4 +9,4 @@
 
 bazel build \
         //tools:kubectl //tools:kubecfg //tools:secretstore \
-        //tools:pass //tools:calicoctl.bin
+        //tools:pass //tools:calicoctl.bin //tools:cfssl