diff --git a/.travis.yml b/.travis.yml
index d65bfc642..82b5efd18 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -30,7 +30,7 @@ services:
 
 # Only build pull requests, pushes to the master branch, and branches
 # starting with `test-`. This is a convenient way to push branches to
-# your own fork of the repostiory to ensure Travis passes before submitting
+# your own fork of the repository to ensure Travis passes before submitting
 # a PR. For instance, you might run:
 # git push myremote branchname:test-branchname
 branches:
diff --git a/api/api.go b/api/api.go
index 98b0ec462..1d7e23e13 100644
--- a/api/api.go
+++ b/api/api.go
@@ -176,7 +176,7 @@ type Response struct {
 	Messages []ResponseMessage `json:"messages"`
 }
 
-// NewSuccessResponse is a shortcut for creating new successul API
+// NewSuccessResponse is a shortcut for creating new successful API
 // responses.
 func NewSuccessResponse(result interface{}) Response {
 	return Response{
diff --git a/api/bundle/bundle.go b/api/bundle/bundle.go
index 3f048306b..179c22f66 100644
--- a/api/bundle/bundle.go
+++ b/api/bundle/bundle.go
@@ -62,7 +62,7 @@ func (h *Handler) Handle(w http.ResponseWriter, r *http.Request) error {
 	case "certificate":
 		bundle, err := h.bundler.BundleFromPEMorDER([]byte(blob["certificate"]), []byte(blob["private_key"]), bf, "")
 		if err != nil {
-			log.Warning("bad PEM certifcate or private key")
+			log.Warning("bad PEM certificate or private key")
 			return err
 		}
 
diff --git a/api/certinfo/certinfo.go b/api/certinfo/certinfo.go
index eb2eb12c1..d44f17a56 100644
--- a/api/certinfo/certinfo.go
+++ b/api/certinfo/certinfo.go
@@ -58,7 +58,7 @@ func (h *Handler) Handle(w http.ResponseWriter, r *http.Request) (err error) {
 		}
 	case "certificate":
 		if cert, err = certinfo.ParseCertificatePEM([]byte(blob["certificate"])); err != nil {
-			log.Warningf("bad PEM certifcate: %v", err)
+			log.Warningf("bad PEM certificate: %v", err)
 			return err
 		}
 	case "serial", "authority_key_id":
diff --git a/api/client/client.go b/api/client/client.go
index 3f48bb105..0e743cb6f 100644
--- a/api/client/client.go
+++ b/api/client/client.go
@@ -328,7 +328,7 @@ func (ar *AuthRemote) Sign(req []byte) ([]byte, error) {
 	return ar.AuthSign(req, nil, ar.provider)
 }
 
-// nomalizeURL checks for http/https protocol, appends "http" as default protocol if not defiend in url
+// normalizeURL checks for http/https protocol, appends "http" as default protocol if not defined in url
 func normalizeURL(addr string) (*url.URL, error) {
 	addr = strings.TrimSpace(addr)
 
diff --git a/bundler/bundler.go b/bundler/bundler.go
index 31177e154..59497af97 100644
--- a/bundler/bundler.go
+++ b/bundler/bundler.go
@@ -44,7 +44,7 @@ const (
 	// by the most platforms.
 	Ubiquitous BundleFlavor = "ubiquitous"
 
-	// Force means the bundler only verfiies the input as a valid bundle, not optimization is done.
+	// Force means the bundler only verifies the input as a valid bundle, not optimization is done.
 	Force BundleFlavor = "force"
 )
 
@@ -470,7 +470,7 @@ func constructCertFileName(cert *x509.Certificate) string {
 // intermediate pool, the certificate is saved to file and added to
 // the list of intermediates to be used for verification. This will
 // not add any new certificates to the root pool; if the ultimate
-// issuer is not trusted, fetching the certicate here will not change
+// issuer is not trusted, fetching the certificate here will not change
 // that.
 func (b *Bundler) fetchIntermediates(certs []*x509.Certificate) (err error) {
 	if IntermediateStash != "" {
diff --git a/bundler/bundler_test.go b/bundler/bundler_test.go
index 2448c193a..44c242fba 100644
--- a/bundler/bundler_test.go
+++ b/bundler/bundler_test.go
@@ -774,7 +774,7 @@ func newBundlerFromPEM(t *testing.T, caBundlePEM, intBundlePEM []byte) (b *Bundl
 }
 
 // newCustomizedBundleCreator is a helper function that returns a new Bundler
-// takes specified CA bundle, intermediate bundle, and any additional intermdiate certs to generate a bundler.
+// takes specified CA bundle, intermediate bundle, and any additional intermediate certs to generate a bundler.
 func newCustomizedBundlerFromFile(t *testing.T, caBundle, intBundle, adhocInters string) (b *Bundler) {
 	b, err := NewBundler(caBundle, intBundle)
 	if err != nil {
diff --git a/certdb/sql/database_accessor.go b/certdb/sql/database_accessor.go
index a0c45b731..b6d6273d9 100644
--- a/certdb/sql/database_accessor.go
+++ b/certdb/sql/database_accessor.go
@@ -327,7 +327,7 @@ func (d *Accessor) UpdateOCSP(serial, aki, body string, expiry time.Time) error
 // We didn't implement 'upsert' with SQL statement and we lost race condition
 // prevention provided by underlying DBMS.
 // Reasoning:
-// 1. it's diffcult to support multiple DBMS backends in the same time, the
+// 1. it's difficult to support multiple DBMS backends in the same time, the
 // SQL syntax differs from one to another.
 // 2. we don't need a strict simultaneous consistency between OCSP and certificate
 // status. It's OK that a OCSP response still shows 'good' while the
diff --git a/cli/config.go b/cli/config.go
index 0f72b9ef8..d174f3a6d 100644
--- a/cli/config.go
+++ b/cli/config.go
@@ -124,7 +124,7 @@ func registerFlags(c *Config, f *flag.FlagSet) {
 	f.StringVar(&c.Password, "password", "0", "Password for accessing PKCS #12 data passed to bundler")
 	f.StringVar(&c.Usage, "usage", "", "usage of private key")
 	f.StringVar(&c.PGPPrivate, "pgp-private", "", "file to load a PGP Private key decryption")
-	f.StringVar(&c.PGPName, "pgp-name", "", "PGP public key name, can be a comma-sepearted  key name list")
+	f.StringVar(&c.PGPName, "pgp-name", "", "PGP public key name, can be a comma-separated  key name list")
 	f.StringVar(&c.Serial, "serial", "", "certificate serial number")
 	f.StringVar(&c.CNOverride, "cn", "", "certificate common name (CN)")
 	f.StringVar(&c.AKI, "aki", "", "certificate issuer (authority) key identifier")
diff --git a/cli/serve/static/assets/cfssl.js b/cli/serve/static/assets/cfssl.js
index 30c304b50..fe1872a22 100644
--- a/cli/serve/static/assets/cfssl.js
+++ b/cli/serve/static/assets/cfssl.js
@@ -81,7 +81,7 @@
     'scan.tlshandshake.title': 'TLS Handshake',
     'scan.tlshandshake.description': 'Scans for host\'s SSL and TLS versions and cipher suite negotiation.',
     'scan.tlshandshake.CipherSuite.title': 'Cipher Suite Matrix',
-    'scan.tlshandshake.CipherSuite.body': 'Determines host\'s cipher suite accepted and prefered order.',
+    'scan.tlshandshake.CipherSuite.body': 'Determines host\'s cipher suite accepted and preferred order.',
     'scan.tlssession.title': 'TLS Session',
     'scan.tlssession.description': 'Scans host\'s implementation of TLS session resumption using session ticket and session IDs.',
     'scan.tlssession.SessionResume.title': 'Session Resumption',
diff --git a/cmd/cfssl/cfssl.go b/cmd/cfssl/cfssl.go
index 7bf1e130c..6d8cb60ee 100644
--- a/cmd/cfssl/cfssl.go
+++ b/cmd/cfssl/cfssl.go
@@ -54,7 +54,7 @@ import (
 // main defines the cfssl usage and registers all defined commands and flags.
 func main() {
 	// Add command names to cfssl usage
-	flag.Usage = nil // this is set to nil for testabilty
+	flag.Usage = nil // this is set to nil for testability
 	// Register commands.
 	cmds := map[string]*cli.Command{
 		"bundle":         bundle.Command,
diff --git a/config/config.go b/config/config.go
index 56eeb4367..59ef604fd 100644
--- a/config/config.go
+++ b/config/config.go
@@ -85,7 +85,7 @@ type SigningProfile struct {
 	BackdateString      string       `json:"backdate"`
 	AuthKeyName         string       `json:"auth_key"`
 	CopyExtensions      bool         `json:"copy_extensions"`
-	PrevAuthKeyName     string       `json:"prev_auth_key"` // to suppport key rotation
+	PrevAuthKeyName     string       `json:"prev_auth_key"` // to support key rotation
 	RemoteName          string       `json:"remote"`
 	NotBefore           time.Time    `json:"not_before"`
 	NotAfter            time.Time    `json:"not_after"`
diff --git a/config/config_test.go b/config/config_test.go
index 73dc0deb6..1ba994504 100644
--- a/config/config_test.go
+++ b/config/config_test.go
@@ -401,9 +401,9 @@ func TestParse(t *testing.T) {
 	for _, p := range invalidProfiles {
 		if p.populate(nil) == nil {
 			if p != nil {
-				t.Fatalf("ExpiryString=%s should not be parseable", p.ExpiryString)
+				t.Fatalf("ExpiryString=%s should not be parsable", p.ExpiryString)
 			}
-			t.Fatalf("Nil profile should not be parseable")
+			t.Fatalf("Nil profile should not be parsable")
 		}
 	}
 
diff --git a/doc/cmd/cfssl.txt b/doc/cmd/cfssl.txt
index c68d30ca6..581ffb43b 100644
--- a/doc/cmd/cfssl.txt
+++ b/doc/cmd/cfssl.txt
@@ -89,7 +89,7 @@ blank.
 	+ Key Usages
 		+ signing
 		+ digital signature
-		+ content committment
+		+ content commitment
 		+ key encipherment
 		+ key agreement
 		+ data encipherment
diff --git a/helpers/derhelpers/ed25519.go b/helpers/derhelpers/ed25519.go
index 9220f3e5f..eb669ce93 100644
--- a/helpers/derhelpers/ed25519.go
+++ b/helpers/derhelpers/ed25519.go
@@ -26,7 +26,7 @@ type subjectPublicKeyInfo struct {
 
 // MarshalEd25519PublicKey creates a DER-encoded SubjectPublicKeyInfo for an
 // ed25519 public key, as defined in
-// https://tools.ietf.org/html/draft-ietf-curdle-pkix-04. This is analagous to
+// https://tools.ietf.org/html/draft-ietf-curdle-pkix-04. This is analogous to
 // MarshalPKIXPublicKey in crypto/x509, which doesn't currently support Ed25519.
 func MarshalEd25519PublicKey(pk crypto.PublicKey) ([]byte, error) {
 	pub, ok := pk.(ed25519.PublicKey)
@@ -82,7 +82,7 @@ type oneAsymmetricKey struct {
 // oneAsymmetricKey.
 type curvePrivateKey []byte
 
-// MarshalEd25519PrivateKey returns a DER encdoing of the input private key as
+// MarshalEd25519PrivateKey returns a DER encoding of the input private key as
 // specified in https://tools.ietf.org/html/draft-ietf-curdle-pkix-04.
 func MarshalEd25519PrivateKey(sk crypto.PrivateKey) ([]byte, error) {
 	priv, ok := sk.(ed25519.PrivateKey)