1PKI --SELF(1)                     strongSwan                     PKI --SELF(1)
2
3
4

NAME

6       pki --self - Create a self-signed certificate
7

SYNOPSIS

9       pki --self [--in file|--keyid hex] [--type t] --dn distinguished-name
10                  [--san subjectAltName] [--lifetime days] [--not-
11                  before datetime] [--not-after datetime] [--serial hex]
12                  [--flag flag] [--digest digest] [--rsa-padding padding]
13                  [--ca] [--ocsp uri] [--pathlen len] [--addrblock block]
14                  [--nc-permitted name] [--nc-excluded name] [--critical oid]
15                  [--policy-mapping mapping] [--policy-explicit len]
16                  [--policy-inhibit len] [--policy-any len]
17                  [--cert-policy oid [--cps-uri uri] [--user-notice text]]
18                  [--outform encoding] [--debug level]
19
20       pki --self --options file
21
22       pki --self -h | --help
23

DESCRIPTION

25       This sub-command of pki(1) is used to create a self-signed certificate.
26

OPTIONS

28       -h, --help
29              Print usage information with a summary of the available options.
30
31       -v, --debug level
32              Set debug level, default: 1.
33
34       -+, --options file
35              Read command line options from file.
36
37       -i, --in file
38              Private key input file. If not given the key is read from STDIN.
39
40       -x, --keyid hex
41              Smartcard or TPM private key object handle in hex format with an
42              optional 0x prefix.
43
44       -t, --type type
45              Type  of  the input key. Either priv, rsa, ecdsa, ed25519, ed448
46              or bliss, defaults to priv.
47
48       -d, --dn distinguished-name
49              Subject and issuer distinguished name (DN). Required.
50
51       -a, --san subjectAltName
52              subjectAltName extension to include in certificate. Can be  used
53              multiple times.
54
55       -l, --lifetime days
56              Days the certificate is valid, default: 1095. Ignored if both an
57              absolute start and end time are given.
58
59       -F, --not-before datetime
60              Absolute time when the validity of the certificate  begins.  The
61              datetime format is defined by the --dateform option.
62
63       -T, --not-after datetime
64              Absolute  time  when  the  validity of the certificate ends. The
65              datetime format is defined by the --dateform option.
66
67       -D, --dateform form
68              strptime(3) format for the --not-before and --not-after options,
69              default: %d.%m.%y %T
70
71       -s, --serial hex
72              Serial number in hex. It is randomly allocated by default.
73
74       -e, --flag flag
75              Add  extendedKeyUsage  flag. One of serverAuth, clientAuth, crl‐
76              Sign, or ocspSigning. Can be used multiple times.
77
78       -g, --digest digest
79              Digest to use for signature creation. One of md5, sha1,  sha224,
80              sha256,  sha384,  or sha512.  The default is determined based on
81              the type and size of the signature key.
82
83       -R, --rsa-padding padding
84              Padding to use for RSA signatures. Either pkcs1 or pss, defaults
85              to pkcs1.
86
87       -f, --outform encoding
88              Encoding of the created certificate file. Either der (ASN.1 DER)
89              or pem (Base64 PEM), defaults to der.
90
91       -b, --ca
92              Include CA basicConstraint extension in certificate.
93
94       -o, --ocsp uri
95              OCSP AuthorityInfoAccess URI to include in certificate.  Can  be
96              used multiple times.
97
98       -p, --pathlen len
99              Set path length constraint.
100
101       -B, --addrblock block
102              RFC  3779  address block to include in certificate. block is ei‐
103              ther a CIDR subnet (such as 10.0.0.0/8) or an arbitrary  address
104              range  (192.168.1.7-192.168.1.13).  Can  be  repeated to include
105              multiple blocks.  Please note that the supplied blocks  are  in‐
106              cluded  in  the  certificate as is, so for standards compliance,
107              multiple blocks must be supplied in correct order  and  adjacent
108              blocks must be combined. Refer to RFC 3779 for details.
109
110       -n, --nc-permitted name
111              Add  permitted  NameConstraint extension to certificate. For DNS
112              or email constraints, the identity type is not always detectable
113              by the given name. Use the dns: or email: prefix to force a con‐
114              straint type.
115
116       -N, --nc-excluded name
117              Add excluded NameConstraint extension to certificate. For DNS or
118              email constraints, the identity type is not always detectable by
119              the given name. Use the dns: or email: prefix to  force  a  con‐
120              straint type.
121
122       -X, --critical oid
123              Add a critical extension with the given OID.
124
125       -M, --policy-mapping issuer-oid:subject-oid
126              Add policyMapping from issuer to subject OID.
127
128       -E, --policy-explicit len
129              Add requireExplicitPolicy constraint.
130
131       -H, --policy-inhibit len
132              Add inhibitPolicyMapping constraint.
133
134       -A, --policy-any len
135              Add inhibitAnyPolicy constraint.
136
137   Certificate Policy
138       Multiple  certificatePolicy extensions can be added. Each with the fol‐
139       lowing information:
140
141       -P, --cert-policy oid
142              OID to include in certificatePolicy extension. Required.
143
144       -C, --cps-uri uri
145              Certification Practice statement URI for certificatePolicy.
146
147       -U, --user-notice text
148              User notice for certificatePolicy.
149

EXAMPLES

151       Generate a self-signed certificate using the given RSA key:
152
153         pki --self --in key.der --dn "C=CH, O=strongSwan, CN=moon" \
154             --san moon.strongswan.org > cert.der
155

SEE ALSO

157       pki(1)
158
159
160
1615.9.4                             2019-05-06                     PKI --SELF(1)
Impressum