1certtool(1) User Commands certtool(1)
2
6 certtool - GnuTLS certificate tool
7
9 certtool [-flags] [-flag [value]] [--option-name[[=| ]value]]
10 All arguments must be options.
12
15 Tool to parse and generate X.509 certificates, requests and private
16 keys. It can be used interactively or non interactively by specifying
17 the template command line option.
18 The tool accepts files or supported URIs via the --infile option. In
20 case PIN is required for URI access you can provide it using the envi‐
21 ronment variables GNUTLS_PIN and GNUTLS_SO_PIN.
22
25 -d number, --debug=number
26 Enable debugging. This option takes an integer number as its
27 argument. The value of number is constrained to being:
28 in the range 0 through 9999
29 Specifies the debug level.
31 -V, --verbose
33 More verbose output. This option may appear an unlimited number
34 of times.
35 --infile=file
38 Input file.
39 --outfile=string
42 Output file.
43 Certificate related options
46 -i, --certificate-info
47 Print information on the given certificate.
48 --pubkey-info
51 Print information on a public key.
52 The option combined with --load-request, --load-pubkey, --load-
54 privkey and --load-certificate will extract the public key of
55 the object in question.
56 -s, --generate-self-signed
58 Generate a self-signed certificate.
59 -c, --generate-certificate
62 Generate a signed certificate.
63 --generate-proxy
66 Generates a proxy certificate.
67 -u, --update-certificate
70 Update a signed certificate.
71 --fingerprint
74 Print the fingerprint of the given certificate.
75 This is a simple hash of the DER encoding of the certificate. It
77 can be combined with the --hash parameter. However, it is recom‐
78 mended for identification to use the key-id which depends only
79 on the certificate's key.
80 --key-id
82 Print the key ID of the given certificate.
83 This is a hash of the public key of the given certificate. It
85 identifies the key uniquely, remains the same on a certificate
86 renewal and depends only on signed fields of the certificate.
87 --certificate-pubkey
89 Print certificate's public key.
90 This option is deprecated as a duplicate of --pubkey-info
92 NOTE: THIS OPTION IS DEPRECATED
94 --v1 Generate an X.509 version 1 certificate (with no extensions).
96 --sign-params=string
99 Sign a certificate with a specific signature algorithm.
100 This option can be combined with --generate-certificate, to sign
102 the certificate with a specific signature algorithm variant. The
103 only option supported is 'RSA-PSS', and should be specified when
104 the signer does not have a certificate which is marked for RSA-
105 PSS use only.
106 Certificate request related options
108 --crq-info
109 Print information on the given certificate request.
110 -q, --generate-request
113 Generate a PKCS #10 certificate request. This option must not
114 appear in combination with any of the following options: infile.
115 Will generate a PKCS #10 certificate request. To specify a pri‐
117 vate key use --load-privkey.
118 --no-crq-extensions
120 Do not use extensions in certificate requests.
121 PKCS#12 file related options
124 --p12-info
125 Print information on a PKCS #12 structure.
126 This option will dump the contents and print the metadata of the
128 provided PKCS #12 structure.
129 --p12-name=string
131 The PKCS #12 friendly name to use.
132 The name to be used for the primary certificate and private key
134 in a PKCS #12 file.
135 --to-p12
137 Generate a PKCS #12 structure.
138 It requires a certificate, a private key and possibly a CA cer‐
140 tificate to be specified.
141 Private key related options
143 -k, --key-info
144 Print information on a private key.
145 --p8-info
148 Print information on a PKCS #8 structure.
149 This option will print information about encrypted PKCS #8
151 structures. That option does not require the decryption of the
152 structure.
153 --to-rsa
155 Convert an RSA-PSS key to raw RSA format.
156 It requires an RSA-PSS key as input and will output a raw RSA
158 key. This command is necessary for compatibility with applica‐
159 tions that cannot read RSA-PSS keys.
160 -p, --generate-privkey
162 Generate a private key.
163 When generating RSA-PSS private keys, the --hash option will
165 restrict the allowed hash for the key; in the same keys the
166 --salt-size option is also acceptable.
167 --key-type=string
169 Specify the key type to use on key generation.
170 This option can be combined with --generate-privkey, to specify
172 the key type to be generated. Valid options are, 'rsa', 'rsa-
173 pss', 'dsa', 'ecdsa', 'ed25519, and 'ed448'.'. When combined
174 with certificate generation it can be used to specify an RSA-PSS
175 certificate when an RSA key is given.
176 --bits=number
178 Specify the number of bits for key generation. This option
179 takes an integer number as its argument.
180 --curve=string
183 Specify the curve used for EC key generation.
184 Supported values are secp192r1, secp224r1, secp256r1, secp384r1
186 and secp521r1.
187 --sec-param=security parameter
189 Specify the security level [low, legacy, medium, high, ultra].
190 This is alternative to the bits option.
192 --to-p8
194 Convert a given key to a PKCS #8 structure.
195 This needs to be combined with --load-privkey.
197 -8, --pkcs8
199 Use PKCS #8 format for private keys.
200 --provable
203 Generate a private key or parameters from a seed using a prov‐
204 able method.
205 This will use the FIPS PUB186-4 algorithms (i.e., Shawe-Taylor)
207 for provable key generation. When specified the private keys or
208 parameters will be generated from a seed, and can be later vali‐
209 dated with --verify-provable-privkey to be correctly generated
210 from the seed. You may specify --seed or allow GnuTLS to gener‐
211 ate one (recommended). This option can be combined with --gener‐
212 ate-privkey or --generate-dh-params.
213 That option applies to RSA and DSA keys. On the DSA keys the PQG
215 parameters are generated using the seed, and on RSA the two
216 primes.
217 --verify-provable-privkey
219 Verify a private key generated from a seed using a provable
220 method.
221 This will use the FIPS-186-4 algorithms for provable key genera‐
223 tion. You may specify --seed or use the seed stored in the pri‐
224 vate key structure.
225 --seed=string
227 When generating a private key use the given hex-encoded seed.
228 The seed acts as a security parameter for the private key, and
230 thus a seed size which corresponds to the security level of the
231 private key should be provided (e.g., 256-bits seed).
232 CRL related options
234 -l, --crl-info
235 Print information on the given CRL structure.
236 --generate-crl
239 Generate a CRL.
240 This option generates a Certificate Revocation List. When com‐
242 bined with --load-crl it would use the loaded CRL as base for
243 the generated (i.e., all revoked certificates in the base will
244 be copied to the new CRL). To add new certificates to the CRL
245 use --load-certificate.
246 --verify-crl
248 Verify a Certificate Revocation List using a trusted list. This
249 option must appear in combination with the following options:
250 load-ca-certificate.
251 The trusted certificate list must be loaded with --load-ca-cer‐
253 tificate.
254 Certificate verification related options
256 -e, --verify-chain
257 Verify a PEM encoded certificate chain.
258 Verifies the validity of a certificate chain. That is, an
260 ordered set of certificates where each one is the issuer of the
261 previous, and the first is the end-certificate to be validated.
262 In a proper chain the last certificate is a self signed one. It
263 can be combined with --verify-purpose or --verify-hostname.
264 --verify
266 Verify a PEM encoded certificate (chain) against a trusted set.
267 The trusted certificate list can be loaded with --load-ca-cer‐
269 tificate. If no certificate list is provided, then the system's
270 trusted certificate list is used. Note that during verification
271 multiple paths may be explored. On a successful verification the
272 successful path will be the last one. It can be combined with
273 --verify-purpose or --verify-hostname.
274 --verify-hostname=string
276 Specify a hostname to be used for certificate chain verifica‐
277 tion.
278 This is to be combined with one of the verify certificate
280 options.
281 --verify-email=string
283 Specify a email to be used for certificate chain verification.
284 This option must not appear in combination with any of the fol‐
285 lowing options: verify-hostname.
286 This is to be combined with one of the verify certificate
288 options.
289 --verify-purpose=string
291 Specify a purpose OID to be used for certificate chain verifica‐
292 tion.
293 This object identifier restricts the purpose of the certificates
295 to be verified. Example purposes are 1.3.6.1.5.5.7.3.1 (TLS
296 WWW), 1.3.6.1.5.5.7.3.4 (EMAIL) etc. Note that a CA certificate
297 without a purpose set (extended key usage) is valid for any pur‐
298 pose.
299 --verify-allow-broken
301 Allow broken algorithms, such as MD5 for verification.
302 This can be combined with --p7-verify, --verify or --verify-
304 chain.
305 --verify-profile=string
307 Specify a security level profile to be used for verification.
308 This option can be used to specify a certificate verification
310 profile. Certificate
311 verification profiles correspond to the security level. This
312 should be one of
313 'none', 'very weak', 'low', 'legacy', 'medium', 'high',
314 'ultra',
315 'future'. Note that by default no profile is applied, unless
316 one is set
317 as minimum in the gnutls configuration file.
318 PKCS#7 structure options
320 --p7-generate
321 Generate a PKCS #7 structure.
322 This option generates a PKCS #7 certificate container structure.
324 To add certificates in the structure use --load-certificate and
325 --load-crl.
326 --p7-sign
328 Signs using a PKCS #7 structure.
329 This option generates a PKCS #7 structure containing a signature
331 for the provided data from infile. The data are stored within
332 the structure. The signer certificate has to be specified using
333 --load-certificate and --load-privkey. The input to --load-cer‐
334 tificate can be a list of certificates. In case of a list, the
335 first certificate is used for signing and the other certificates
336 are included in the structure.
337 --p7-detached-sign
339 Signs using a detached PKCS #7 structure.
340 This option generates a PKCS #7 structure containing a signature
342 for the provided data from infile. The signer certificate has to
343 be specified using --load-certificate and --load-privkey. The
344 input to --load-certificate can be a list of certificates. In
345 case of a list, the first certificate is used for signing and
346 the other certificates are included in the structure.
347 --p7-include-cert, --no-p7-include-cert
349 The signer's certificate will be included in the cert list..
350 The no-p7-include-cert form will disable the option. This
351 option is enabled by default.
352 This options works with --p7-sign or --p7-detached-sign and will
354 include or exclude the signer's certificate into the generated
355 signature.
356 --p7-time, --no-p7-time
358 Will include a timestamp in the PKCS #7 structure. The
359 no-p7-time form will disable the option.
360 This option will include a timestamp in the generated signature
362 --p7-show-data, --no-p7-show-data
364 Will show the embedded data in the PKCS #7 structure. The
365 no-p7-show-data form will disable the option.
366 This option can be combined with --p7-verify or --p7-info and
368 will display the embedded signed data in the PKCS #7 structure.
369 --p7-info
371 Print information on a PKCS #7 structure.
372 --p7-verify
375 Verify the provided PKCS #7 structure.
376 This option verifies the signed PKCS #7 structure. The certifi‐
378 cate list to use for verification can be specified with --load-
379 ca-certificate. When no certificate list is provided, then the
380 system's certificate list is used. Alternatively a direct signer
381 can be provided using --load-certificate. A key purpose can be
382 enforced with the --verify-purpose option, and the --load-data
383 option will utilize detached data.
384 --smime-to-p7
386 Convert S/MIME to PKCS #7 structure.
387 Other options
390 --generate-dh-params
391 Generate PKCS #3 encoded Diffie-Hellman parameters.
392 The will generate random parameters to be used with Diffie-Hell‐
394 man key exchange. The output parameters will be in PKCS #3 for‐
395 mat. Note that it is recommended to use the --get-dh-params
396 option instead.
397 NOTE: THIS OPTION IS DEPRECATED
399 --get-dh-params
401 List the included PKCS #3 encoded Diffie-Hellman parameters.
402 Returns stored DH parameters in GnuTLS. Those parameters
404 returned are defined in RFC7919, and can be considered standard
405 parameters for a TLS key exchange. This option is provided for
406 old applications which require DH parameters to be specified;
407 modern GnuTLS applications should not require them.
408 --dh-info
410 Print information PKCS #3 encoded Diffie-Hellman parameters.
411 --load-privkey=string
414 Loads a private key file.
415 This can be either a file or a PKCS #11 URL
417 --load-pubkey=string
419 Loads a public key file.
420 This can be either a file or a PKCS #11 URL
422 --load-request=string
424 Loads a certificate request file.
425 This option can be used with a file
427 --load-certificate=string
429 Loads a certificate file.
430 This option can be used with a file
432 --load-ca-privkey=string
434 Loads the certificate authority's private key file.
435 This can be either a file or a PKCS #11 URL
437 --load-ca-certificate=string
439 Loads the certificate authority's certificate file.
440 This can be either a file or a PKCS #11 URL
442 --load-crl=string
444 Loads the provided CRL.
445 This option can be used with a file
447 --load-data=string
449 Loads auxiliary data.
450 This option can be used with a file
452 --password=string
454 Password to use.
455 You can use this option to specify the password in the command
457 line instead of reading it from the tty. Note, that the command
458 line arguments are available for view in others in the system.
459 Specifying password as '' is the same as specifying no password.
460 --null-password
462 Enforce a NULL password.
463 This option enforces a NULL password. This is different than the
465 empty or no password in schemas like PKCS #8.
466 --empty-password
468 Enforce an empty password.
469 This option enforces an empty password. This is different than
471 the NULL or no password in schemas like PKCS #8.
472 --hex-numbers
474 Print big number in an easier format to parse.
475 --cprint
478 In certain operations it prints the information in C-friendly
479 format.
480 In certain operations it prints the information in C-friendly
482 format, suitable for including into C programs.
483 --rsa Generate RSA key.
485 When combined with --generate-privkey generates an RSA private
487 key.
488 NOTE: THIS OPTION IS DEPRECATED
490 --dsa Generate DSA key.
492 When combined with --generate-privkey generates a DSA private
494 key.
495 NOTE: THIS OPTION IS DEPRECATED
497 --ecc Generate ECC (ECDSA) key.
499 When combined with --generate-privkey generates an elliptic
501 curve private key to be used with ECDSA.
502 NOTE: THIS OPTION IS DEPRECATED
504 --ecdsa
506 This is an alias for the --ecc option.
507 NOTE: THIS OPTION IS DEPRECATED
509 --hash=string
511 Hash algorithm to use for signing.
512 Available hash functions are SHA1, RMD160, SHA256, SHA384,
514 SHA512, SHA3-224, SHA3-256, SHA3-384, SHA3-512.
515 --salt-size=number
517 Specify the RSA-PSS key default salt size. This option takes an
518 integer number as its argument.
519 Typical keys shouldn't set or restrict this option.
521 --inder, --no-inder
523 Use DER format for input certificates, private keys, and DH
524 parameters . The no-inder form will disable the option.
525 The input files will be assumed to be in DER or RAW format.
527 Unlike options that in PEM input would allow multiple input data
528 (e.g. multiple certificates), when reading in DER format a sin‐
529 gle data structure is read.
530 --inraw
532 This is an alias for the --inder option.
533 --outder, --no-outder
535 Use DER format for output certificates, private keys, and DH
536 parameters. The no-outder form will disable the option.
537 The output will be in DER or RAW format.
539 --outraw
541 This is an alias for the --outder option.
542 --disable-quick-random
544 No effect.
545 NOTE: THIS OPTION IS DEPRECATED
548 --template=string
550 Template file to use for non-interactive operation.
551 --stdout-info
554 Print information to stdout instead of stderr.
555 --ask-pass
558 Enable interaction for entering password when in batch mode..
559 This option will enable interaction to enter password when in
561 batch mode. That is useful when the template option has been
562 specified.
563 --pkcs-cipher=cipher
565 Cipher to use for PKCS #8 and #12 operations.
566 Cipher may be one of 3des, 3des-pkcs12, aes-128, aes-192,
568 aes-256, rc2-40, arcfour.
569 --provider=string
571 Specify the PKCS #11 provider library.
572 This will override the default options in
574 /etc/gnutls/pkcs11.conf
575 --text, --no-text
577 Output textual information before PEM-encoded certificates, pri‐
578 vate keys, etc. The no-text form will disable the option. This
579 option is enabled by default.
580 Output textual information before PEM-encoded data
582 -h, --help
584 Display usage information and exit.
585 -!, --more-help
587 Pass the extended usage information through a pager.
588 -v [{v|c|n --version [{v|c|n}]}]
590 Output version of program and exit. The default mode is `v', a
591 simple version. The `c' mode will print copyright information
592 and `n' will print the full copyright notice.
593
595 Certtool's template file format
596 A template file can be used to avoid the interactive questions of cert‐
597 tool. Initially create a file named 'cert.cfg' that contains the infor‐
598 mation about the certificate. The template can be used as below:
599 $ certtool --generate-certificate --load-privkey key.pem --template cert.cfg --outfile cert.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem
601 An example certtool template file that can be used to generate a cer‐
603 tificate request or a self signed certificate follows.
604 # X.509 Certificate options
606 #
607 # DN options
608 # The organization of the subject.
610 organization = "Koko inc."
611 # The organizational unit of the subject.
613 unit = "sleeping dept."
614 # The locality of the subject.
616 # locality =
617 # The state of the certificate owner.
619 state = "Attiki"
620 # The country of the subject. Two letter code.
622 country = GR
623 # The common name of the certificate owner.
625 cn = "Cindy Lauper"
626 # A user id of the certificate owner.
628 #uid = "clauper"
629 # Set domain components
631 #dc = "name"
632 #dc = "domain"
633 # If the supported DN OIDs are not adequate you can set
635 # any OID here.
636 # For example set the X.520 Title and the X.520 Pseudonym
637 # by using OID and string pairs.
638 #dn_oid = "2.5.4.12 Dr."
639 #dn_oid = "2.5.4.65 jackal"
640 # This is deprecated and should not be used in new
642 # certificates.
643 # pkcs9_email = "none@none.org"
644 # An alternative way to set the certificate's distinguished name directly
646 # is with the "dn" option. The attribute names allowed are:
647 # C (country), street, O (organization), OU (unit), title, CN (common name),
648 # L (locality), ST (state), placeOfBirth, gender, countryOfCitizenship,
649 # countryOfResidence, serialNumber, telephoneNumber, surName, initials,
650 # generationQualifier, givenName, pseudonym, dnQualifier, postalCode, name,
651 # businessCategory, DC, UID, jurisdictionOfIncorporationLocalityName,
652 # jurisdictionOfIncorporationStateOrProvinceName,
653 # jurisdictionOfIncorporationCountryName, XmppAddr, and numeric OIDs.
654 #dn = "cn = Nikos,st = New Something,C=GR,surName=Mavrogiannopoulos,2.5.4.9=Arkadias"
656 # The serial number of the certificate
658 # The value is in decimal (i.e. 1963) or hex (i.e. 0x07ab).
659 # Comment the field for a random serial number.
660 serial = 007
661 # In how many days, counting from today, this certificate will expire.
663 # Use -1 if there is no expiration date.
664 expiration_days = 700
665 # Alternatively you may set concrete dates and time. The GNU date string
667 # formats are accepted. See:
668 # https://www.gnu.org/software/tar/manual/html_node/Date-input-formats.html
669 #activation_date = "2004-02-29 16:21:42"
671 #expiration_date = "2025-02-29 16:24:41"
672 # X.509 v3 extensions
674 # A dnsname in case of a WWW server.
676 #dns_name = "www.none.org"
677 #dns_name = "www.morethanone.org"
678 # An othername defined by an OID and a hex encoded string
680 #other_name = "1.3.6.1.5.2.2 302ca00d1b0b56414e5245494e2e4f5247a11b3019a006020400000002a10f300d1b047269636b1b0561646d696e"
681 #other_name_utf8 = "1.2.4.5.6 A UTF8 string"
682 #other_name_octet = "1.2.4.5.6 A string that will be encoded as ASN.1 octet string"
683 # Allows writing an XmppAddr Identifier
685 #xmpp_name = juliet@im.example.com
686 # Names used in PKINIT
688 #krb5_principal = user@REALM.COM
689 #krb5_principal = HTTP/user@REALM.COM
690 # A subject alternative name URI
692 #uri = "https://www.example.com"
693 # An IP address in case of a server.
695 #ip_address = "192.168.1.1"
696 # An email in case of a person
698 email = "none@none.org"
699 # TLS feature (rfc7633) extension. That can is used to indicate mandatory TLS
701 # extension features to be provided by the server. In practice this is used
702 # to require the Status Request (extid: 5) extension from the server. That is,
703 # to require the server holding this certificate to provide a stapled OCSP response.
704 # You can have multiple lines for multiple TLS features.
705 # To ask for OCSP status request use:
707 #tls_feature = 5
708 # Challenge password used in certificate requests
710 challenge_password = 123456
711 # Password when encrypting a private key
713 #password = secret
714 # An URL that has CRLs (certificate revocation lists)
716 # available. Needed in CA certificates.
717 #crl_dist_points = "https://www.getcrl.crl/getcrl/"
718 # Whether this is a CA certificate or not
720 #ca
721 # Subject Unique ID (in hex)
723 #subject_unique_id = 00153224
724 # Issuer Unique ID (in hex)
726 #issuer_unique_id = 00153225
727 #### Key usage
729 # The following key usage flags are used by CAs and end certificates
731 # Whether this certificate will be used to sign data (needed
733 # in TLS DHE ciphersuites). This is the digitalSignature flag
734 # in RFC5280 terminology.
735 signing_key
736 # Whether this certificate will be used to encrypt data (needed
738 # in TLS RSA ciphersuites). Note that it is preferred to use different
739 # keys for encryption and signing. This is the keyEncipherment flag
740 # in RFC5280 terminology.
741 encryption_key
742 # Whether this key will be used to sign other certificates. The
744 # keyCertSign flag in RFC5280 terminology.
745 #cert_signing_key
746 # Whether this key will be used to sign CRLs. The
748 # cRLSign flag in RFC5280 terminology.
749 #crl_signing_key
750 # The keyAgreement flag of RFC5280. It's purpose is loosely
752 # defined. Not use it unless required by a protocol.
753 #key_agreement
754 # The dataEncipherment flag of RFC5280. It's purpose is loosely
756 # defined. Not use it unless required by a protocol.
757 #data_encipherment
758 # The nonRepudiation flag of RFC5280. It's purpose is loosely
760 # defined. Not use it unless required by a protocol.
761 #non_repudiation
762 #### Extended key usage (key purposes)
764 # The following extensions are used in an end certificate
766 # to clarify its purpose. Some CAs also use it to indicate
767 # the types of certificates they are purposed to sign.
768 # Whether this certificate will be used for a TLS client;
771 # this sets the id-kp-clientAuth (1.3.6.1.5.5.7.3.2) of
772 # extended key usage.
773 #tls_www_client
774 # Whether this certificate will be used for a TLS server;
776 # this sets the id-kp-serverAuth (1.3.6.1.5.5.7.3.1) of
777 # extended key usage.
778 #tls_www_server
779 # Whether this key will be used to sign code. This sets the
781 # id-kp-codeSigning (1.3.6.1.5.5.7.3.3) of extended key usage
782 # extension.
783 #code_signing_key
784 # Whether this key will be used to sign OCSP data. This sets the
786 # id-kp-OCSPSigning (1.3.6.1.5.5.7.3.9) of extended key usage extension.
787 #ocsp_signing_key
788 # Whether this key will be used for time stamping. This sets the
790 # id-kp-timeStamping (1.3.6.1.5.5.7.3.8) of extended key usage extension.
791 #time_stamping_key
792 # Whether this key will be used for email protection. This sets the
794 # id-kp-emailProtection (1.3.6.1.5.5.7.3.4) of extended key usage extension.
795 #email_protection_key
796 # Whether this key will be used for IPsec IKE operations (1.3.6.1.5.5.7.3.17).
798 #ipsec_ike_key
799 ## adding custom key purpose OIDs
801 # for microsoft smart card logon
803 # key_purpose_oid = 1.3.6.1.4.1.311.20.2.2
804 # for email protection
806 # key_purpose_oid = 1.3.6.1.5.5.7.3.4
807 # for any purpose (must not be used in intermediate CA certificates)
809 # key_purpose_oid = 2.5.29.37.0
810 ### end of key purpose OIDs
812 ### Adding arbitrary extensions
814 # This requires to provide the extension OIDs, as well as the extension data in
815 # hex format. The following two options are available since GnuTLS 3.5.3.
816 #add_extension = "1.2.3.4 0x0AAB01ACFE"
817 # As above but encode the data as an octet string
819 #add_extension = "1.2.3.4 octet_string(0x0AAB01ACFE)"
820 # For portability critical extensions shouldn't be set to certificates.
822 #add_critical_extension = "5.6.7.8 0x1AAB01ACFE"
823 # When generating a certificate from a certificate
825 # request, then honor the extensions stored in the request
826 # and store them in the real certificate.
827 #honor_crq_extensions
828 # Alternatively only specific extensions can be copied.
830 #honor_crq_ext = 2.5.29.17
831 #honor_crq_ext = 2.5.29.15
832 # Path length constraint. Sets the maximum number of
834 # certificates that can be used to certify this certificate.
835 # (i.e. the certificate chain length)
836 #path_len = -1
837 #path_len = 2
838 # OCSP URI
840 # ocsp_uri = https://my.ocsp.server/ocsp
841 # CA issuers URI
843 # ca_issuers_uri = https://my.ca.issuer
844 # Certificate policies
846 #policy1 = 1.3.6.1.4.1.5484.1.10.99.1.0
847 #policy1_txt = "This is a long policy to summarize"
848 #policy1_url = https://www.example.com/a-policy-to-read
849 #policy2 = 1.3.6.1.4.1.5484.1.10.99.1.1
851 #policy2_txt = "This is a short policy"
852 #policy2_url = https://www.example.com/another-policy-to-read
853 # The number of additional certificates that may appear in a
855 # path before the anyPolicy is no longer acceptable.
856 #inhibit_anypolicy_skip_certs 1
857 # Name constraints
859 # DNS
861 #nc_permit_dns = example.com
862 #nc_exclude_dns = test.example.com
863 # EMAIL
865 #nc_permit_email = "nmav@ex.net"
866 # Exclude subdomains of example.com
868 #nc_exclude_email = .example.com
869 # Exclude all e-mail addresses of example.com
871 #nc_exclude_email = example.com
872 # IP
874 #nc_permit_ip = 192.168.0.0/16
875 #nc_exclude_ip = 192.168.5.0/24
876 #nc_permit_ip = fc0a:eef2:e7e7:a56e::/64
877 # Options for proxy certificates
880 #proxy_policy_language = 1.3.6.1.5.5.7.21.1
881 # Options for generating a CRL
884 # The number of days the next CRL update will be due.
886 # next CRL update will be in 43 days
887 #crl_next_update = 43
888 # this is the 5th CRL by this CA
890 # The value is in decimal (i.e. 1963) or hex (i.e. 0x07ab).
891 # Comment the field for a time-based number.
892 # Time-based CRL numbers generated in GnuTLS 3.6.3 and later
893 # are significantly larger than those generated in previous
894 # versions. Since CRL numbers need to be monotonic, you need
895 # to specify the CRL number here manually if you intend to
896 # downgrade to an earlier version than 3.6.3 after publishing
897 # the CRL as it is not possible to specify CRL numbers greater
898 # than 263-2 using hex notation in those versions.
899 #crl_number = 5
900 # Specify the update dates more precisely.
902 #crl_this_update_date = "2004-02-29 16:21:42"
903 #crl_next_update_date = "2025-02-29 16:24:41"
904 # The date that the certificates will be made seen as
906 # being revoked.
907 #crl_revocation_date = "2025-02-29 16:24:41"
908
912 Generating private keys
913 To create an RSA private key, run:
914 $ certtool --generate-privkey --outfile key.pem --rsa
915 To create a DSA or elliptic curves (ECDSA) private key use the above
917 command combined with 'dsa' or 'ecc' options.
918 Generating certificate requests
920 To create a certificate request (needed when the certificate is issued
921 by another party), run:
922 certtool --generate-request --load-privkey key.pem --outfile request.pem
923 If the private key is stored in a smart card you can generate a request
925 by specifying the private key object URL.
926 $ ./certtool --generate-request --load-privkey "pkcs11:..." --load-pubkey "pkcs11:..." --outfile request.pem
927 Generating a self-signed certificate
930 To create a self signed certificate, use the command:
931 $ certtool --generate-privkey --outfile ca-key.pem
932 $ certtool --generate-self-signed --load-privkey ca-key.pem --outfile ca-cert.pem
933 Note that a self-signed certificate usually belongs to a certificate
935 authority, that signs other certificates.
936 Generating a certificate
938 To generate a certificate using the previous request, use the command:
939 $ certtool --generate-certificate --load-request request.pem --outfile cert.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem
940 To generate a certificate using the private key only, use the command:
942 $ certtool --generate-certificate --load-privkey key.pem --outfile cert.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem
943 Certificate information
945 To view the certificate information, use:
946 $ certtool --certificate-info --infile cert.pem
947 Changing the certificate format
949 To convert the certificate from PEM to DER format, use:
950 $ certtool --certificate-info --infile cert.pem --outder --outfile cert.der
951 PKCS #12 structure generation
953 To generate a PKCS #12 structure using the previous key and certifi‐
954 cate, use the command:
955 $ certtool --load-certificate cert.pem --load-privkey key.pem --to-p12 --outder --outfile key.p12
956 Some tools (reportedly web browsers) have problems with that file
958 because it does not contain the CA certificate for the certificate. To
959 work around that problem in the tool, you can use the --load-ca-cer‐
960 tificate parameter as follows:
961 $ certtool --load-ca-certificate ca.pem --load-certificate cert.pem --load-privkey key.pem --to-p12 --outder --outfile key.p12
963 Obtaining Diffie-Hellman parameters
965 To obtain the RFC7919 parameters for Diffie-Hellman key exchange, use
966 the command:
967 $ certtool --get-dh-params --outfile dh.pem --sec-param medium
968 Verifying a certificate
970 To verify a certificate in a file against the system's CA trust store
971 use the following command:
972 $ certtool --verify --infile cert.pem
973 It is also possible to simulate hostname verification with the follow‐
975 ing options:
976 $ certtool --verify --verify-hostname www.example.com --infile cert.pem
977 Proxy certificate generation
980 Proxy certificate can be used to delegate your credential to a tempo‐
981 rary, typically short-lived, certificate. To create one from the pre‐
982 viously created certificate, first create a temporary key and then gen‐
983 erate a proxy certificate for it, using the commands:
984 $ certtool --generate-privkey > proxy-key.pem
986 $ certtool --generate-proxy --load-ca-privkey key.pem --load-privkey proxy-key.pem --load-certificate cert.pem --outfile proxy-cert.pem
987 Certificate revocation list generation
989 To create an empty Certificate Revocation List (CRL) do:
990 $ certtool --generate-crl --load-ca-privkey x509-ca-key.pem --load-ca-certificate x509-ca.pem
992 To create a CRL that contains some revoked certificates, place the cer‐
994 tificates in a file and use --load-certificate as follows:
995 $ certtool --generate-crl --load-ca-privkey x509-ca-key.pem --load-ca-certificate x509-ca.pem --load-certificate revoked-certs.pem
997 To verify a Certificate Revocation List (CRL) do:
999 $ certtool --verify-crl --load-ca-certificate x509-ca.pem < crl.pem
1001
1003 One of the following exit values will be returned:
1004 0 (EXIT_SUCCESS)
1006 Successful program execution.
1007 1 (EXIT_FAILURE)
1009 The operation failed or the command syntax was not valid.
1010 70 (EX_SOFTWARE)
1012 libopts had an internal operational error. Please report it to
1013 autogen-users@lists.sourceforge.net. Thank you.
1014
1016 p11tool (1), psktool (1), srptool (1)
1017
1019 Nikos Mavrogiannopoulos, Simon Josefsson and others; see
1020 /usr/share/doc/gnutls/AUTHORS for a complete list.
1021
1023 Copyright (C) 2000-2020 Free Software Foundation, and others all rights
1024 reserved. This program is released under the terms of the GNU General
1025 Public License, version 3 or later.
1026
1028 Please send bug reports to: bugs@gnutls.org
1029
1031 This manual page was AutoGen-erated from the certtool option defini‐
1032 tions.
10333.6.15 04 Sep 2020 certtool(1)