|
|
EJBCA, J2EE PKI Certificate Authority: 3.8.1 released
01-29-2009
|
|
PKI --ISSUE(8) strongSwan PKI --ISSUE(8) NAME
pki --issue - Issue a certificate using a CA certificate and key SYNOPSIS
pki --issue [--in file] [--type type] --cakey file|--cakeyid hex --cacert file [--dn subject-dn] [--san subjectAltName] [--lifetime days] [--serial hex] [--flag flag] [--digest digest] [--ca] [--crl uri [--crlissuer issuer]] [--ocsp uri] [--pathlen len] [--nc- permitted name] [--nc-excluded name] [--policy-mapping mapping] [--policy-explicit len] [--policy-inhibit len] [--policy-any len] [--cert-policy oid [--cps-uri uri] [--user-notice text]] [--outform encoding] [--debug level] pki --issue --options file pki --issue -h | --help DESCRIPTION
This sub-command of pki(1) is used to issue a certificate using a CA certificate and private key. OPTIONS
-h, --help Print usage information with a summary of the available options. -v, --debug level Set debug level, default: 1. -+, --options file Read command line options from file. -i, --in file Public key or PKCS#10 certificate request file to issue. If not given the key/request is read from STDIN. -t, --type type Type of the input. Either pub for a public key, or pkcs10 for a PKCS#10 certificate request, defaults to pub. -k, --cakey file CA private key file. Either this or --cakeyid is required. -x, --cakeyid hex Key ID of a CA private key on a smartcard. Either this or --cakey is required. -c, --cacert file CA certificate file. Required. -d, --dn subject-dn Subject distinguished name (DN) of the issued certificate. -a, --san subjectAltName subjectAltName extension to include in certificate. Can be used multiple times. -l, --lifetime days Days the certificate is valid, default: 1095. -s, --serial hex Serial number in hex. It is randomly allocated by default. -e, --flag flag Add extendedKeyUsage flag. One of serverAuth, clientAuth, crlSign, or ocspSigning. Can be used multiple times. -g, --digest digest Digest to use for signature creation. One of md5, sha1, sha224, sha256, sha384, or sha512. Defaults to sha1. -f, --outform encoding Encoding of the created certificate file. Either der (ASN.1 DER) or pem (Base64 PEM), defaults to der. -b, --ca Include CA basicConstraint extension in certificate. -u, --crl uri CRL distribution point URI to include in certificate. Can be used multiple times. -I, --crlissuer issuer Optional CRL issuer for the CRL at the preceding distribution point. -o, --ocsp uri OCSP AuthorityInfoAccess URI to include in certificate. Can be used multiple times. -p, --pathlen len Set path length constraint. -n, --nc-permitted name Add permitted NameConstraint extension to certificate. -N, --nc-excluded name Add excluded NameConstraint extension to certificate. -M, --policy-mapping issuer-oid:subject-oid Add policyMapping from issuer to subject OID. -E, --policy-explicit len Add requireExplicitPolicy constraint. -H, --policy-inhibit len Add inhibitPolicyMapping constraint. -A, --policy-any len Add inhibitAnyPolicy constraint. Certificate Policy Multiple certificatePolicy extensions can be added. Each with the following information: -P, --cert-policy oid OID to include in certificatePolicy extension. Required. -C, --cps-uri uri Certification Practice statement URI for certificatePolicy. -U, --user-notice text User notice for certificatePolicy. EXAMPLES
To save repetitive typing, command line options can be stored in files. Lets assume pki.opt contains the following contents: --cacert ca_cert.der --cakey ca_key.der --digest sha256 --flag serverAuth --lifetime 1460 --type pkcs10 Then the following command can be used to issue a certificate based on a given PKCS#10 certificate request and the options above: pki --issue --options pki.opt --in req.der > cert.der SEE ALSO
pki(1) 5.1.1 2013-08-12 PKI --ISSUE(8)