1 AutoGen Definitions options
;
3 prog
-title
= "GnuTLS PKCS #11 tool";
4 prog
-desc
= "Manipulate certificates and private keys.";
5 detail
= "Tool to parse and generate X.509 certificates, requests and private keys.
6 It can be used interactively or non interactively by
7 specifying the template command line option.";
8 short
-usage
= "certtool [options] [url]\ncerttool --help for usage instructions.\n";
16 name
= generate
-self
-signed
;
18 descrip
= "Generate a self-signed certificate";
23 name
= generate
-certificate
;
25 descrip
= "Generate a signed certificate";
30 name
= generate
-proxy
;
31 descrip
= "Generates a proxy certificate";
37 descrip
= "Generate a CRL";
42 name
= update
-certificate
;
44 descrip
= "Update a signed certificate";
49 name
= generate
-privkey
;
51 descrip
= "Generate a private key";
56 name
= generate
-request
;
58 descrip
= "Generate a PKCS #10 certificate request";
65 descrip
= "Verify a PEM encoded certificate chain.";
66 doc
= "The last certificate in the chain must be a self signed one.";
71 descrip
= "Verify a PEM encoded certificate chain using a trusted list.";
72 doc
= "The trusted certificate list must be loaded with --load-ca-certificate.";
73 flags
-must
= load
-ca
-certificate
;
78 descrip
= "Verify a CRL using a trusted list.";
79 doc
= "The trusted certificate list must be loaded with --load-ca-certificate.";
80 flags
-must
= load
-ca
-certificate
;
84 name
= generate
-dh
-params
;
85 descrip
= "Generate PKCS #3 encoded Diffie-Hellman parameters.";
91 descrip
= "Get the included PKCS #3 encoded Diffie-Hellman parameters.";
92 doc
= "Returns stored DH parameters in GnuTLS. Those parameters are used in the SRP protocol. The parameters returned by fresh generation
93 are more efficient since GnuTLS 3.0.9.";
98 descrip
= "Print information PKCS #3 encoded Diffie-Hellman parameters";
104 descrip
= "Loads a private key file";
106 doc
= "This can be either a file or a PKCS #11 URL";
111 descrip
= "Loads a public key file";
113 doc
= "This can be either a file or a PKCS #11 URL";
118 descrip
= "Loads a certificate request file";
125 name
= load
-certificate
;
126 descrip
= "Loads a certificate file";
128 doc
= "This can be either a file or a PKCS #11 URL";
132 name
= load
-ca
-privkey
;
133 descrip
= "Loads the certificate authority's private key file";
135 doc
= "This can be either a file or a PKCS #11 URL";
139 name
= load
-ca
-certificate
;
140 descrip
= "Loads the certificate authority's certificate file";
142 doc
= "This can be either a file or a PKCS #11 URL";
148 descrip
= "Password to use";
153 name
= certificate
-info
;
155 descrip
= "Print information on the given certificate";
160 name
= certificate
-pubkey
;
161 descrip
= "Print certificate's public key";
166 name
= pgp
-certificate
-info
;
167 descrip
= "Print information on the given OpenPGP certificate";
172 name
= pgp
-ring
-info
;
173 descrip
= "Print information on the given OpenPGP keyring structure";
180 descrip
= "Print information on the given CRL structure";
186 descrip
= "Print information on the given certificate request";
192 name
= no
-crq
-extensions
;
193 descrip
= "Do not use extensions in certificate requests";
199 descrip
= "Print information on a PKCS #12 structure";
205 descrip
= "Print information on a PKCS #7 structure";
211 descrip
= "Convert S/MIME to PKCS #7 structure";
218 descrip
= "Print information on a private key";
224 descrip
= "Print information on an OpenPGP private key";
230 descrip
= "Print information on a public key";
236 descrip
= "Generate an X.509 version 1 certificate (with no extensions)";
242 descrip
= "Generate a PKCS #12 structure";
243 doc
= "It requires a certificate, a private key and possibly a CA certificate to be specified.";
244 flags
-must
= load
-certificate
;
249 descrip
= "Generate a PKCS #8 structure";
256 descrip
= "Use PKCS #8 format for private keys";
262 descrip
= "Generate RSA key";
268 descrip
= "Generate DSA key";
274 descrip
= "Generate ECC (ECDSA) key";
281 descrip
= "Hash algorithm to use for signing.";
282 doc
= "Available hash functions are SHA1, RMD160, SHA256, SHA384, SHA512.";
287 descrip
= "Use DER format for input certificates and private keys.";
290 doc
= "The input files will be assumed to be in DER or RAW format.
291 Unlike options that in PEM input would allow multiple input data (e.g. multiple
292 certificates), when reading in DER format a single data structure is read.";
302 descrip
= "Use DER format for output certificates and private keys";
305 doc
= "The output will be in DER or RAW format.";
316 descrip
= "Specify the number of bits for key generate";
323 arg
-name
= "Security parameter";
324 descrip
= "Specify the security level [low, legacy, normal, high, ultra].";
325 doc
= "This is alternative to the bits option.";
329 name
= disable
-quick
-random
;
330 descrip
= "No effect";
338 descrip
= "Template file to use for non-interactive operation";
346 descrip
= "Cipher to use for PKCS #8 and #12 operations";
347 doc
= "Cipher may be one of 3des, 3des-pkcs12, aes-128, aes-192, aes-256, rc2-40, arcfour.";
351 ds
-type
= 'SEE ALSO';
359 ds
-type
= 'EXAMPLES';
362 @subheading Generating private keys
363 To create an RSA private key
, run
:
365 $ certtool
--generate
-privkey
--outfile key.pem
--rsa
368 To create a DSA or elliptic
curves (ECDSA
) private key use the
369 above command combined with
'dsa' or
'ecc' options.
371 @subheading Generating certificate requests
372 To create a certificate
request (needed when the certificate is issued by
375 certtool
--generate
-request
--load
-privkey key.pem \
376 --outfile request.pem
379 If the private key is stored in a smart card you can generate
380 a request by specifying the private key object URL.
382 $ .
/certtool
--generate
-request
--load
-privkey
"pkcs11:..." \
383 --load
-pubkey
"pkcs11:..." --outfile request.pem
387 @subheading Generating a self
-signed certificate
388 To create a self signed certificate
, use the command
:
390 $ certtool
--generate
-privkey
--outfile ca
-key.pem
391 $ certtool
--generate
-self
-signed
--load
-privkey ca
-key.pem \
392 --outfile ca
-cert.pem
395 Note that a self
-signed certificate usually belongs to a certificate
396 authority
, that signs other certificates.
398 @subheading Generating a certificate
399 To generate a certificate using the previous request
, use the command
:
401 $ certtool
--generate
-certificate
--load
-request request.pem \
402 --outfile cert.pem
--load
-ca
-certificate ca
-cert.pem \
403 --load
-ca
-privkey ca
-key.pem
406 To generate a certificate using the private key only
, use the command
:
408 $ certtool
--generate
-certificate
--load
-privkey key.pem \
409 --outfile cert.pem
--load
-ca
-certificate ca
-cert.pem \
410 --load
-ca
-privkey ca
-key.pem
413 @subheading Certificate information
414 To view the certificate information
, use
:
416 $ certtool
--certificate
-info
--infile cert.pem
419 @subheading PKCS #
12 structure generation
420 To generate a PKCS #
12 structure using the previous key and certificate
,
423 $ certtool
--load
-certificate cert.pem
--load
-privkey key.pem \
424 --to
-p12
--outder
--outfile key.p12
427 Some
tools (reportedly web browsers
) have problems with that file
428 because it does not contain the CA certificate for the certificate.
429 To work around that problem in the tool
, you can use the
430 --load
-ca
-certificate parameter as follows
:
433 $ certtool
--load
-ca
-certificate ca.pem \
434 --load
-certificate cert.pem
--load
-privkey key.pem \
435 --to
-p12
--outder
--outfile key.p12
438 @subheading Diffie
-Hellman parameter generation
439 To generate parameters for Diffie
-Hellman key exchange
, use the command
:
441 $ certtool
--generate
-dh
-params
--outfile dh.pem
--sec
-param normal
444 @subheading Proxy certificate generation
445 Proxy certificate can be used to delegate your credential to a
446 temporary
, typically short
-lived
, certificate. To create one from the
447 previously created certificate
, first create a temporary key and then
448 generate a proxy certificate for it
, using the commands
:
451 $ certtool
--generate
-privkey
> proxy
-key.pem
452 $ certtool
--generate
-proxy
--load
-ca
-privkey key.pem \
453 --load
-privkey proxy
-key.pem
--load
-certificate cert.pem \
454 --outfile proxy
-cert.pem
457 @subheading Certificate revocation list generation
458 To create an empty Certificate Revocation
List (CRL
) do
:
461 $ certtool
--generate
-crl
--load
-ca
-privkey x509
-ca
-key.pem \
462 --load
-ca
-certificate x509
-ca.pem
465 To create a CRL that contains some revoked certificates
, place the
466 certificates in a file and use @code
{--load
-certificate
} as follows
:
469 $ certtool
--generate
-crl
--load
-ca
-privkey x509
-ca
-key.pem \
470 --load
-ca
-certificate x509
-ca.pem
--load
-certificate revoked
-certs.pem
473 To verify a Certificate Revocation
List (CRL
) do
:
476 $ certtool
--verify
-crl
--load
-ca
-certificate x509
-ca.pem
< crl.pem
486 @subheading Certtool
's template file format
487 A template file can be used to avoid the interactive questions of
488 certtool. Initially create a file named 'cert.cfg
' that contains the information
489 about the certificate. The template can be used as below:
492 $ certtool --generate-certificate cert.pem --load-privkey key.pem \
493 --template cert.cfg \
494 --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem
497 An example certtool template file that can be used to generate a certificate
498 request or a self signed certificate follows.
501 # X.509 Certificate options
505 # The organization of the subject.
506 organization = "Koko inc."
508 # The organizational unit of the subject.
509 unit = "sleeping dept."
511 # The locality of the subject.
514 # The state of the certificate owner.
517 # The country of the subject. Two letter code.
520 # The common name of the certificate owner.
523 # A user id of the certificate owner.
526 # Set domain components
530 # If the supported DN OIDs are not adequate you can set
532 # For example set the X.520 Title and the X.520 Pseudonym
533 # by using OID and string pairs.
534 #dn_oid = 2.5.4.12 Dr.
535 #dn_oid = 2.5.4.65 jackal
537 # This is deprecated and should not be used in new
539 # pkcs9_email = "none@@none.org"
541 # The serial number of the certificate
544 # In how many days, counting from today, this certificate will expire.
545 expiration_days = 700
547 # X.509 v3 extensions
549 # A dnsname in case of a WWW server.
550 #dns_name = "www.none.org"
551 #dns_name = "www.morethanone.org"
553 # A subject alternative name URI
554 #uri = "http://www.example.com"
556 # An IP address in case of a server.
557 #ip_address = "192.168.1.1"
559 # An email in case of a person
560 email = "none@@none.org"
562 # Challenge password used in certificate requests
563 challenge_passwd = 123456
565 # An URL that has CRLs (certificate revocation lists)
566 # available. Needed in CA certificates.
567 #crl_dist_points = "http://www.getcrl.crl/getcrl/"
569 # Whether this is a CA certificate or not
572 # for microsoft smart card logon
573 # key_purpose_oid = 1.3.6.1.4.1.311.20.2.2
575 ### Other predefined key purpose OIDs
577 # Whether this certificate will be used for a TLS client
580 # Whether this certificate will be used for a TLS server
583 # Whether this certificate will be used to sign data (needed
584 # in TLS DHE ciphersuites).
587 # Whether this certificate will be used to encrypt data (needed
588 # in TLS RSA ciphersuites). Note that it is preferred to use different
589 # keys for encryption and signing.
592 # Whether this key will be used to sign other certificates.
595 # Whether this key will be used to sign CRLs.
598 # Whether this key will be used to sign code.
601 # Whether this key will be used to sign OCSP data.
604 # Whether this key will be used for time stamping.
607 # Whether this key will be used for IPsec IKE operations.
610 ### end of key purpose OIDs
612 # When generating a certificate from a certificate
613 # request, then honor the extensions stored in the request
614 # and store them in the real certificate.
615 #honor_crq_extensions
617 # Path length contraint. Sets the maximum number of
618 # certificates that can be used to certify this certificate.
619 # (i.e. the certificate chain length)
624 # ocsp_uri = http://my.ocsp.server/ocsp
627 # ca_issuers_uri = http://my.ca.issuer
629 # Options for proxy certificates
630 # proxy_policy_language = 1.3.6.1.5.5.7.21.1
632 # Options for generating a CRL
634 # next CRL update will be in 43 days (wow)
635 #crl_next_update = 43
637 # this is the 5th CRL by this CA