CMCSharedToken(1)

📦
version 11.7.1 · 3 versions
, in centos-stream 9, ubuntu jammy

hiiii bestie 💖 welcome to CMCSharedToken(1) — the PKI CMC Shared Secret Generation Tool. no cap, this is the little command-line bestie for handling a user passphrase and making a shared token. iykyk. ✨

🎀 NAME 🎀

CMCSharedToken is used to process a user passphrase and create a shared token to be stored by the CA to allow Shared Secret-based proof of origin in cases such as CMC certificate issuance and revocation. periodt. 💅

✨ SYNOPSIS ✨

CMCSharedToken [OPTIONS]

💖 DESCRIPTION 💖

okay so the Certificate Management over Cryptographic Message Syntax (CMC) shared secret generation tool, CMCSharedToken, provides a command-line utility used to process a user passphrase to be shared with the CA. literally that's the whole vibe. 🦋

It takes a passphrase provided by the user, encrypts it with an issuance protection certificate, and outputs the encrypted blob — which could be stored on the CA for subsequent enrollment or revocation activities by the user. ✨

This tool can be run either by the user or by the administrator. If it's run by the user, the output (the encrypted passphrase, i.e. the shared token) needs to be sent to the CA administrator to store on the CA. If it's run by the CA administrator, the passphrase itself needs to be passed to the intended user. the way that handoff happens? not this software's problem — it is outside of the scope of this software to state how such communication takes place. 🙈 It is up to the site policy to decide which way best suits the deployment site. slay. 💜

For information on how the administrator would store the shared tokens on the CA, see the Red Hat Certificate System Administrator's Guide. 👑

💅 OPTIONS 💅

okay bestie, the following are supported options:

  • -d database — path of directory to the NSS database. this option is required, no cap.
  • -h token — security token name (default: internal).
  • -p password — security token password.
  • -s passphrase — CMC enrollment passphrase (shared secret) — put in "" if containing spaces.
  • -b issuance-protection-cert — PEM issuance protection certificate. Note: only one of the -b or -n options should be used. 👀
  • -n issuance-protection-cert-nickname — PEM issuance protection certificate on token. Note: only one of the -b or -n options should be used. 👀
  • -v — run in verbose mode.

🦋 EXAMPLE 🦋

              $ CMCSharedToken -d . -p myNSSPassword \
                  -s "just another good day" -o cmcSharedTok2.b64 -n "subsystemCert cert-pki-tomcat"

🌈 SEE ALSO 🌈

🫶 AUTHORS 🫶

shoutout to Christina Fu lt;cfu@redhat.comgt;. 🫶

Copyright (c) 2018 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt. 💜

mwah 💋 — this page comes from PKI, dated March 14, 2018 (and the manual is CMCSharedToken(1), iykyk). ✨

📦 where this page comes from