CVC-CREATE(1)

📦
version 1.1.4 · 11 versions
, in arch rolling

🌸 cvc-create(1) — like, the manual page, but make it make sense 💅

okay so first things first: this is cvc-create, it lives in the User Commands part of the manual (section 1, bestie, the one for user commands), and it's part of OpenPACE 1.1.4. we're gonna get into all of it, no cap.

✨ NAME ✨

cvc-create — the manual page for cvc-create 1.1.4 🎀

🦋 SYNOPSIS 🦋

cvc-create [OPTION]...

that's it. that's the whole vibe check. options go in, certificate comes out. iconic.

💖 DESCRIPTION 💖

Create a card verifiable certificate ✨

like, literally that's the job. you feed it options, it hands you a CVC. main character energy fr fr.

👑 OPTIONS 👑

the basic stuff 🍼

  • -h, --help — prints the help text and then dips out. bye bestie 👋
  • -V, --version — prints the version and exits. short and sweet, we love her.

the actual cert-making options 🧚

  • --out-cert=FILENAME — where to save the certificate. default is CHR.cvcert 🎀
  • --role=ENUM — the terminal's role. possible values are "cvca", "dv_domestic", "dv_foreign", "terminal" — pick your fighter 💅
  • --type=STRING — type of the terminal. known values are "at" (Authentication Terminal), "is" (Inspection System), "st" (Signature Terminal), and "derived_from_signer" (uses the the signer's CVC type). any other value is interpreted as an object identifier. default is derived_from_signer 🦋
  • --chat=HEXSTRING — Raw Card Holder Authorization Template (CHAT). careful bestie, this option will overwrite any terminal specific effective authorization (see options for AT/IS/ST). so like, it eats the other ones 🫶
  • --issued=YYMMDD — date the certificate was issued. default is today 🌸
  • --expires=YYMMDD — date until the certicate is valid ⏳
  • --sign-with=FILENAME — private key for signing the new certificate 🔑
  • --scheme=ENUM — signature scheme that the new terminal will use. possible values are "ECDSA_SHA_1", "ECDSA_SHA_224", "ECDSA_SHA_256", "ECDSA_SHA_384", "ECDSA_SHA_512", "RSA_v1_5_SHA_1", "RSA_v1_5_SHA_256", "RSA_v1_5_SHA_512", "RSA_PSS_SHA_1", "RSA_PSS_SHA_256", "RSA_PSS_SHA_512". yes that's twelve of them, we listed all twelve, you're welcome 💜

then it says:

Mode: csr — the properties of the certificate are derived from the given signing request.
  • --csr=FILENAME — certificate signing request with the attributes.

and then:

Mode: manual — the properties of the certificate are derived from the command line switches.
  • --chr=CCH...HSSSSS — certificate holder reference. and it's built like this: 2 characters ISO 3166-1 ALPHA-2 country code, then 0-9 characters ISO/IEC 8859-1 holder mnemonic, then 5 characters ISO/IEC 8859-1 numeric or alphanumeric sequence number. 🧩
  • --sign-as=FILENAME — CV certificate of the entity signing the new certificate. default is self signed 💫
  • --key=FILENAME — private key of the Terminal. default is derived from signer 🔐
  • --out-key=FILENAME — where to save the derived private key. default is CHR.pkcs8 🎁

🔥 Options for an Authentication Terminal (AT) 🔥

  • --out-desc=FILENAME — where to save the encoded certificate description. default is CHR.desc 📄
  • --cert-desc=FILENAME — terms of usage as part of the certificate description (*.txt, *.html or *.pdf) 📝
  • --issuer-name=STRING — name of the issuer of this certificate (certificate description) 🏛️
  • --issuer-url=URL — URL that points to informations about the issuer of this certificate (certificate description) 🌐
  • --subject-name=STRING — name of the holder of this certificate (certificate description) 🙋
  • --subject-url=URL — URL that points to informations about the subject of this certificate (certificate description) 🔗
  • --write-dg17 — allow writing DG 17 (Normal Place of Residence). default is off
  • --write-dg18 — allow writing DG 18 (Community ID). default is off
  • --write-dg19 — allow writing DG 19 (Residence Permit I). default is off
  • --write-dg20 — allow writing DG 20 (Residence Permit II). default is off
  • --write-dg21 — allow writing DG 21 (Optional Data). default is off
  • --at-rfu32 — allow RFU R/W Access bit 32. default is off
  • --at-rfu31 — allow RFU R/W Access bit 31. default is off
  • --at-rfu30 — allow RFU R/W Access bit 30. default is off
  • --at-rfu29 — allow RFU R/W Access bit 29. default is off
  • --read-dg1 — allow reading DG 1 (Document Type). default is off
  • --read-dg2 — allow reading DG 2 (Issuing State). default is off
  • --read-dg3 — allow reading DG 3 (Date of Expiry). default is off
  • --read-dg4 — allow reading DG 4 (Given Names). default is off
  • --read-dg5 — allow reading DG 5 (Family Names). default is off
  • --read-dg6 — allow reading DG 6 (Religious/Artistic Name). default is off
  • --read-dg7 — allow reading DG 7 (Academic Title). default is off
  • --read-dg8 — allow reading DG 8 (Date of Birth). default is off
  • --read-dg9 — allow reading DG 9 (Place of Birth). default is off
  • --read-dg10 — allow reading DG 10 (Nationality). default is off
  • --read-dg11 — allow reading DG 11 (Sex). default is off
  • --read-dg12 — allow reading DG 12 (Optional Data). default is off
  • --read-dg13 — allow reading DG 13. default is off
  • --read-dg14 — allow reading DG 14. default is off
  • --read-dg15 — allow reading DG 15. default is off
  • --read-dg16 — allow reading DG 16. default is off
  • --read-dg17 — allow reading DG 17 (Normal Place of Residence). default is off
  • --read-dg18 — allow reading DG 18 (Community ID). default is off
  • --read-dg19 — allow reading DG 19 (Residence Permit I). default is off
  • --read-dg20 — allow reading DG 20 (Residence Permit II). default is off
  • --read-dg21 — allow reading DG 21 (Optional Data). default is off
  • --install-qual-cert — allow installing qualified certificate. default is off
  • --install-cert — allow installing certificate. default is off
  • --pin-management — allow PIN management. default is off
  • --can-allowed — CAN allowed. default is off
  • --privileged — privileged terminal. default is off
  • --rid — allow restricted identification. default is off
  • --verify-community — allow community ID verification. default is off
  • --verify-age — allow age verification. default is off

that's a lot of toggles, and every single one of them is off by default, so don't come for me 🫶

🎀 Options for a Signature Terminal (ST) 🎀

  • --st-rfu5 — allow RFU bit 5. default is off
  • --st-rfu4 — allow RFU bit 4. default is off
  • --st-rfu3 — allow RFU bit 3. default is off
  • --st-rfu2 — allow RFU bit 2. default is off
  • --gen-qualified-sig — generate qualified electronic signature. default is off ✍️
  • --gen-sig — generate electronic signature. default is off ✒️

🌈 Options for an Inspection System (IS) 🌈

  • --read-eid — read access to eID application (Deprecated). default is off 💀
  • --is-rfu4 — allow RFU bit 4. default is off
  • --is-rfu3 — allow RFU bit 3. default is off
  • --is-rfu2 — allow RFU bit 2. default is off
  • --read-iris — read access to ePassport application: DG 4 (Iris). default is off 👁️
  • --read-finger — read access to ePassport application: DG 3 (Fingerprint). default is off 🫆
⚠️ heads up bestie: --read-eid is marked Deprecated. it's still listed here, but like… the manpage said it, not me 💅

🫶 AUTHOR 🫶

Written by Frank Morgner <frankmorgner@gmail.com> — king behavior, honestly 👑

🐛 REPORTING BUGS 🐛

Report bugs to https://github.com/frankmorgner/openpace/issues — go tell them, they actually want to know, fr fr 📮

that's the whole page!! every flag, every default, every "default is off", all accounted for, nothing skipped, periodt ✨

<div align="center">

💖 OpenPACE 1.1.4 — June 2026 💖

</div>

mwah, go make some certificates bestie 🎀🦋💜

📦 where this page comes from