GVM-MANAGE-CERTS(1)

✨ NAME ✨

gvm-manage-certs — bestie, this is the girl who manages the certificate infrastructure for a GVM installation 💅

(you're in the User manual for the Open Vulnerability Assessment System (OpenVAS), section 1, and yes this is the main character of cert wrangling 🎀)

🌸 SYNOPSIS 🌸

gvm-manage-certs [OPTION]...

🦋 DESCRIPTION 🦋

Okay so, gvm-manage-certs manages the certificate infrastructure for a GVM installation. What does that even mean? It means the certificate infrastructure is the thing that lets GVM daemons talk to each other in a secure manner, and it's used for authentication and authorization before establishing TLS connections between the daemons. Security girlie behaviour, no cap 🔐

The GVM certificate infrastructure consists of a certificate authority (CA) which is trusted by all GVM daemons. That CA then gets used to sign certificates used by the various daemons. And the certificates can be divided into two use cases:

• Server certificates, primarily used for authentication
• Client certificates, primarily used for authorization

gvm-manage-certs can perform an automatic creation of a default certificate infrastructure for a standard GVM installation. It can also verify an existing infrastructure and perform various certificate related tasks to support the setup of a more complex infrastructure. Versatile queen 👑

---

💖 OPTIONS 💖

🎀 Certificate infrastructure management

• -a — Automatically set up default infrastructure for GVM. Auto-pilot mode, slay ✨
• -V — Verify existing GVM certificate infrastructure. Vibe check on your certs 🕵️
• -C — Create a certificate authority (CA). Mother of all the certs 👑
• -R — Create a certificate request for a CA
• -r — Create a certificate request for a CA and sign it. Two birds, one icon 💫
• -C — Create a certificate authority (CA). (yes, she's listed twice in the original, and I am nothing if not loyal to the source material 😭)
• -I — Install a CA certificate
• -c — Create a certificate request and sign it
• -i — Install a certificate
• -S — Sign a certificate request
• -f — Force overwriting of existing files. Careful bestie, this one does NOT play about your old files 💀

🌈 Certificate options

• -E — Create a server certificate. This sets the appropriate key usage constraints for a server certificate.
• -L — Create a client certificate. This sets the appropriate key usage constraints for a client certificate.
• -A — Skip CA generation in automatic mode. This automatically (re-)generates server and client certificates, but keeps the CA certificate. So the CA stays, everyone else gets a glow-up 💅

⭐ Configuration

• -e file — Read configuration from file (see below for configuration details)

🫶 Output control

• -d — Print debug output. For when you simply must know everything 🔍
• -v — Print verbose messages
• -q — Be quiet, only print error messages. Introvert mode, respect it 🤫

🍓 Other options

• -h — Print help. Your bestie when you're lost 🧚

---

💀 EXIT STATUS 💀

• 0 — The requested operation was successfully performed. We ate and left no crumbs 🎉
• 1 — An error occurred, the requested operation could not be performed. It's giving flop, unfortunately 😭

💜 ENVIRONMENT 💜

All certificate generation options can be set either through the configuration file or through environment variables like the following:

• GVM_CERTIFICATE_LIFETIME — Days until the certificate will expire
• GVM_CERTIFICATE_HOSTNAME — Name to use for the certificate
• GVM_CERTIFICATE_SIGNALG — Hash algorithm to use for signing
• GVM_CERTIFICATE_KEYSIZE — Size in bits of the generated key
• GVM_CERTIFICATE_SECPARAM — GnuTLS security level [low|medium|high|ultra]
• GVM_CERT_DIR — Directory where keys and certificates are stored before installation
• GVM_CERT_PREFIX — Prefix for certificate filename (e.g. "server")

For a complete list of options, please refer to the example configuration file included in the documentation. iykyk, go read it 📖✨

🌸 SEE ALSO 🌸

openvas(8), gvmd(8), gsad(8)

---

okay that's the whole page bestie, go forth and manage those certs responsibly 💖

Signed off with love by The OpenVAS Project, dated 2015-09-21, and yes she's still serving after all these years 👑✨