KLIST(1)

🌸 kx509 — ok so this one's filed under KLIST(1) but bestie it's literally kx509's moment ✨

Yes the header says KLIST(1) and the NAME line says kx509 — that's just how this page shows up in the wild, iykyk. Anyway, she's here, she's iconic, let's get into it 💅

💖 NAME

kx509 — acquire or extract certificates using Kerberos credentials. That's the whole vibe: you either go get PKIX certs, or you pull out the ones you already stashed. 🎀

🦋 SYNOPSIS

kx509 [-c cache | --cache=cache] [-s | --save] [-o store | --out=store]
      [-x | --extract] [-t time-left | --test=time-left]
      [-C PKCS10:filename | --csr=PKCS10:filename]
      [-C PKCS10:filename | --csr=PKCS10:filename]
      [-K hx509-store | --private-key=hx509-store]
      [-r realm | --realm=realm] [--help]

👑 DESCRIPTION

So here's the tea 🍓: kx509 acquires PKIX credentials from a credential cache using the kx509 protocol, or extracts PKIX credentials that are already stored in a credential cache. Two modes, one little command. Main character energy fr fr.

Options supported — and yes, we're doing all of them, no skips:

✨ OPTIONS ✨

• -c cache, --cache=cache — the credential cache to use. If you don't pass it, the default one gets used. No cap, it just picks for you 🫶
• -t time-left, --test=time-left — tests whether there's an active and valid certificate in the credential cache with at least time-left seconds of valid life left. And if you also give -o, then the certificates in the hx509 store get tested right alongside the ones in the credentials cache (if any). It's giving vibe check but for certs ⏰
• -x, --extract — extract credentials, rather than acquire them. Flip the mode, slay 🔥
• -s, --save — save the acquired certificate and the private key that was used into the given credential cache. Tucking them in for later 💜
• -o, --out=hx509-store — an hx509 store specification, like DER-FILE:/path/to/der/file, PEM-FILE:/path/to/PEM/file, FILE:/path/to/PEM/file, or PKCS12:/path/to/PKCS#12/file, into which to store any PKIX certificate and private key (unencrypted) that may have been acquired with the kx509 protocol and stored in the ccache. Yes, unencrypted — that's what the page says, so don't come for me 🙈
• -r realm, --realm=realm — specify the name of the realm whose kx509 service to use. Pick your kingdom 👑
• -K store, --private-key=store — use the private key from the given hx509 store for requesting a certificate. Bring your own key, iconic 🔑
• -C csr, --csr=certificate-request — specify a CSR to use, which must be a string of the form PKCS10:filename and which must contain the DER encoding of a PKCS#10 certification request. Format matters, bestie, don't freestyle it 💀

Lowkey the most useful glow-up tip on this whole page: the hxtool(1) command can be used to create private keys and CSRs. Go make your own, it's cute 🧚

🌈 SEE ALSO

• kdestroy(1)
• kinit(1)
• hxtool(1)

And that's the page!! 🌸 This gem comes from HEIMDAL, dated October 6, 2005, and it's filed in the manual as KLIST(1) — older than most of the group chat but still ate 💖 periodt 🎀