Mono(MakeCert)

👑 MakeCert — Mono(MakeCert) 💅

okay bestie, listen up, because this one is literally the whole Mono(MakeCert) situation and you're gonna eat it up. This is the manual page for MakeCert — yes, the name is MakeCert, capital M capital C, and it is not like other girls. ✨

---

🌸 NAME 🌸

MakeCert — Create X.509 certificates for test purposes 🎀

---

🦋 SYNOPSIS 🦋

makecert [options] certificate

---

💖 DESCRIPTION 💖

So basically you create an X.509 certificate using the informations you give it. And why would you do that, you ask? Because it's useful for testing Authenticode signatures, SSL and S/MIME technologies. Periodt. That's the whole vibe. 🔥

---

✨ PARAMETERS ✨

this is the part where I need you to lock in, bestie, because there are a LOT of them and every single one matters. no skimming. 💜

• -# num — Specify the certificate serial number. That's your number, your main character identifier. 🔢
• -n dn — Specify the subject Distinguished Name (DN).
• -in dn — Specify the issuer Distinguished Name (DN).
• -r — Create a self-signed, also called root, certificate. It's giving independent. It answers to no one. 👑
• -iv pvkfile — Specify the private key file (.PVK) for the issuer. The private key in the specified file will be used to sign the new certificate.
• -ic certfile — Extract the issuer's name from the specified certificate file — i.e. the subject name of the specified certificate becomes the issuer name of the new certificate. Recycling? We love her. ♻️
• -in name — Use the issuer's name from the specified parameter. (yes this flag shows up twice in the list, it's literally in the docs, don't come for me 💀)
• -ik container — Specify the key container name to be used for the issuer.
• -iky [signature | exchange | #] — Specify the key number to be used in the provider (when used with -ik).
• -ip provider — Specify the cryptographic provider to be used for the issuer.
• -ir [localmachine | currentuser] — Specify the provider will search the user or the machine keys containers for the issuer.
• -iy number — Specify the provider type to be used for the issuer.
• -sv pkvfile — Specify the private key file (.PVK) for the subject. The public part of the key will be inserted into the created certificate. If non-existant the specified file will be created with a new key pair (default to 1024 bits RSA key pair). Yes, non-existant, that's how the docs spell it, we're keeping it. 🫶
• -sk container — Specify the key container name to be used for the subject.
• -sky [signature | exchange | #] — Specify the key number to be used in the provider (when used with -sk).
• -sp provider — Specify the cryptographic provider to be used for the subject.
• -sr [localmachine | currentuser] — Specify the provider will search the user or the machine keys containers for the subject.
• -sy number — Specify the provider type to be used for the issuer.
• -a hash — Select hash algorithm. Only MD5 and SHA1 algorithms are supported. That's it. That's the menu. MD5 or SHA1, pick your fighter. 🌈
• -b date — The date since when the certificate is valid (notBefore). Its birthday. 🎂
• -e date — The date until when the certificate is valid (notAfter).
• -m number — Specify the certificate validity period in months. This is added to the notBefore validity date which can be set with -b or will default to the current date/time.
• -cy [authority|end] — Basic constraints. Select Authority or End-Entity certificate. Only Authority certificates can be used to sign other certificates (-ic). End-Entity can be used by clients (e.g. Authenticode, S/MIME) or servers (e.g. SSL).
• -h number — Add a path length restriction to the certificate chain. This is only applicable for certificates that have BasicConstraint set to Authority (-cy authority). This is used to limit the chain of certificates than can be issued under this authority. (again: "than can be issued", that's the original, I'm just the messenger 💀)
• -alt filename — Add a subjectAltName extension to the certificate. Each line from filename will be added as a DNS entry of the extension. This option is useful if you want to create a single SSL certificate to work on several hosts that do not share a common domain name (i.e. CN=*.domain.com would not work). One cert, many hosts, iconic. 🌐
• -eku oid[,oid] — Add some extended key usage OID to the certificate.
• -p12 pkcs12file password — Create a new PKCS#12 file containing both the certificates (the subject and possibly the issuer's) and the private key. The PKCS#12 file is protected with the specified password. This option is mono exclusive. 💅
• -? — Help (display this help message)
• -! — Extended help (for advanced options) 🚀

---

🌟 EXAMPLES 🌟

okay so here's the tea: to create a SSL test (i.e. non trusted) certificate is easy once your know your host's name. And the following command will create a test certificate for an SSL server:

$ hostname
pollux

$ makecert -r -eku 1.3.6.1.5.5.7.3.1 -n "CN=pollux" -sv pollux.pvk pollux.cer
Success

In particular in the above example, the parameters used to build this test certificate were:

• -r — Create a self-signed certificate (i.e. without an hierarchy).
• -eku 1.3.6.1.5.5.7.3.1 — Optional (as sadly most client don't require it). This indicates that your certificate is intended for server-side authentication.
• -n — Common Name (CN) = Host name. This is verified the SSL client and must match the connected host (or else you'll get a warning or error or gasp nothing).
• -sv private.key — The private key file. The key (1024 bits RSA key pair) will be automatically generated if the specified file isn't present.
• pollux.cer — The SSL certificate to be created for your host.

---

💀 KNOWN RESTRICTIONS 💀

Compared to the Windows version some options aren't supported (-$, -d, -l, -nscp, -is, -sc, -ss). Also PVK files with passwords aren't supported.

no cap, this is the limitations section. Don't try to use those flags. It will not go well. 🙈

---

🎀 AUTHOR 🎀

Written by Sebastien Pouliot

---

💜 COPYRIGHT 💜

Copyright (C) 2003 Motus Technologies. Copyright (C) 2004-2005 Novell. Released under BSD license.

---

🧚 MAILING LISTS 🧚

Visit http://lists.ximian.com/mailman/listinfo/mono-devel-list for details.

---

⭐ WEB SITE ⭐

Visit http://www.mono-project.com for details

---

👑 SEE ALSO 👑

signcode(1)

---

and that's the whole page, bestie — every last bit of it, from the Mono(MakeCert) title at the top to the Mono(MakeCert) footer at the very bottom (yes, the same name twice, it's symmetrical, it's art 🌸). Consider yourself certified. Slay. 💅✨