nethsm-key-sign(1)

💅 nethsm-key-sign — the "nethsm key sign" command

okay so welcome to the nethsm-key-sign page, bestie 🫶 this is part of the General Commands Manual and honestly it's giving "small command, big responsibilities." it signs a message with a key on your NetHSM. that's the whole vibe. let's get into it ✨

---

🌸 SYNOPSIS 🌸

nethsm key sign [-a|--auth-passphrase-file] [-f|--force] [-c|--config]
[-o|--output] [-l|--label] [-u|--user] [-h|--help] <KEY_ID>
<SIGNATURE_TYPE> <MESSAGE>

---

🦋 DESCRIPTION 🦋

The nethsm key sign command 💫 that's literally it, that's the description — but like, functionally, it's the one that makes a signature for a message using a key on your device. three things go in: the key id, the signature type, and the message file. slay.

---

🎀 OPTIONS 🎀

• -a, --auth-passphrase-file <AUTH_PASSPHRASE_FILE> — the path to a file holding a passphrase for authentication 🔐 the passphrase in that file must be the one for the user you picked for this command, no cap.

you can pass this option multiple times, which you'll need for commands that want several roles at once. when you do, ordering matters — the files get matched up to the respective users you gave with the --user option, in order. 👑

may also be specified with the NETHSM_AUTH_PASSPHRASE_FILE environment variable.

• -f, --force — write to the output file even if it already exists already 🙈 like, yes, overwrite it, i said what i said. May also be specified with the NETHSM_FORCE environment variable.
• -c, --config <CONFIG> — the path to a custom configuration file 📁 if you specify it, your custom config gets used instead of the default configuration file location. May also be specified with the NETHSM_CONFIG environment variable.
• -o, --output <OUTPUT> — the optional path to a specific file that the signature is written to ✍️ optional being the key word. May also be specified with the NETHSM_KEY_SIGNATURE_OUTPUT_FILE environment variable.
• -l, --label <LABEL> — a label uniquely identifying a device in the configuration file 🏷️ must be provided if more than one device is set up in the configuration file. no label, no clue which device, we don't do that here. May also be specified with the NETHSM_LABEL environment variable.
• -u, --user <USER> — a user name which is used for a command 👤 can be provided if no user name is set up in the configuration file for a device. must be provided if several user names of the same target role are set up in the configuration file for a device.

this option can be provided multiple times, which is needed for commands that require multiple roles at once. multi-role main character energy 💅

May also be specified with the NETHSM_USER environment variable.

• -h, --help — print help (see a summary with -h) 🫶 yes bestie, there's a summary version, use it when you're in a hurry.
• <KEY_ID> — the ID of the key to use for signing the message 🔑 May also be specified with the NETHSM_KEY_ID environment variable.
• <SIGNATURE_TYPE> — the signature type to use for the signature ✨ one of:

["EcdsaK256", "EcdsaP224", "EcdsaP256", "EcdsaP384",
"EcdsaP521", "EdDsa", "Pkcs1", "PssSha1", "PssSha224",
"PssSha256", "PssSha384", "PssSha512"]

May also be specified with the NETHSM_KEY_SIGNATURE_TYPE environment variable.

• <MESSAGE> — the path to a message for which to create a signature 📨 yes, it's a path, not the raw message text. lowkey important. May also be specified with the NETHSM_KEY_SIGNATURE_MESSAGE environment variable.

---

⚠️ tiny vibe check: the --user ordering + repeated --auth-passphrase-file thing is real. if you're doing multi-role stuff, keep your passphrase files in the same order as your users, or it's giving chaos 😭

---

and that's the whole page, bestie 💖 this was nethsm-key-sign, filed under nethsm-key-sign(1) in the General Commands Manual — now go forth and sign something iconic 👑✨