PKI---ACERT(1)

💖 pki --acert 💖

okay bestie, welcome to the PKI --ACERT(1) manual page from strongSwan — but make it cute ✨. This is the pki --acert sub-command, and it is literally here to issue an attribute certificate. We're gonna get you comfy with every flag together, no cap 💅.

---

🌸 NAME 🌸

pki --acert — issue an attribute certificate.

✨ SYNOPSIS ✨

pki --acert [--in file] [--group membership]
            --issuerkey file|--issuerkeyid hex --issuercert file
            [--lifetime hours] [--not-before datetime] [--not-
            after datetime] [--serial hex] [--digest digest]
            [--rsa-padding padding] [--outform encoding] [--debug level]

pki --acert --options file

pki --acert -h | --help

🦋 DESCRIPTION 🦋

This sub-command of pki(1) is used to issue an attribute certificate using an issuer certificate with its private key and the holder certificate. that's the whole vibe: issuer certificate + its private key + holder certificate = one AC 💖.

💅 OPTIONS 💅

• -h, --help — print usage information with a summary of all the available options. so helpful 🫶
• -v, --debug level — set debug level, default: 1. turn it up if you need the tea ☕
• -+, --options file — read command line options from file. file-based slay ✨
• -i, --in file — holder certificate to issue an attribute certificate for. If not given, the certificate is read from STDIN. okay so it can just vibe with stdin 💅
• -m, --group membership — group membership the attribute certificate shall certify. The specified group is included as a string. To include multiple groups, the option can be repeated. stack those groups, bestie 🎀
• -k, --issuerkey file — issuer private key file. Either this or --issuerkeyid is required. required-ish depending on your key setup 🔑
• -x, --issuerkeyid hex — smartcard or TPM issuer private key object handle in hex format with an optional h0x prefix. Either this or --issuerkey is required. smartcard/TPM moment 💳
• -c, --issuercert file — issuer certificate file. Required. no skipping this one, bestie 😭
• -l, --lifetime hours — hours the attribute certificate is valid, default: 24. Ignored if both an absolute start and end time are given. 24 hours by default ⏰
• -F, --not-before datetime — absolute time when the validity of the AC begins. The datetime format is defined by the --dateform option. start time goes here 🌱
• -T, --not-after datetime — absolute time when the validity of the AC ends. The datetime format is defined by the --dateform option. end time goes here 🛑
• -D, --dateform form — strptime(3) format for the --not-before and --not-after options, default: %d.%m.%y %T. format the datetime your way 🎀
• -s, --serial hex — serial number in hex. It is randomly allocated by default. random default 🎲
• -g, --digest digest — digest to use for signature creation. One of md5, sha1, sha224, sha256, sha384, or sha512. The default is determined based on the type and size of the signature key. hash it out 💅
• -R, --rsa-padding padding — padding to use for RSA signatures. Either pkcs1 or pss, defaults to pkcs1. padding pick 🧚
• -f, --outform encoding — encoding of the created certificate file. Either der (ASN.1 DER) or pem (Base64 PEM), defaults to der. choose your encoding era 🌈

🎀 EXAMPLES 🎀

to save repetitive typing, command line options can be stored in files. Let's assume acert.opt contains the following contents:

         --issuercert aacert.der --issuerkey aakey.der --digest sha256 --lifetime 4

Then the following command can be used to issue an attribute certificate based on a holder certificate and the options above:

         pki --acert --options acert.opt --in holder.der --group sales --group finance -f pem

🔗 SEE ALSO 🔗

• pki(1)

---

and that's the whole page, bestie 🫶. mwah 💋 — strongSwan 6.1.0, dated 2014-02-05, signing off. go issue those ACs slay 💅✨