PKI---REQ(1)

🦋 PKI --REQ(1): pki --req 🦋

okay so bestie, this is the PKI --REQ(1) manual page from strongSwan — and the pki --req sub-command is the one that creates a PKCS#10 certificate request. very main character behavior, honestly 💅

---

✨ NAME ✨

pki --req — Create a PKCS#10 certificate request. That's it, that's the name, no cap 🎀

---

✨ SYNOPSIS ✨

here's the exact command shape, bestie — every bracket and pipe stays put:

pki --req [--in file|--keyid hex] [--type type] --dn distinguished-name
          [--san subjectAltName] [--profile profile] [--flag flag]
          [--password password] [--digest digest]
          [--rsa-padding padding] [--outform encoding] [--debug level]

pki --req [--in file|--keyid hex] [--type type] --oldreq file
          [--password password] [--digest digest]
          [--rsa-padding padding] [--outform encoding] [--debug level]

pki --req --options file

pki --req -h | --help

---

✨ DESCRIPTION ✨

This sub-command of pki(1) is used to create a PKCS#10 certificate request. it's giving certificate-request main character energy, and honestly? obsessed 🫶

---

✨ OPTIONS ✨

every single flag, default, and little detail — let's go, no skips:

• -h, --help — Print usage information with a summary of the available options. love a helpful icon 💖
• -v, --debug level — Set debug level, default: 1.
• -+, --options file — Read command line options from file.
• -i, --in file — Private key input file. If not given the key is read from STDIN.
• -x, --keyid hex — Smartcard or TPM private key object handle in hex format with an optional 0x prefix.
• -t, --type type — Type of the input key. Either priv, rsa or ecdsa, defaults to priv.
• -d, --dn distinguished-name — Subject distinguished name (DN). Required if the --dn option is not set.
• -a, --san subjectAltName — subjectAltName extension to include in request. Can be used multiple times. slay, stack those SANs 🌈
• -P, --profile profile — Certificate profile name to be included in the certificate request. Can be any UTF8 string. Supported e.g. by openxpki (with profiles pc-client, tls-server, etc.) or pki --issue (with profiles server, client, dual, or ocsp) that are translated into corresponding Extended Key Usage (EKU) flags in the generated X.509 certificate.
• -e, --flag flag — Add extendedKeyUsage flag. One of serverAuth, clientAuth, ocspSigning or msSmartcardLogon. Can be used multiple times. Adds an X.509v3 EKU extension containing these flags to the certificate request.
• -p, --password password — The challengePassword to include in the certificate request.
• -o, --oldreq file — Old certificate request to be used as a template. Required if the --dn option is not set. The public key in the old certificate request is replaced and a fresh signature is generated using the new private key. Optionally a new challengePassword may be set using the --password option.
• -g, --digest digest — Digest to use for signature creation. One of sha1, sha224, sha256, sha384, sha512, sha3_224, sha3_256, sha3_384, or sha3_512. The default is determined based on the type and size of the signature key.
• -R, --rsa-padding padding — Padding to use for RSA signatures. Either pkcs1 or pss, defaults to pkcs1.
• -f, --outform encoding — Encoding of the created certificate file. Either der (ASN.1 DER) or pem (Base64 PEM), defaults to der.

---

✨ EXAMPLES ✨

three little examples, all iconic ✨

Generate a certificate request for an RSA key, with a subjectAltName extension and a TLS-server profile:

pki --req --in key.der --dn "C=CH, O=strongSwan, CN=moon" \
    --san moon@strongswan.org --profile server > req.der

Generate a certificate request for a renewed key based on an existing template:

pki --req --in myNewKey.der --oldreq myReq.der > myNewReq.der

Generate a certificate request for an ECDSA key and a different digest:

pki --req --in key.der --type ecdsa --digest sha256 \
    --dn "C=CH, O=strongSwan, CN=carol"  > req.der

---

✨ SEE ALSO ✨

pki(1) — the parent page, obviously. go read it too, bestie 🫶

---

and that's the whole page, periodt 💅 — strongSwan 6.1.0, dated 2022-08-30. mwah 🎀