PKI---SELF(1)

🌸 PKI --SELF(1) 🌸

okay bestie, gather round, because we're diving into pki --self from the strongSwan manual, section 1 of the Unix manual pages. yes THAT strongSwan. she's iconic, she's giving certificate authority realness, and honestly? you're gonna eat this up 💅

---

✨ NAME ✨

pki --self — Create a self-signed certificate 🎀

like, a certificate that signs itself. main character energy fr fr, no CA needed, she validates her own existence 💀

---

✨ SYNOPSIS ✨

pki --self [--in file|--keyid hex] [--type t] --dn distinguished-name
           [--san subjectAltName] [--lifetime days] [--not-before datetime]
           [--not-after datetime] [--serial hex] [--flag flag]
           [--digest digest] [--rsa-padding padding] [--ca] [--ocsp uri]
           [--pathlen len] [--addrblock block] [--nc-permitted name]
           [--nc-excluded name] [--critical oid]
           [--policy-mapping mapping] [--policy-explicit len]
           [--policy-inhibit len] [--policy-any len]
           [--cert-policy oid [--cps-uri uri] [--user-notice text]]
           [--outform encoding] [--debug level]

pki --self --options file

pki --self -h | --help

three whole ways to run her, pick your fighter 🫶

---

✨ DESCRIPTION ✨

so this sub-command of pki(1) is literally just here to create a self-signed certificate. that's it. that's the whole vibe. one job, and she does it slayfully ⭐

---

✨ OPTIONS ✨

okay this is the long part, but stay with me, every single flag matters 🔥

• -h, --help — prints usage info with a lil summary of all the available options. your emotional support flag 🫶
• -v, --debug level — sets the debug level. default: 1. crank it up when things get mysterious 👀
• -+, --options file — reads command line options from file. yes the flag is literally -+. we love a quirky queen ✨
• -i, --in file — the private key input file. if you don't give her one, she reads the key from STDIN. no file? no problem, she'll wait 💅
• -x, --keyid hex — smartcard or TPM private key object handle, in hex format, with an optional 0x prefix. hardware girlies rise 👑
• -t, --type type — the type of the input key. either priv, rsa, ecdsa, ed25519 or ed448. defaults to priv 🦋
• -d, --dn distinguished-name — the Subject and issuer distinguished name (DN). Required. like, non-negotiable, she will not run without it 😭
• -a, --san subjectAltName — the subjectAltName extension to include in the certificate. can be used multiple times, stack 'em up 🌸
• -l, --lifetime days — how many days the certificate is valid. default: 1095. ignored if you give her both an absolute start and end time. she said pick a lane 💀
• -F, --not-before datetime — absolute time when the certificate's validity begins. the datetime format is defined by the --dateform option ⭐
• -T, --not-after datetime — absolute time when the certificate's validity ends. the datetime format is defined by the --dateform option ⭐
• -D, --dateform form — strptime(3) format for the --not-before and --not-after options. default: %d.%m.%y %T 🎀
• -s, --serial hex — serial number in hex. it's randomly allocated by default, so like, you don't HAVE to ✨
• -e, --flag flag — adds an extendedKeyUsage flag. one of serverAuth, clientAuth, crlSign, or ocspSigning. can be used multiple times 💜
• -g, --digest digest — the digest to use for signature creation. one of md5, sha1, sha224, sha256, sha384, or sha512. the default is determined based on the type and size of the signature key. she picks for you, trust her 🙈
• -R, --rsa-padding padding — padding to use for RSA signatures. either pkcs1 or pss, defaults to pkcs1 🧚
• -f, --outform encoding — encoding of the created certificate file. either der (ASN.1 DER) or pem (Base64 PEM), defaults to der 🦋
• -b, --ca — includes the CA basicConstraint extension in the certificate. congrats, you're a CA now 👑
• -o, --ocsp uri — OCSP AuthorityInfoAccess URI to include in the certificate. can be used multiple times 🌈
• -p, --pathlen len — set the path length constraint 📏
• -B, --addrblock block — RFC 3779 address block to include in the certificate. block is either a CIDR subnet (such as 10.0.0.0/8) or an arbitrary address range (192.168.1.7-192.168.1.13). can be repeated to include multiple blocks. heads up though: the supplied blocks are included in the certificate as is, so for standards compliance, multiple blocks must be supplied in correct order and adjacent blocks must be combined. refer to RFC 3779 for details 📚
• -n, --nc-permitted name — adds a permitted NameConstraint extension to the certificate. for DNS or email constraints, the identity type is not always detectable by the given name — use the dns: or email: prefix to force a constraint type 💅
• -N, --nc-excluded name — adds an excluded NameConstraint extension to the certificate. for DNS or email constraints, the identity type is not always detectable by the given name — use the dns: or email: prefix to force a constraint type 💅
• -X, --critical oid — adds a critical extension with the given OID. fancy 🔥
• -M, --policy-mapping issuer-oid:subject-oid — adds policyMapping from issuer to subject OID 🎀
• -E, --policy-explicit len — adds the requireExplicitPolicy constraint ⭐
• -H, --policy-inhibit len — adds the inhibitPolicyMapping constraint ⭐
• -A, --policy-any len — adds the inhibitAnyPolicy constraint ⭐

🎀 Certificate Policy 🎀

multiple certificatePolicy extensions can be added, bestie. plural! each one with the following info:

• -P, --cert-policy oid — OID to include in the certificatePolicy extension. Required. 👑
• -C, --cps-uri uri — Certification Practice statement URI for certificatePolicy 🦋
• -U, --user-notice text — user notice for certificatePolicy 💌

---

✨ EXAMPLES ✨

generate a self-signed certificate using the given RSA key, like so:

pki --self --in key.der --dn "C=CH, O=strongSwan, CN=moon" \
    --san moon.strongswan.org > cert.der

moon said "I'm the main character" and honestly? correct 🌙✨

---

✨ SEE ALSO ✨

pki(1) — go read the mothership page, iykyk 🫶

---

and that's the whole page bestie!! version 6.1.0, dated 2019-05-06 — vintage but still slaying 💖 go forth and self-sign something iconic 💅🎀