PKI---VERIFY(1)

💅 PKI --VERIFY(1) 💅

ok so bestie, this is a sub-command of pki(1) — the strongSwan tool — and the whole entire job of pki --verify is: verify a certificate using a CA certificate. That's it. That's the vibe. Certificate goes in, trust verdict comes out. 🎀

---

✨ SYNOPSIS ✨

pki --verify [--in file] [--cacert file] [--crl file] [--debug level]
             [--online]

pki --verify --options file

pki --verify -h | --help

---

🌸 DESCRIPTION 🌸

So like, this is a sub-command of pki(1), right? And what it does is verifies a certificate — using a CA certificate if you feel like handing one over. That's the whole plot. No cap. ✨

---

🦋 OPTIONS 🦋

• -h, --help — prints the usage info plus a little summary of all the options you can use. icon behavior honestly. 💅
• -v, --debug level — sets the debug level. the default is 1, bestie, in case you were wondering 🫶
• -+, --options file — reads the command line options straight out of file instead of, y'know, typing them. convenient queen behavior 👑
• -i, --in file — the X.509 certificate you actually want to verify. if you don't give it one? it just reads from STDIN, lowkey self-sufficient 😌
• -c, --cacert file — the CA certificate used for trustchain verification. if you don't pass one, the certificate is assumed to be self-signed. it can also be a path to a directory, in which case the CA certificates get loaded from there. and yes, you can use it multiple times — stack 'em up 🍓
• -l, --crl file — a local CRL used for trustchain verification. same deal: it may optionally be a path to a directory from which CRLs are loaded, and it can be used multiple times. heads up though — this implies -o. like, it just does that automatically 🙈
• -o, --online — enables online CRL/OCSP revocation checking. going to the internet to check if things are still valid, main character energy 🌈

---

💀 EXIT STATUS 💀

the exit status is telling you everything, so listen up:

• 0 — the certificate was verified successfully. slay, it's valid ✨
• 1 — the certificate is untrusted. 😭
• 2 — the certificate's lifetimes are invalid. the dates are giving expired, honestly 💀
• 3 — the certificate was verified successfully, but the online revocation check said it has been revoked. so like… it works but it's also cancelled 🫠

---

👑 SEE ALSO 👑

• pki(1) — go read about the parent tool, iykyk 💜

---

ok that's the whole page, bestie 🧚 this was PKI --VERIFY(1) from strongSwan, version 6.1.0, dated 2016-08-19 — go forth and verify those certificates, you've absolutely got this 💖🌸