QCATOOL(1)

📦 version 2.2.1, in fedora 43

💖 QCATOOL — the manual page, but make it cute 💖

okay bestie, welcome to qcatool(1), the qcatool page from the Qt Cryptographic Architecture (QCA) fam. grab a strawberry 🍓, sit down, and let's get into it.

✨ NAME ✨

qcatool — a command line tool for the Qt Cryptographic Architecture, and yes she does everything 💅

🌸 DESCRIPTION 🌸

qcatool is a command line tool for doing all kinds of cryptographic operations with the Qt Cryptographic Architecture (QCA). no cap, she's the whole package.

she can also be used for testing and debugging QCA, so like, she's useful and she's a vibe checker. double threat. iconic. 👑

🎀 USAGE 🎀

so here's the tea: qcatool has a whole range of options and commands. the rule is:

  • you only ever get to use one command — just one, periodt
  • but you may use several, one, or no options

that's it, that's the whole structure. she's simple like that. 🦋

💅 OPTIONS 💅

as noted above, all of these are optional, and they can be combined. mix and match, girl. 🌈

  • --pass=PASSWORD — specify the password to use. lowkey this is a bad idea unless you're testing, because literally anyone can read the arguments to a command line application. everyone can see her. 💀
  • --newpass=PASSWORD — specify the new password to use for password change, with the key changepass and keybundle changepass commands. also probably a bad idea except for testing, because — say it with me — anyone can read the arguments to a command line application. 🙈
  • --nonroots=CERTIFICATES — specify additional certificates that are not trusted, but which may be used in the trust path if appropriate trust can be established. they're not root, they're just... adjacent. ykyk.
  • --roots=CERTIFICATES — specify additional certificates which can be used as trusted (root) certificates. these ones get the 👑 treatment.
  • --nosys — disable use of the standard root certificates that are provided by the operating system. bye system, we don't know her.
  • --noprompt — disable prompting for passwords/passphrases. so if you don't provide the passphrase on the command line (with --pass or --newpass), this will cause qcatool to abort the command if a password/passphrase is required. no prompt, no vibes, no service. 😭
  • --ordered — if you're outputting certificate information fields (Distinguished Name and Subject Alternative Name), show them in the same order that they are present in the certificate rather than in a friendly sorted order. sometimes you just want the raw truth.
  • --debug — enable additional output to aid debugging. turn the volume up 🔊
  • --log-file=FILENAME — log to the specified file.
  • --log-level=LEVEL — log at the specified level. the log level can be between 0 (none) and 8 (most). glow up scale fr fr.
  • --nobundle — when S/MIME signing, do not bundle the signer's certificate chain inside the signature. this results in a smaller signature output, but requires the recipient to have all of the necessary certificates in order to verify it. smaller file, bigger responsibility. 🫶

👑 COMMANDS 👑

one command per hangout, remember?

  • help, --help, -h — output usage (help) information.
  • version, --version, -v — output version information.
  • plugins — list available plugins. use the --debug option to get more information on plugins which are found and which ones actually loaded. found vs. actually showed up — very different things. 💀
  • config save [provider] — save provider configuration. use this to have the provider's default configuration written to persistent storage, which you can then edit by hand.
  • config edit [provider] — edit provider configuration. the changes are written to persistent storage.
  • key make rsa|dsa [bits] — create a key pair
  • key changepass [K] — add/change/remove passphrase of a key
  • cert makereq [K] — create certificate request (CSR)
  • cert makeself [K] — create self-signed certificate
  • cert makereqadv [K] — advanced version of makereq
  • cert makeselfadv [K] — advanced version of makeself
  • cert validate [C] — validate certificate
  • keybundle make [K] [C] — create a keybundle
  • keybundle extract [X] — extract certificate(s) and key
  • keybundle changepass [X] — change passphrase of a keybundle
  • keystore list-stores — list all available keystores
  • keystore list [storeName] — list content of a keystore
  • keystore monitor — monitor for keystore availability
  • keystore export [E] — export a keystore entry's content
  • keystore exportref [E] — export a keystore entry reference
  • keystore addkb [storeName] [cert.p12] — add a keybundle into a keystore
  • keystore addpgp [storeName] [key.asc] — add a PGP key into a keystore
  • keystore remove [E] — remove an object from a keystore
  • show cert [C] — examine a certificate
  • show req [req.pem] — examine a certificate request (CSR)
  • show crl [crl.pem] — examine a certificate revocation list
  • show kb [X] — examine a keybundle
  • show pgp [P|S] — examine a PGP key
  • message sign pgp|pgpdetach|smime [X|S] — sign a message
  • message encrypt pgp|smime [C|P] — encrypt a message
  • message signencrypt [S] [P] — PGP sign & encrypt a message
  • message verify pgp|smime — verify a message
  • message decrypt pgp|smime ((X) ...) — decrypt a message (S/MIME needs X)
  • message exportcerts — export certs from S/MIME message

🧚 ARGUMENTS 🧚

the arguments to the commands are as follows. she's got a whole lil alphabet for you:

  • K = private key.
  • C = certificate.
  • X = key bundle.
  • P = PGP public key.
  • S = PGP secret key.
  • E = generic entry.

and here's the important part — these must be identified by either a filename or a keystore reference ("store:obj"). so either you hand her a file, or you point her at the keystore. both valid, both slay. 💖

🫶 AUTHOR 🫶

qcatool was written by Justin Karneges as part of QCA. this manual page was written by Brad Hards.

give them their flowers. they ate. 🌸

heads up bestie: putting your password directly on the command line with --pass or --newpass means anyone who can read your process arguments can read it too. it's fine for testing, it's not the move for real life. 💀

and that's the whole page, no skips, no crumbs. 💅

this was qcatool 1.0.0, from Qt Cryptographic Architecture (QCA), dated August 2007. yes she's an elder but she still runs the group chat. periodt. ⭐🌈

📦 where this page comes from