SQ(1)

💖 sq-pki-vouch-add 💖

okay bestie, welcome to the pki vouch add page from the Sequoia PGP manual, section 1, user commands. sit down, hydrate, and let's certify some identities together 🫶

---

✨ NAME ✨

sq-pki-vouch-add — certify a User ID for a Certificate 👑

---

✨ SYNOPSIS ✨

sq pki vouch add [OPTIONS]

---

✨ DESCRIPTION ✨

Certify a User ID for a Certificate. that's the whole bit 💅

So here's the vibe: by making a certification, a keyholder goes "yeah, I vouch for the fact that this other certificate legitimately belongs to this user id." In email-land, that literally means the same entity controls the key and the email address. And all these certifications stacked together? that's the Web of Trust, fr fr 🌈

This command emits the certificate with the new certification baked in. and then you have to distribute that updated certificate, preferably by sending it to the certificate holder for approval. like, don't just sit on it, bestie. see also sq key approvals 👀

By default a certification expires after 10 years. if you want a different validity period, use the --expiration argument. you can give it a point in time for validity to end, or just a duration. your call 🎀

sq pki vouch add respects the reference time set by the top-level --time argument. and it sets the certification's creation time to that reference time. periodt ⏰

---

✨ OPTIONS ✨

Subcommand options

• --add-email=EMAIL — use a user ID with the specified email address. The user ID is literally just the email address, nothing else. and no, the email address does not have to appear in a self-signed user ID 💌
• --add-userid=USERID — use the specified user ID. The specified user ID does not need to be self signed. lowkey because using a user ID that is not self-signed is often a mistake, you have to pass this option to explicitly opt in 🙈
• --all — use all self-signed user IDs. all of them. every single one 👑
• --allow-non-canonical-userids — don't reject new user IDs that are not in canonical form. for reference, canonical user IDs are of the form Name (Comment) <localpart@example.org> 🎀
• --amount=AMOUNT — set the amount of trust. Values between 1 and 120 are meaningful. 120 means fully trusted. values less than 120 indicate the degree of trust. 60 is usually used for partially trusted. [default: full] ⭐
• --cert=FINGERPRINT|KEYID — use certificates with the specified fingerprint or key ID 🔑
• --cert-file=PATH — read certificates from PATH 📁
• --certifier=FINGERPRINT|KEYID — create the certification using the key with the specified fingerprint or key ID ✍️
• --certifier-email=EMAIL — create the certification using the key where a user ID includes the specified email address 📧
• --certifier-file=PATH — create the certification using the key read from PATH 📂
• --certifier-self — create the certification using your default certification key. this uses the certificates set in the configuration file under pki.vouch.certifier-self as certification key. Currently, there is no default certification key. 💀
• --certifier-userid=USERID — create the certification using the key with the specified user ID 🫶
• --email=EMAIL — use a user ID consisting of just the email address, if the email address occurs in a self-signed user ID 💖
• --expiration=EXPIRATION — sets the expiration time. EXPIRATION is either an ISO 8601 formatted date with an optional time, or a custom duration. a duration takes the form N[ymwds], where the letters stand for years, months, weeks, days, and seconds, respectively. or, alternatively, the keyword never means no expiration time gets set at all. the default can be changed in the configuration file using the setting pki.vouch.expiration. [default: 10y] ⏳
• --local — make the certification a local certification. normally, local certifications are not exported. keeping it lowkey 🤫
• --non-revocable — mark the certification as being non-revocable. that is, you cannot later revoke this certification. this should normally only be used with an expiration, so pls be careful with this one bestie 😭
• --output=FILE — write to FILE, or to stdout if omitted 📝
• --signature-notation NAME VALUE — add a notation to the signature. a user-defined notation's name must be of the form name@a.domain.you.control.org. If the notation's name starts with a !, then the notation is marked as being critical. if a consumer of a signature doesn't understand a critical notation, then it will ignore the signature. The notation is marked as being human readable 🌸
• --userid=USERID — use the specified self-signed user ID. note that the specified user ID must be self signed 💅
• --userid-by-email=EMAIL — use the self-signed user ID with the specified email address 🦋

Global options

See sq(1) for a description of the global options. yes, the whole thing lives over there 👑

---

✨ EXAMPLES ✨

Alice certifies that Bob controls 3F68CB84CE537C9A and bob@example.org. iconic behaviour:

sq pki vouch add \
       --certifier=EB28F26E2739A4870ECC47726F0073F60FD0CBF0 \
       --cert=511257EBBF077B7AEDAE5D093F68CB84CE537C9A \
       --email=bob@example.org

Alice certifies that Bob controls 3F68CB84CE537C9A and bob@bobs.lair.net, which is not a self-signed user ID:

sq pki vouch add \
       --certifier=EB28F26E2739A4870ECC47726F0073F60FD0CBF0 \
       --cert=511257EBBF077B7AEDAE5D093F68CB84CE537C9A \
       --add-email=bob@bobs.lair.net

---

✨ SEE ALSO ✨

sq(1), sq-pki(1), sq-pki-vouch(1).

for the full documentation, go look at <https://book.sequoia-pgp.org/> 🌐

---

✨ VERSION ✨

1.5.0

---

and that's a wrap, bestie!! this page came to you courtesy of Sequoia PGP, version 1.5.0 🎀 go forth and vouch responsibly, mwah 💖✨🦋