STRONGSWAN_PKI---ACERT(1)

💖 NAME 💖

pki --acert — Issue an attribute certificate. (Also known as the PKI --ACERT(1) page, bestie. 💅)

---

✨ SYNOPSIS ✨

pki --acert [--in file] [--group membership]
            --issuerkey file|--issuerkeyid hex --issuercert file
            [--lifetime hours] [--not-before datetime] [--not-
            after datetime] [--serial hex] [--digest digest]
            [--rsa-padding padding] [--outform encoding] [--debug level]

pki --acert --options file

pki --acert -h | --help

---

💅 DESCRIPTION 💅

So basically, this is a sub-command of pki(1). It issues an attribute certificate, and it does that using an issuer certificate with its private key plus the holder certificate. That's the whole assignment. Periodt. ✨

---

🎀 OPTIONS 🎀

• -h, --help — Prints usage information with a summary of the available options. Like a lil' cheat sheet. ✨
• -v, --debug level — Sets debug level, default: 1.
• -+, --options file — Reads command line options from file.
• -i, --in file — Holder certificate to issue an attribute certificate for. If not given, the certificate is read from STDIN.
• -m, --group membership — Group membership the attribute certificate shall certify. The specified group is included as a string. To include multiple groups, the option can be repeated.
• -k, --issuerkey file — Issuer private key file. Either this or --issuerkeyid is required.
• -x, --issuerkeyid hex — Smartcard or TPM issuer private key object handle in hex format with an optional h0x prefix. Either this or --issuerkey is required.
• -c, --issuercert file — Issuer certificate file. Required. No skipping this one, bestie.
• -l, --lifetime hours — Hours the attribute certificate is valid, default: 24. Ignored if both an absolute start and end time are given.
• -F, --not-before datetime — Absolute time when the validity of the AC begins. The datetime format is defined by the --dateform option.
• -T, --not-after datetime — Absolute time when the validity of the AC ends. The datetime format is defined by the --dateform option.
• -D, --dateform form — strptime(3) format for the --not-before and --not-after options, default: %d.%m.%y %T
• -s, --serial hex — Serial number in hex. It is randomly allocated by default.
• -g, --digest digest — Digest to use for signature creation. One of md5, sha1, sha224, sha256, sha384, or sha512. The default is determined based on the type and size of the signature key.
• -R, --rsa-padding padding — Padding to use for RSA signatures. Either pkcs1 or pss, defaults to pkcs1.
• -f, --outform encoding — Encoding of the created certificate file. Either der (ASN.1 DER) or pem (Base64 PEM), defaults to der.

---

🦋 EXAMPLES 🦋

To save repetitive typing, command line options can be stored in files. Let's assume acert.opt contains the following contents:

--issuercert aacert.der --issuerkey aakey.der --digest sha256 --lifetime 4

Then the following command can be used to issue an attribute certificate based on a holder certificate and the options above:

pki --acert --options acert.opt --in holder.der --group sales --group finance -f pem

---

🔥 SEE ALSO 🔥

pki(1)

---

That's the whole page, bestie. It's from strongSwan 6.0.7, dated 2014-02-05, and it's literally PKI --ACERT(1). Slay. 💖✨🎀