STRONGSWAN_PKI---REQ(1)

📦
version 6.0.7 · 4 versions
, in fedora 43, fedora 44

🌸 PKI --REQ(1) 🌸

okay bestie, sit down, hydrate, because we're about to talk about the pki --req page from the strongSwan manual, and honestly? it's giving certificate-request royalty. 👑

✨ NAME ✨

pki --req — create a PKCS#10 certificate request 🎀

✨ SYNOPSIS ✨

like, here's the whole vibe of how you call it:

pki --req [--in file|--keyid hex] [--type type] --dn distinguished-name
          [--san subjectAltName] [--profile profile] [--flag flag]
          [--password password] [--digest digest]
          [--rsa-padding padding] [--outform encoding] [--debug level]

pki --req [--in file|--keyid hex] [--type type] --oldreq file
          [--password password] [--digest digest]
          [--rsa-padding padding] [--outform encoding] [--debug level]

pki --req --options file

pki --req -h | --help

✨ DESCRIPTION ✨

so this sub-command of pki(1) is literally the one that creates a PKCS#10 certificate request. that's it, that's the job, and it does it flawlessly. 💅

✨ OPTIONS ✨

  • -h, --help — prints usage info plus a lil summary of all the options available. your bestie when you're lost. 🫶
  • -v, --debug level — sets the debug level, and the default is 1.
  • -+, --options file — reads the command line options from file. yes the flag is literally -+, iconic behaviour.
  • -i, --in file — the private key input file. if you don't give it one, the key gets read from STDIN instead. no cap.
  • -x, --keyid hex — smartcard or TPM private key object handle, in hex format, with an optional 0x prefix.
  • -t, --type type — the type of the input key. either priv, rsa or ecdsa, and it defaults to priv.
  • -d, --dn distinguished-name — the subject distinguished name (DN). Required if the --dn option is not set. 🚨 (yes, it really says that, we don't question the lore)
  • -a, --san subjectAltName — a subjectAltName extension to include in the request. can be used multiple times, stack 'em up. 🌈
  • -P, --profile profile — a certificate profile name to be included in the certificate request. can be any UTF8 string. supported e.g. by openxpki (with profiles pc-client, tls-server, etc.) or pki --issue (with profiles server, client, dual, or ocsp) that are translated into corresponding Extended Key Usage (EKU) flags in the generated X.509 certificate.
  • -e, --flag flag — adds an extendedKeyUsage flag. one of serverAuth, clientAuth, ocspSigning or msSmartcardLogon. can be used multiple times. it adds an X.509v3 EKU extension containing these flags to the certificate request. 🔥
  • -p, --password password — the challengePassword to include in the certificate request.
  • -o, --oldreq file — an old certificate request to be used as a template. required if the --dn option is not set. the public key in the old certificate request is replaced and a fresh signature is generated using the new private key. optionally a new challengePassword may be set using the --password option. glow-up energy fr fr. ✨
  • -g, --digest digest — the digest to use for signature creation. one of sha1, sha224, sha256, sha384, sha512, sha3_224, sha3_256, sha3_384, or sha3_512. the default is determined based on the type and size of the signature key.
  • -R, --rsa-padding padding — the padding to use for RSA signatures. either pkcs1 or pss, defaults to pkcs1.
  • -f, --outform encoding — the encoding of the created certificate file. either der (ASN.1 DER) or pem (Base64 PEM), defaults to der.

✨ EXAMPLES ✨

generate a certificate request for an RSA key, with a subjectAltName extension and a TLS-server profile:

  pki --req --in key.der --dn "C=CH, O=strongSwan, CN=moon" \
      --san moon@strongswan.org --profile server > req.der

generate a certificate request for a renewed key based on an existing template:

  pki --req --in myNewKey.der --oldreq myReq.der > myNewReq.der

generate a certificate request for an ECDSA key and a different digest:

  pki --req --in key.der --type ecdsa --digest sha256 \
      --dn "C=CH, O=strongSwan, CN=carol"  > req.der

✨ SEE ALSO ✨

💖 reminder bestie: all the flags, values, defaults and paths up there are exactly as written, don't go freestyling them. iykyk.

okay that's the whole page, and honestly it ate. 💅✨

signing off from the strongSwan manual, version 6.0.7, dated 2022-08-30, still the one and only PKI --REQ(1). mwah, bye bestie! 🦋💜🎀

📦 where this page comes from