PKI(1)

📦
version 6.0.7 · 4 versions
, in fedora 43, fedora 44

💖 PKI(1) — the strongSwan public key infrastructure tool, but make it make sense 💖

okay bestie, listen. this is pki, the strongSwan command. it's a whole suite of commands that lets you run a simple public key infrastructure, and honestly? it's iconic. no cap.

✨ SYNOPSIS ✨

pki command [option ...]

pki -h | --help

🌸 DESCRIPTION 🌸

so pki is literally a suite of commands for managing a simple public key infrastructure (PKI). that's the whole vibe.

here's what you can do with it, and i'm gonna list it all because you deserve the full picture:

  • generate RSA and ECDSA key pairs 🗝️
  • create PKCS#10 certificate requests containing subjectAltNames
  • create X.509 self-signed end-entity and root CA certificates
  • issue end-entity and intermediate CA certificates signed by the private key of a CA — and those can contain subjectAltNames, CRL distribution points, and URIs of OCSP servers
  • extract raw public keys from private keys, certificate requests and certificates
  • compute two kinds of SHA-1-based key IDs

periodt. that's the feature list.

the pki command also supports certificate enrollment via the Simple Certificate Enrollment Protocol (SCEP) as defined by RFC 8894 — which replaces the obsoleted ipsec scepclient tool, so if you were still using that, bestie, it's giving outdated. additionally, the Enrollment over Secure Transport (EST) protocol (RFC 7030) is supported, too. we love options. 💅

and the latest feature — the newest main character — is an Online Certificate Status Protocol (OCSP) responder as defined by RFC 6960, which interoperates with an OpenXPKI server by directly accessing its internal certificate database. that's highkey wild and i'm obsessed.

👑 COMMANDS 👑

  • -h, --help — prints usage information plus a short summary of the available commands. your lil cheat sheet.
  • -g, --gen — generate a new private key. the origin story.
  • -s, --self — create a self-signed certificate. it's giving "i define myself."
  • -i, --issue — issue a certificate using a CA certificate and key.
  • -c, --signcrl — issue a CRL using a CA certificate and key.
  • -z, --acert — issue an attribute certificate.
  • -r, --req — create a PKCS#10 certificate request.
  • -7, --pkcs7 — provides PKCS#7 wrap/unwrap functions.
  • -k, --keyid — calculate key identifiers of a key or certificate.
  • -a, --print — print a credential (key, certificate etc.) in human readable form.
  • -d, --dn — extract the subject DN of an X.509 certificate.
  • -p, --pub — extract a public key from a private key or certificate.
  • -V, --verify — verify a certificate using a CA certificate.
  • -S, --scep — enroll an X.509 certificate with a SCEP server.
  • -C, --scepca — get CA [and RA] certificate[s] from a SCEP server.
  • -E, --est — enroll an X.509 certificate with an EST server.
  • -e, --estca — get CA certificate[s] from an EST server.
  • -o, --ocsp — OCSP request parser and OCSP responder.

🎀 GENERAL OPTIONS 🎀

  • -v, --debug — set debug level, default: 1
  • -+, --options — read command line options from file

🦋 EXAMPLES 🦋

🌈 Generating a CA Certificate

first step, bestie: generate a private key using the --gen command. by default this generates a 2048-bit RSA key. (yes, 2048. it's the default. don't come for me.)

pki --gen > ca_key.der

this key is used to create the self-signed CA certificate, using the --self command. the distinguished name should be adjusted to your needs — that's on you, i can't pick your DN.

pki --self --ca --in ca_key.der \
    --dn "C=CH, O=strongSwan, CN=strongSwan CA" > ca_cert.der

💜 Generating End-Entity Certificates

with the root CA certificate and key at hand, end-entity certificates for clients and servers can be issued. similarly, intermediate CA certificates can be issued, which in turn can issue other certificates. it's giving generational wealth, but for certs. 🧚

to generate a certificate for a server, we start by generating a private key.

pki --gen > server_key.der

the public key will be included in the certificate, so lets extract that from the private key.

pki --pub --in server_key.der > server_pub.der

the following command will use the CA certificate and private key to issue the certificate for this server. adjust the distinguished name, subjectAltName(s) and flags as needed (check pki --issue(8) for more options).

pki --issue --in server_pub.der --cacert ca_cert.der \
    --cakey ca_key.der --dn "C=CH, O=strongSwan, CN=VPN Server" \
    --san vpn.strongswan.org --flag serverAuth > server_cert.der

instead of storing the public key in a separate file, the output of --pub may also be piped directly into the above command. efficiency queen behavior. 👑

💀 Generating Certificate Revocation Lists (CRL)

if end-entity certificates have to be revoked, CRLs may be generated using the --signcrl command. sorry not sorry, that cert is over.

pki --signcrl --cacert ca_cert.der --cakey ca_key.der \
    --reason superseded --cert server_cert.der > crl.der
⚠️ okay this part matters: the certificate given with --cacert must be either a CA certificate or a certificate with the crlSign extended key usage (--flag crlSign). no shortcuts, bestie, the rules are the rules.

URIs to CRLs may be included in issued certificates with the --crl option. cute, right?

🌟 SEE ALSO 🌟

okay and that's the whole page, babe 🫶 this manual is for strongSwan version 6.0.7, dated 2023-10-20. go forth and issue certs responsibly. mwah 💖✨🎀

📦 where this page comes from