SYSTEMD-KEYUTIL(1)

💖 SYSTEMD-KEYUTIL 💖

okay bestie, welcome to systemd-keyutil — she's the one from the systemd fam who handles all your private keys and X.509 certificates and does NOT get enough credit for it. let's get into it ✨

---

✨ SYNOPSIS ✨

systemd-keyutil [OPTIONS...] {COMMAND}

---

🌸 DESCRIPTION 🌸

systemd-keyutil does various operations on private keys and X.509 certificates. that's the whole vibe. she's the key-and-cert handler, and she's literally so good at it. 🎀

---

👑 COMMANDS 👑

• validate — checks that we can actually load the private key and certificate you gave with --private-key= and --certificate=. like, a vibe check but for your keys.

and here's the tea 🫖: as a side effect, if the private key is loaded from a PIN-protected hardware token, this command can cache the PIN in the kernel keyring. the $SYSTEMD_ASK_PASSWORD_KEYRING_TIMEOUT_SEC and $SYSTEMD_ASK_PASSWORD_KEYRING_TYPE environment variables control how long and in which kernel keyring that PIN gets cached. iykyk 💅

Added in version 257.

• extract-public — this command prints the public key in PEM format, extracted from either the certificate given with --certificate= or the private key given with --private-key=. either/or, she's flexible 💜

Added in version 257.

• extract-certificate — prints the X.509 certificate in PEM format, extracted from the certificate given with --certificate=. super useful when you're loading a certificate from an OpenSSL provider (e.g. a hardware token) and you want to output a standalone PEM certificate that can be used without the provider. no provider required, periodt. 🔥

Added in version 260.

• pkcs7 — embeds the PKCS#1 signature (RSA) you gave with --signature= into a PKCS#7 signature using the certificate from --certificate=, and writes it to the file specified with --output=, in PKCS#7 format (p7s). if --content= is provided, it's included in the p7s — otherwise you get a "detached" signature. and the --hash-algorithm= option (which defaults to "SHA256") says what hash algorithm was used to generate the signature. 🧚

Added in version 258.

---

💅 OPTIONS 💅

here's what she understands, bestie:

• --private-key=PATH/URI, --private-key-source=TYPE[:NAME], --certificate=PATH, --certificate-source=TYPE[:NAME] — set the private key and certificate to use. the --certificate= option takes a path to a PEM encoded X.509 certificate, or a URI that gets passed to the OpenSSL provider configured with --certificate-source. --certificate-source takes either "file" or "provider" — and the latter gets followed by a specific provider identifier, separated with a colon, like "provider:pkcs11". meanwhile --private-key= can take a path or a URI that'll be passed to the OpenSSL engine or provider, as specified by --private-key-source= as a "type:name" tuple, such as "engine:pkcs11". iconic behavior tbh 🎀

Added in version 257.

• --signature=PATH — input PKCS#1 signature for the pkcs7 command. 📝

Added in version 258.

• --content=PATH — input data that corresponds to the PKCS#1 signature for the pkcs7 command, used for generating inline (i.e. non-"detached") PKCS#7 signatures. 🍓

Added in version 258.

• --hash-algorithm=ALGORITHM — the hash algorithm used to generate the PKCS#1 signature for the pkcs7 command. this should be a valid openssl digest algorithm; run "openssl list -digest-algorithms" to see a list of valid algorithms on your system. defaults to "SHA256". ✨

Added in version 258.

• --output=PATH — output PKCS#7 signature for the pkcs7 command. 💾

Added in version 258.

• -h, --help — print a short help text and exit. classic. 🙈
• --version — print a short version string and exit. 🌈

---

🔍 SEE ALSO 🔍

systemd-sbsign(1), systemd-measure(1)

---

and that's the whole page, bestie 🫶 this was systemd 262.1 talking about SYSTEMD-KEYUTIL(1) — go forth and handle your keys responsibly, mwah 💖✨