TOR-GENCERT(1)

📦
version 0.4.9.15 · 9 versions
, in alpine 3.24, debian trixie, nixos 26.05, nixpkgs unstable

💕 TOR-GENCERT(1) 💕

okay bestie, welcome to the Tor Manual page for tor-gencert, and yes this is the one that makes ✨certs and keys✨ for Tor directory authorities. buckle up, it's giving cryptography 🎀

🌸 NAME 🌸

tor-gencert — Generate certs and keys for Tor directory authorities

✨ SYNOPSIS ✨

tor-gencert [-h|--help] [-v] [-r|--reuse] [--create-identity-key] [-i
id_file] [-c cert_file] [-m num] [-a address:port]

💅 DESCRIPTION 💅

so tor-gencert generates certificates and private keys for use by Tor directory authorities running the v3 Tor directory protocol, as used by Tor 0.2.0 and later. and like, if you are not running a directory authority, you do not need to use tor-gencert, fr fr. it's not your moment, and that's fine 🫶

every directory authority has a long term authority identity key — and not to be dramatic but it's a totally different key from the identity key it uses as a Tor server, keep up — and this key should be kept offline in a secure location. it's the icon that certifies shorter-lived signing keys, which stay online and get used by the directory authority to sign votes and consensus documents. the long-term one? offline. the short-lived ones? online. main character energy vs. working-from-home energy, it's giving work-life balance 😌

after you use this program to generate a signing key and a certificate, copy those files to the keys subdirectory of your Tor process, and send Tor a SIGHUP signal.

DO NOT COPY THE IDENTITY KEY. 🚨 like genuinely bestie, do not. that one stays home.

🎀 OPTIONS 🎀

  • -v — Display verbose output. she's chatty and we love that 💬
  • -h or --help — Display help text and exit. bye bestie 👋
  • -r or --reuse — Generate a new certificate, but not a new signing key. this one's for when you want to change the address or lifetime associated with a given key, without making a whole new key. glow-up, not rebirth ✨
  • --create-identity-key — Generate a new identity key. only use this option the first time you run tor-gencert; in the future, you should use the identity key that's already there. like, don't keep remaking it, it's not a draft folder 💀
  • -i FILENAME — Read the identity key from the specified file. If the file is not present and --create-identity-key is provided, create the identity key in the specified file. Default: "./authority_identity_key"
  • -s FILENAME — Write the signing key to the specified file. Default: "./authority_signing_key"
  • -c FILENAME — Write the certificate to the specified file. Default: "./authority_certificate"
  • -m NUM — Number of months that the certificate should be valid. Default: 12. (one whole year of certified slay, no cap 🗓️)
  • --passphrase-fd FILEDES — Filedescriptor to read the passphrase from. Ends at the first NUL or newline. Default: read from the terminal. secrets stay secret 🤫
  • -a address:port — If provided, advertise the address:port combination as this authority's preferred directory port in its certificate. If the address is a hostname, the hostname is resolved to an IP before it's published. so it gets translated into IP first, iykyk 🌐

💀 BUGS 💀

This probably doesn't run on Windows. That's not a big issue, since we don't really want authorities to be running on Windows anyway. 🙈 (not me saying that, the manpage said that, I'm just the messenger 🎀)

👑 SEE ALSO 👑

See also the "dir-spec.txt" file, distributed with Tor. 📖

🌈 AUTHOR 🌈

Tor Project, Inc. Author.

and that's the whole page bestie, you ate 💖 this sweet lil thing is from the Tor project, dated 10/28/2026, and it literally says Tor down in the footer corner if you squint. go forth and generate responsibly, muah 💋

📦 where this page comes from