winpr-makecert(1)

💅 winpr-makecert — the FreeRDP manual, bestie edition 🎀

okay so you wanna make an X.509 certificate? say less. this is winpr-makecert, and it's lowkey iconic. ✨

---

🌸 NAME 🌸

winpr-makecert — a whole tool for creating X.509 certificates. that's it, that's the vibe. 🦋

---

✨ SYNOPSIS ✨

winpr-makecert [-rdp] [-silent] [-live] [-format { crt | pem | pfx }]
[-p password] [-n common_name] [-y years] [-m months] [-len length] [-#
serial] [-a { md5 | sha1 | sha256 | s384 | sha512 }] [-path outputpath]
[outputname]

no cap, that's the whole invocation right there. copy it, love it, run it. 💖

---

🧚 DESCRIPTION 🧚

winpr-makecert generates X.509 certificates, and it's modeled after the Windows command MakeCert. the goal is to be command line compatible with MakeCert, but fr fr not every option is supported or implemented yet — some stuff is still under construction, iykyk.

features that aren't implemented? they're not described here. they get marked as "Unsupported" in winpr-makecerts help instead. so if you're squinting at the help output like "where's the rest"… that's why. 💀

now here's the big difference from its Windows counterpart: winpr-makecert always creates and saves a certificate — unless the -live option is given. it doesn't hold back, it just does the thing. and if outputname isn't set, it tries to determine the host name of the computer the command is run on and uses that.

⚠️ Warning: if the file already exists it will be overwritten without asking. no "are you sure", no "pls confirm", nothing. it just goes. so maybe check first, bestie. 🙈

without further options, the generated certificates have these properties (the default glow-up 💅):

• 2048 bit long
• sha256 as hash algorithm
• the detected host name is used as common name
• a time stamp is used as serial number
• validity period of one year
• saved in the current working directory in crt format

---

👑 OPTIONS 👑

• -rdp — dummy parameter. literally just a shortcut so you can quickly generate a certificate with default properties without specifying any further parameters. it's giving "just give me the defaults". 🫶
• -silent — don't print the generated certificate to stdout. quiet mode, main character energy but make it shy. 🤫
• -f format — three formats are supported: crt, pem and pfx. here's the breakdown:
  • crt outputs the key and the certificate in a separate file each, with the file endings .key and .crt.
  • pem outputs the key and certificate into a single file with the file ending pem.
  • and pfx outputs key and certificate into a pkcs12 file with the ending .pfx.
• -p password — the password to use if the pfx format is used as format. no password, no pfx tea. 🍓
• -live — don't write the key/certificate to disk. when used from the command line this can be thought of as "dummy" mode. nothing gets saved, it's just vibes. ✨
• -n common_name — the common name to use in the certificate. name it, claim it. 💜
• -m months — validity period in months.
• -y years — validity period in years. and heads up: if months and years are specified, the specified month parameter will take precedence. so -m wins that argument, periodt. 🔥
• -len length — key length in bits to use. big key, big energy.
• -a { md5 | sha1 | sha256 | s384 | sha512 } — the hashing algorithm to use. pick your fighter. ⭐
• -# serial — the serial number to use for the certificate.
• -path — a directory where the certificate should be created in. keep it tidy. 📁
• outputname — the base name of the created file(s). a suffix, the format specific suffix, is appended to this name. so don't add the extension yourself, it'll handle that. 💅

---

🌈 EXAMPLES 🌈

okay bestie, here's how it actually looks:

winpr-makecert -rdp

creates a certificate with the default properties, saved to a file in the current working directory in crt format named like the host. so if the host is named freerdp, the created files are called freerdp.key and freerdp.crt. slay. 🎀

winpr-makecert -len 4096 -a sha384 -path /tmp -# 22 -m 144 -y 1 -format
crt mycert

the command above creates the file /tmp/mycert.pem containing a key and a certificate with a length of 4096. it will use sha384 as hash algorithm. the certificate has the serial number 22 and is valid for 12 years (144 months). look at her go. 🔥

---

💀 EXIT STATUS 💀

• 0 — Successful program execution. we ate. 👑
• 1 — Otherwise. something went sideways, ngl. 😭

---

🦋 SEE ALSO 🦋

• MakeCert help page ⟨https://msdn.microsoft.com/library/windows/desktop/aa386968.aspx⟩ — the Windows original, for reference. iykyk.

---

🌸 AUTHOR 🌸

FreeRDP <team@freerdp.com> — the whole squad behind this. 🫶

---

and that's the page, bestie! brought to you by version 2.11.7, dated 2017-01-11, straight from the FreeRDP crew. go forth and make certificates, you absolute icon. 💖✨🎀