AMSSL(8)

💅 AMSSL(8) — the amanda ssl cert glow-up guide ✨

okay so this is amssl, from the System Administration Commands girlies — a whole program whose entire personality is managing your amanda ssl certificates for ssl auth 🎀. It creates self-signed CA, server certificates and client certificates. no cap, that's the whole job. 💖

---

✨ SYNOPSIS ✨

amssl [--client] [--init | --create-ca |
      --create-server-cert server-host |
      --create-client-cert client-host [--server server-host] ]
      [--country country-code] [--state state] [--locality locality]
      [--organisation organisation]
      [--organisation-unit organisation-unit] [--common common-name]
      [--email email] [-o configoption...] [--config config]

---

🦋 DESCRIPTION 🦋

So amssl is literally the program that manages amanda ssl certificates for the ssl auth. that's it, that's the vibe. it can create a self-signed CA, a server certificate and client certificates 👑. lowkey iconic.

---

🌸 OPTIONS 🌸

• --create-ca — make a self-signed CA. main character energy fr.
• --create-server-cert — make a server certificate.
• --create-client-cert CLIENT-HOSTNAME — make a client certificate for that hostname.
• --server SERVER-HOSTNAME — the amanda server you're connecting to.
• --batch — use the certificate fields you set in the initialization, and there is confirmation. ⚠️ heads up bestie: this option is useless if one of the fields was not set in the initiatization. so set your fields first or it's giving nothing.
• --client — for when you're running amssl on a client.
• --init — initialize the host.

The following options are the ones a certificate needs, iykyk:

• --country — the two letter country code.
• --state — the State.
• --locality — the locality.
• --organisation — the organisation.
• --organisation-unit — the organisation unit.
• --common — the common name.
• --email — the email.

---

🧚 INITIALISATION 🧚

Bestie. listen. this must be run once before any other command. no skipping, periodt.

It creates a template openssl.cnf file and a configuration file with the value you provided, and those get used in future commands so you do not need to enter them at every invocation 🙏. blessing.

The value provided must be the one you want in the certificate. so like, don't lie to it.

amssl [--client] --init [--country country-code] [--state state]
      [--locality locality] [--organisation organisation]
      [--organisation-unit organisation-unit] [--common common-name]
      [--email email] [-o configoption...] [--config config]

A client is initialized with the --client options. cute.

What it creates:

$SSL_DIR/openssl.cnf.template
$SSL_DIR/openssl.data

---

🔥 CREATE A SELF-SIGNED CA 🔥

Create a self-signed CA. slay.

amssl --create-ca [--batch] [--config CONFIG]

You can also provide all options of the initialization step. flexible queen.

⚠️ You must enter a new CA passphrase, and you must keep it secret and remember it. it will be required every time you need to create a new cetificate. do not lose it, do not forget it, do not text it to anyone. 😭

After you enter the passphrase, it will be asked 3 other times. yes, three. it's thorough like that.

What it creates:

$SSL_DIR/CA/crt.pem
$SSL_DIR/CA/private/key.pem

---

🫶 CREATE THE SERVER CERTIFICATE 🫶

Create the amanda server certificate.

amssl --create-server-cert HOSTNAME [--batch] [--config CONFIG]

You can also provide all options of the initialization step.

The CA passphrase is asked. (you remembered it, right? 🥺)

What it creates:

$SSL_DIR/me/crt.pem
$SSL_DIR/me/fingerprint
$SSL_DIR/me/private/key.pem
$SSL_DIR/remote/HOSTNAME -> ../me

---

💀 CREATE A CLIENT CERTIFICATE 💀

Create a client certificate, sign it by the CA certicate on the server, and both server and client learn the remore fingerprint. teamwork makes the dream work 💜.

🚨 DO NOT RUN IT ON SERVER. This will detroy the server certificate. 🚨 like actually do not, that's a canon event you cannot undo.

It require to run amssl on the server and client at the same time. yes, simultaneously, it's a two-phone situation.

ssl-dir must be set in amanda-client.conf on the client.

Both server and client must already be initialized. no shortcuts.

Run on the server:

amssl --create-client-cert client-host [--config CONFIG]

It wait for the client to connect and then sign the client certificate. The CA passphrase is asked.

Run on the client:

amssl --client --create-client-cert CLIENT-HOST --server SERVER-HOST
      [--batch] [--config CONFIG]

Create on server:

$SSL_DIR/remote/CLIENT-HOST/fingerprint

Create on client:

$SSL_DIR/me/crt.pem
$SSL_DIR/me/fingerprint
$SSL_DIR/me/private/key.pem
$SSL_DIR/remote/SERVER-HOST/fingerprint

---

🌈 EXAMPLE 🌈

Initialize the server

amssl --init --country US --state California --locality Sunnyvale
--organisation zmanda --organistion-unit engineering --common boss
--email 'email@email.com'

Create the CA on the server

amssl --create-ca

Create the server certificate

amssl --create-server-cert server.zmanda.com

Create a client certificate

On server:

amssl --create-client-cert client.zmanda.com

On client:

amssl --client --init --country US --state California --locality
Sunnyvale --organisation zmanda --organistion-unit engineering
--common boss --email 'email@email.com'

amssl --client --create-client-cert client.zmanda.com --server
server.zmanda.com

---

⭐ SEE ALSO ⭐

amanda(8), amanda.conf(5), amanda-client.conf(5), amanda(8), amanda-auth(7), amanda-auth-ssl(7)

The Amanda Wiki: : http://wiki.zmanda.com/ 🦋

---

👑 AUTHORS 👑

James da Silva <jds@amanda.org>

Stefan G. Weichinger <sgw@amanda.org>

---

and that's the whole page bestie 💖 this was Amanda 3.5.4, dated 07/23/2025 — go forth and certify, you absolute icon 🌸🎀✨