CERTPATCH(8)

CERTPATCH — the section 8 glow-up ✨

okay bestie, welcome to CERTPATCH(8), straight outta the System Manager's Manual 💖 this one is lowkey a lil legend and it does exactly one thing but it does it so well.

NAME 🎀

certpatch — add subjectAltName identities to X.509 certificates

like. that's the whole personality. it patches certs. iconic behavior.

SYNOPSIS 🦋

certpatch [-t identity-type] -i identity -k signing-key
          input-certificate output-certificate

see how it eats? two files in, one patched cert out, no notes 💅

DESCRIPTION 🌸

so here's the vibe. certpatch alters PEM-encoded X.509 certificates by adding a subjectAltName extension containing an identity used by the signature-based authentication schemes of the ISAKMP protocol. that's the main character move right there.

and then — because you can't just edit a cert and dip 🙈 — after the addition the certificate will be signed once again with the supplied CA signing key. new extension, fresh signature, whole new era. periodt.

the options are as follows ✨

-t identity-type — if given, the -t option specifies the type of the given identity. currently ip, fqdn, and ufqdn are recognized. the default is ip. so if you say nothing, bestie, it's giving ip 🫶
-i identity — the -i option takes an argument which is the identity to put into the subjectAltName field of the certificate. and listen: if the identity-type is ip, this argument should be an IPv4 address in dotted decimal notation. no cap, dotted decimal or nothing 🔥
-k signing-key — the -k option specifies the key used for signing the certificate once the subjectAltName extension has been added. the key is specified by the filename where it is stored in PEM format. PEM or it's not happening, that's the rule 🎀

real talk: -i and -k are not vibes-based. you need an identity and you need a signing key, otherwise there's nothing to sign with and the whole thing falls apart 😭