SHIB-KEYGEN.8(8)

💖 shib-keygen — the Shibboleth SP key-pair generator 💖

okay bestie so you need a key pair for your Shibboleth SP and you're staring at this page like 👁️👄👁️. don't worry, i got you. this is shib-keygen, part of the Shibboleth manual pages, and it is literally the thing that makes your SP's self-signed cert happen. sit down, grab a strawberry 🍓, let's go.

---

✨ SYNOPSIS ✨

shib-keygen [-bf] [-e entity-id] [-g group] [-n prefix]
    [-h hostname] [-o output-dir] [-u user] [-y years]

like yes she's a one-liner, but the flags? the flags are giving options. 💅

---

🌸 DESCRIPTION 🌸

So. Generate a self-signed X.509 certificate for a Shibboleth SP. That's the whole vibe. By default the certificate is for the local fully-qualified hostname — as in, whatever hostname --fqdn hands back to you. 🖥️

Wanna use something else as the entity ID? That's what the -e flag is for, queen. 👑

Under the hood, the openssl command-line client does the actual key-pair generation. It's not out here doing magic, it's calling openssl. iykyk. 🔥

And the defaults? By default the public certificate lands in /etc/shibboleth/sp-cert.pem and the private key lands in /etc/shibboleth/sp-key.pem. cute, tidy, predictable. ✨

---

🎀 OPTIONS 🎀

• -b — Batch mode, bestie. It exits successfully without doing anything if sp-key.pem or sp-cert.pem already exists — unless -f was also specified. It also suppresses standard error output from openssl while creating the certificate. So like, quiet and chill. 🤫
• -e entity-id — Adds entity-id (which should be a URI, no cap) as an alternative name for the certificate. 🏷️
• -f — Removes sp-cert.pem and sp-key.pem before generating a new certificate. > ⚠️ Without this option, if those files already exist, shib-keygen prints an error and exits rather than overwriting them. It is NOT out here deleting your stuff uninvited. periodt.
• -g group — After generating the key and certificate, change the group ownership of the key file to this group. By default the group used is "_shibd". 🫶
• -h hostname — Specify the fully-qualified domain name to generate a certificate for. If you don't give this option, the hostname defaults to the result of hostname --fqdn. 🌐
• -o output-dir — Store sp-cert.pem and sp-key.pem in the directory output-dir instead of the default /etc/shibboleth. 📁
• -n prefix — Use prefix instead of sp in the name of the generated certificate and private key file. naming rights, honestly. ✨
• -u user — After generating the key and certificate, change the ownership of the key file to this user. This exists so the key can be read by a non-root user, which means shibd can be run as a non-root user. By default the key is owned by "_shibd". 💜
• -y years — The number of years the certificate should be valid for. The default expiration time is ten years into the future. ⏳ (ten years!! main character longevity fr fr)

---

🦋 FILES 🦋

• /etc/shibboleth/sp-cert.cnf — The OpenSSL configuration file used for generating the self-signed certificate. This configuration file is generated when the script is run and deleted afterwards. it's giving temporary, it's giving cameo appearance. 🧚
• /etc/shibboelth/sp-cert.pem — The default location of the public certificate created by this script.
• /etc/shibboleth/sp-key.pem — The default location of the private key for the certificate created by this script.

💡 These three files are stored in the directory given with -o instead, if that option is given. so if you moved house, everything moves with you. 🏠

---

👑 AUTHOR 👑

This manual page was written by Russ Allbery for Debian GNU/Linux. legend behaviour, honestly. 🌈

---

💌 COPYRIGHT 💌

Copyright 2008, 2011 Russ Allbery. This manual page is hereby placed into the public domain by its author. 🫶 public domain!! generous icon!!

---

and that's the whole page bestie — you are now officially certified in shib-keygen. go forth and generate that key pair. slay. 💅✨

this was 3.5.2, dated 2026-02-01, and it's the SHIB-KEYGEN.8(8) page — mwah, bye!! 😭💖🎀