SSCG(8)

📦
version 4.0.4 · 13 versions
, in arch rolling, fedora 43, fedora 44

🎀 NAME 🎀

okay so bestie, meet sscg — it's the System Administration Utilities girlie (section 8 of the manual, iykyk) and her whole entire job is generating x.509 certificates 💖

🦋 SYNOPSIS 🦋

sscg [OPTION...]

that's it. that's the whole vibe. you give her options, she gives you certs ✨

💅 DESCRIPTION 💅

she's a cert-generating queen and these are all her little knobs and switches, bestie. buckle up, there's a lot of them, and we're doing all of them, no skipping, periodt.

  • -V, --version — she tells you what version she is and then dips immediately. iconic behavior honestly.
  • -f, --force — overwrites literally any files that are already chilling in the locations you asked for. ⚠️ DANGER: you probably don't want to use this! no fr fr, do not.

🌸 Help options: 🌸

  • -?, --help — shows you this help message, the classic "help me help you" moment.
  • --usage — gives you the short little brief usage message, the snack-size version.

🌈 Verbosity options 🌈

  • -q, --quiet — no output at all unless something goes wrong. silent but deadly (in a good way).
  • -v, --verbose — shows you progress messages so you can watch her cook.
  • -d, --debug — turns on debug message logging, and it implies verbose. but bestie… Warning! This will print private key information to the screen! 😭 like actual private keys, on your screen, in your scrollback. be so careful.

🎀 Certificate Subject options 🎀

  • --lifetime=1-3650 — how long the certificate lives, in days. (default: 398)
  • --country=US, CZ, etc. — Certificate DN: Country (C). (default: "US")
  • --state=Massachusetts, British Columbia, etc. — Certificate DN: State or Province (ST).
  • --locality=Westford, Paris, etc. — Certificate DN: Locality (L).
  • --organization=My Company — Certificate DN: Organization (O). (default: "Unspecified")
  • --organizational-unit=Engineering, etc. — Certificate DN: Organizational Unit (OU).
  • --email=myname@example.com — Certificate DN: Email Address (Email).
  • --hostname=server.example.com — the valid hostname of the certificate. must be an FQDN (fully qualified, no shortcuts). (default: current system FQDN)
  • --subject-alt-name alt.example.com — optional extra valid hostnames for the certificate. and it's not just hostnames — she also accepts explicit values supported by RFC 5280, like IP:xxx.xxx.xxx.xxx. you can specify this one multiple times, so go off. ✨

🔥 Certificate Key Cryptography Options 🔥

  • --key-type={rsa,ecdsa,mldsa} — what kind of key the certificate's private keys use. (default: rsa)
  • --key-strength=2048 or larger — the strength of the certificate private keys, in bits. this argument is only valid if --key-type is set to rsa. (default: 2048)
  • --ec-curve={secp224r1,secp256r1,secp384r1,secp521r1} — which EC curve the certificate private keys use. this argument is only valid if --key-type is set to ecdsa.
  • --mldsa-nist-level={2,3,5} — the NIST level for the ML-DSA key. this argument is only valid if --key-type is set to mldsa. (default: 2)
  • --hash-alg={sha256,sha384,sha512} — the hashing algorithm used to sign RSA and ECDSA keys. this argument is only valid if --key-type is rsa or ecdsa. (default: "sha256")
  • --cipher-alg={des-ede3-cbc,aes-256-cbc} — the cipher used to encrypt key files. (default: "aes-256-cbc")

👑 Certificate Authority File Options 👑

  • --ca-file=STRING — where the public CA certificate gets stored. (default: "./ca.crt")
  • --ca-mode=0644 — file mode of the created CA certificate.
  • --ca-key-file=STRING — where the CA's private key gets stored. if you don't specify it, the key gets destroyed rather than written to disk. (respect, honestly — she doesn't keep what you don't ask for)
  • --ca-key-mode=0600 — file mode of the created CA key.
  • --ca-key-password=STRING — a password for the CA key file. heads up bestie, this will be visible in the process table for all users, so it should be used for testing purposes only. use --ca-keypassfile or --ca-key-password-prompt for secure password entry instead.
  • --ca-key-passfile=STRING — a file containing the password to encrypt the CA key file.
  • -C, --ca-key-password-prompt — prompts you to enter a password for the CA key file.

🍓 Certificate Revocation List File Options 🍓

  • --crl-file=STRING — where an (empty) Certificate Revocation List file will be created, for applications that expect such a file to exist. if unspecified, no such file gets created.
  • --crl-mode=0644 — file mode of the created Certificate Revocation List.

🧚 Service Certificate File Options 🧚

  • --cert-file=STRING — where the public service certificate gets stored. (default "./service.pem")
  • --cert-mode=0644 — file mode of the created certificate.
  • --cert-key-file=STRING — where the service's private key gets stored. (default "service-key.pem")
  • --cert-key-mode=0600 — file mode of the created certificate key.
  • -p, --cert-key-password=STRING — a password for the service key file. same warning as before: it will be visible in the process table for all users, so this flag should be used for testing purposes only. use --cert-keypassfile or --cert-key-password-prompt for secure password entry.
  • --cert-key-passfile=STRING — a file containing the password to encrypt the service key file.
  • -P, --cert-key-password-prompt — prompts you to enter a password for the service key file.

💜 Client Authentication Certificate File Options 💜

  • --client-file=STRING — where a client authentication certificate gets stored.
  • --client-mode=0644 — file mode of the created certificate.
  • --client-key-file=STRING — where the client's private key gets stored. (default is the client-file)
  • --client-key-mode=0600 — file mode of the created certificate key.
  • --client-key-password=STRING — a password for the client key file. yes, same warning: visible in the process table for all users, so this flag should be used for testing purposes only. use --client-keypassfile or --client-key-password-prompt for secure password entry.
  • --client-key-passfile=STRING — a file containing the password to encrypt the client key file.
  • --client-key-password-prompt — prompts you to enter a password for the client key file.

⭐ Diffie-Hellman Parameter File Options ⭐

  • --dhparams-file=STRING — a file to contain a set of Diffie-Hellman parameters. (Default: not created)
  • --dhparams-named-group=STRING — outputs well-known DH parameters. the available named groups are: ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, modp_2048, modp_3072, modp_4096, modp_6144, modp_8192, modp_1536, dh_1024_160, dh_2048_224, dh_2048_256. (Default: "ffdhe4096")
  • --dhparams-generator={2,3,5} — the generator value for dhparams. (default: 2)

okay that's genuinely the whole page, you read all of it, I'm so proud of you 🫶 go make some certificates, you've got this bestie ✨💖

this was sscg 4.0.4, and the page is dated September 2026 — mwah, sending you off with a kiss and a fully populated process table 😘💅

📦 where this page comes from