Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help 
PKI --REQ(1)			   strongSwan			    PKI --REQ(1)

NAME
     pki --req - Create a PKCS#10 certificate request

SYNOPSIS
     pki --req [--in file|--keyid hex] [--type type] --dn distinguished-name
	       [--san subjectAltName] [--profile profile] [--flag flag]
	       [--password password] [--digest digest] [--rsa-padding padding]
	       [--outform encoding] [--debug level]
     pki --req [--in file|--keyid hex] [--type type] --oldreq file
	       [--password password] [--digest digest] [--rsa-padding padding]
	       [--outform encoding] [--debug level]
     pki --req --options file
     pki --req -h | --help

DESCRIPTION
     This sub-command of pki(1) is used to create a PKCS#10 certificate request.

OPTIONS
     -h, --help
	    Print usage information with a summary of the available options.

     -v, --debug level
	    Set debug level, default: 1.

     -+, --options file
	    Read command line options from file.

     -i, --in file
	    Private key input file. If not given the key is read from STDIN.

     -x, --keyid hex
	    Smartcard or TPM private key object handle in hex format with an op-
	    tional 0x prefix.

     -t, --type type
	    Type of the input key. Either priv, rsa or ecdsa, defaults to priv.

     -d, --dn distinguished-name
	    Subject  distinguished name (DN). Required if the --dn option is not
	    set.

     -a, --san subjectAltName
	    subjectAltName extension to include in request. Can be used multiple
	    times.

     -P, --profile profile
	    Certificate profile name to be included in the certificate	request.
	    Can  be  any  UTF8 string. Supported e.g. by openxpki (with profiles
	    pc-client, tls-server, etc.) or pki --issue (with  profiles  server,
	    client,  dual,  or	ocsp) that are translated into corresponding Ex-
	    tended Key Usage (EKU) flags in the generated X.509 certificate.

     -e, --flag flag
	    Add extendedKeyUsage flag. One of serverAuth, clientAuth,  ocspSign-
	    ing or msSmartcardLogon. Can be used multiple times. Adds an X.509v3
	    EKU extension containing these flags to the certificate request.

     -p, --password password
	    The challengePassword to include in the certificate request.

     -o, --oldreq file
	    Old  certificate  request  to be used as a template. Required if the
	    --dn option is not set. The public key in the  old	certificate  re-
	    quest  is  replaced and a fresh signature is generated using the new
	    private key. Optionally a new challengePassword may be set using the
	    --password option.

     -g, --digest digest
	    Digest to use for signature creation. One of sha1,	sha224,  sha256,
	    sha384,  sha512,  sha3_224, sha3_256, sha3_384, or sha3_512. The de-
	    fault is determined based on the type and size of the signature key.

     -R, --rsa-padding padding
	    Padding to use for RSA signatures. Either pkcs1 or pss, defaults  to
	    pkcs1.

     -f, --outform encoding
	    Encoding  of the created certificate file. Either der (ASN.1 DER) or
	    pem (Base64 PEM), defaults to der.

EXAMPLES
     Generate a certificate request for an RSA key, with a subjectAltName exten-
     sion and a TLS-server profile:

       pki --req --in key.der --dn "C=CH, O=strongSwan, CN=moon" \
	   --san moon@strongswan.org --profile server > req.der

     Generate a certificate request for a renewed key based on an existing  tem-
     plate

       pki --req --in myNewKey.der --oldreq myReq.der > myNewReq.der

     Generate a certificate request for an ECDSA key and a different digest:

       pki --req --in key.der --type ecdsa --digest sha256 \
	   --dn "C=CH, O=strongSwan, CN=carol"	> req.der

SEE ALSO
     pki(1)

6.0.7				   2022-08-30			    PKI --REQ(1)

Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=pki---req&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>

home | help