SQ(1) User Commands SQ(1) NAME sq-pki-link-authorize - Make a certificate a trusted introducer SYNOPSIS sq pki link authorize [OPTIONS] DESCRIPTION Make a certificate a trusted introducer. This causes `sq` to consider the certificate to be a be a trusted intro- ducer. Trusted introducer is another word for certification authority (CA). When you link a trusted introducer, you consider certifications made by the trusted introducer to be valid. A trusted introducer can also des- ignate further trusted introducers. As is, a trusted introducer has a lot of power. This power can be limited in several ways. - The ability to specify further introducers can be constrained using the `--depth` parameter. - The degree to which an introducer is trusted can be changed using the `--amount` parameter. - The user IDs that an introducer can certify can be constrained by do- main using the `--domain` parameter or a regular expression using the `--regex` parameter. These mechanisms allow you to say that you are willing to rely on the CA for example.org, but only for user IDs that have an email address for exam- ple.org, for instance. A link can be retracted using `sq pki link retract`. This command is similar to `sq pki vouch authorize`, but the certifications it makes are done using the certificate directory's trust root, not an ar- bitrary key. Further, the certificates are marked as non-exportable. The former makes it easier to manage certifications, especially when your cer- tification key is offline. And the latter improves your privacy, by reduc- ing the chance that parts of your social graph are leaked when a certifi- cate is shared. By default a link never expires. Using the `--expiration` argument spe- cific validity periods may be defined. It allows for providing a point in time for validity to end or a validity duration. `sq pki link authorize` respects the reference time set by the top-level `--time` argument. It sets the link's creation time to the reference time. OPTIONS Subcommand options --add-email=EMAIL Use a user ID with the specified email address The user ID consists of just the email address. The email address does not have to appear in a self-signed user ID. --add-userid=USERID Use the specified user ID The specified user ID does not need to be self signed. Because using a user ID that is not self-signed is often a mistake, you need to use this option to explicitly opt in. --all Use all self-signed user IDs --allow-non-canonical-userids Don't reject new user IDs that are not in canonical form Canonical user IDs are of the form `Name (Comment) <localpart@exam- ple.org>`. --amount=AMOUNT Set the amount of trust Values between 1 and 120 are meaningful. 120 means fully trusted. Values less than 120 indicate the degree of trust. 60 is usually used for partially trusted. [default: full] --cert=FINGERPRINT|KEYID Use certificates with the specified fingerprint or key ID --cert-special=SPECIAL Use certificates identified by the special name [possible values: public-directories, keys.openpgp.org, keys.mailve- lope.com, proton.me, wkd, dane, autocrypt, web] --depth=TRUST_DEPTH Set the trust depth This is sometimes referred to as the trust level. 1 means CERTIFI- CATE is a trusted introducer (default), 2 means CERTIFICATE is a meta-trusted introducer and can authorize another trusted intro- ducer, etc. [default: 255] --domain=DOMAIN Add a domain constraint to the introducer Add a domain to constrain what certifications are respected. A cer- tification made by the certificate is only respected if it is over a user ID with an email address in the specified domain. Multiple do- mains may be specified. In that case, one must match. --email=EMAIL Use a user ID consisting of just the email address, if the email ad- dress occurs in a self-signed user ID --expiration=EXPIRATION Sets the expiration time EXPIRATION is either an ISO 8601 formatted date with an optional time or a custom duration. A duration takes the form `N[ymwds]`, where the letters stand for years, months, weeks, days, and seconds, respectively. Alternatively, the keyword `never` does not set an ex- piration time. [default: never] --recreate Recreate the signature even if the parameters did not change If the link parameters did not change, and thus creating a signature should not be necessary, we omit the operation. This flag can be given to force the signature to be recreated anyway. --regex=REGEX Add a regular expression to constrain the introducer Add a regular expression to constrain what certifications are re- spected. A certification made by the certificate is only respected if it is over a user ID that matches one of the specified regular expression. Multiple regular expressions may be specified. In that case, at least one must match. --signature-notation NAME VALUE Add a notation to the signature A user-defined notation's name must be of the form `name@a.do- main.you.control.org`. If the notation's name starts with a `!`, then the notation is marked as being critical. If a consumer of a signature doesn't understand a critical notation, then it will ig- nore the signature. The notation is marked as being human readable. --unconstrained Don't constrain the introducer Normally an introducer is constrained so that only certain user IDs are respected, e.g., those that have an email address for a certain domain name. This option authorizes an introducer without con- straining it in this way. Because this grants the introducer a lot of power, you have to opt in to this behavior explicitly. --userid=USERID Use the specified self-signed user ID The specified user ID must be self signed. --userid-by-email=EMAIL Use the self-signed user ID with the specified email address Global options See sq(1) for a description of the global options. EXAMPLES Add an unconstrained trusted introducer. sq pki link authorize --unconstrained \ --cert=EB28F26E2739A4870ECC47726F0073F60FD0CBF0 --all Add a trusted introducer for example.org and example.com. sq pki link authorize --domain=example.org \ --domain=example.com \ --cert=EB28F26E2739A4870ECC47726F0073F60FD0CBF0 --all Add a partially trusted introducer. sq pki link authorize --unconstrained --amount=60 \ --cert=EB28F26E2739A4870ECC47726F0073F60FD0CBF0 --all SEE ALSO sq(1), sq-pki(1), sq-pki-link(1). For the full documentation see <https://book.sequoia-pgp.org/>. VERSION 1.3.1 Sequoia PGP 1.3.1 SQ(1)
Want to link to this manual page? Use this URL:
<https://man.FreeBSD.org/cgi/man.cgi?query=sq-pki-link-authorize&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>