cert - Zeus Certificate Management Utility
cert [ options ]
cert can be used to create new private keys, public keys, certificate requests and sign requests. It can also produce a text-based output of information within the certificate.
Generally, cert requires an action each time it is invoked, so it knows what it should do. If you're creating a new key or certificate request, you should invoke cert with the -new and -type arguments.
If you're checking an existing private/public key pair, then invoke with the -check option. If you wish to sign a certificate request, then specify the -sign option with the relevant arguments.
Specifies the file to be processed. Used in conjunction with other options that require an input file.
This option specifies that a new public key, private key or certificate request should be created. Must be used in conjunction with -type.
This option specifies what type of file to create - either a public key, private key, or a certificate request. The file will be written to stdout, or to the filename given in -file
Specifies the private key to be used for creating requests and when signing keys.
Specifies the output file, which defaults to stdout if not supplied.
Specifies the output format. The format can be DER, PEM or text. DER stands for ``Distinguished Encoding Rules'', which is a subset of BER (Basic Encoding Rules) with one unique encoding for each ASN value (Abstract Syntax Notation). If you specify PEM, this will encode the DER output into a 6 bit encoding designed to be printable with standard ASCII characters. Text format provides a human-readable output.
This is the same as -format text and is provided for backwards compatibility. This provides textual representation of the certificate or key details specified.
This option specifies a Certificate Authority's public certificate. It can be used in conjunction with the -sign and -text options, and it will verify that input file was signed by the Certificate Authority, whose X509 public certificate is specified with -in.
Checks a private/public key pair, that they are indeed part of a pair. If they are, a message will be printed to stdout saying they are, else an error message is printed when verification is performed.
Signs a certificate request with Certificate Authority's public certificate. Certificate requests can be signed by multiple CAs, which is called chaining. When using this option, you will need to specify the request as -in and the CA's private key using -key.
See also -days, which controls the default expiry period of the signed certificate.
Number of days a signed certificate is valid for. The default is 365 (one year), but this can be changed with this option at sign-time.
Used when creating new keys, this option sets the size of keys in bits. The default value is 512 bit keys, the minimum supported is 256, and maximum is 2048 bits. Keys with more number of bits provide more security, but smaller keys will be faster to create and decrypt. An increase of one bit in size doubles the number of computations needed to break a key. Many browsers do not support keys greater 1024 bits long.
Typical usage:
$ cert -new -type private -out <private keyfile>
$ cert -new -type request -key <private keyfile> -out <outfile>
$ cert -new -type public -key <private keyfile> -out <outfile>
$ cert -sign -in <req> -ca <cert> -key <privkey> -out <outfile>
Copyright (C) 2000-2001 Zeus Technology Limited. All rights reserved.