SSCG

Section: System Administration Utilities (8)
Updated: January 2020
Page Index
 

NAME

sscg - Tool for generating x.509 certificates  

SYNOPSIS

sscg [,OPTION/...]  

DESCRIPTION

-q, --quiet
Display no output unless there is an error.
-v, --verbose
Display progress messages.
-d, --debug
Enable logging of debug messages. Implies verbose. Warning! This will print private key information to the screen!
-V, --version
Display the version number and exit.
-f, --force
Overwrite any pre-existing files in the requested locations
--lifetime=,1-3650/
Certificate lifetime (days). (default: 3650)
--country=,US/, CZ, etc.
Certificate DN: Country (C). (default: "US")
--state=,Massachusetts/, British Columbia, etc.
Certificate DN: State or Province (ST).
--locality=,Westford/, Paris, etc.
Certificate DN: Locality (L).
--organization=,My/ Company
Certificate DN: Organization (O). (default: "Unspecified")
--organizational-unit=,Engineering/, etc.
Certificate DN: Organizational Unit (OU).
--email=,myname/@example.com
Certificate DN: Email Address (Email).
--hostname=,server/.example.com
The valid hostname of the certificate. Must be an FQDN. (default: current system FQDN)
--subject-alt-name alt.example.com
Optional additional valid hostnames for the certificate. In addition to hostnames, this option also accepts explicit values supported by RFC 5280 such as IP:xxx.xxx.xxx.xxx/yyy.yyy.yyy.yyy May be specified multiple times.
--package=,STRING/
Unused. Retained for compatibility with earlier versions of sscg.
--key-strength=,2048/ or larger
Strength of the certificate private keys in bits. (default: 2048)
--hash-alg={sha256,sha384,sha512}
Hashing algorithm to use for signing. (default: "sha256")
--cipher-alg={des-ede3-cbc,aes-256-cbc}
Cipher to use for encrypting key files. (default: "aes-256-cbc")
--ca-file=,STRING/
Path where the public CA certificate will be stored. (default: "./ca.crt")
--ca-mode=,0644/
File mode of the created CA certificate.
--ca-key-file=,STRING/
Path where the CA's private key will be stored. If unspecified, the key will be destroyed rather than written to the disk.
--ca-key-mode=,0600/
File mode of the created CA key.
--ca-key-password=,STRING/
Provide a password for the CA key file. Note that this will be visible in the process table for all users, so it should be used for testing purposes only. Use --ca-keypassfile or --ca-key-password-prompt for secure password entry.
--ca-key-passfile=,STRING/
A file containing the password to encrypt the CA key file.
-C, --ca-key-password-prompt
Prompt to enter a password for the CA key file.
--crl-file=,STRING/
Path where an (empty) Certificate Revocation List file will be created, for applications that expect such a file to exist. If unspecified, no such file will be created.
--crl-mode=,0644/
File mode of the created Certificate Revocation List.
--cert-file=,STRING/
Path where the public service certificate will be stored. (default "./service.pem")
--cert-mode=,0644/
File mode of the created certificate.
--cert-key-file=,STRING/
Path where the service's private key will be stored. (default "service-key.pem")
--cert-key-mode=,0600/
File mode of the created certificate key.
-p, --cert-key-password=,STRING/
Provide a password for the service key file. Note that this will be visible in the process table for all users, so this flag should be used for testing purposes only. Use --cert-keypassfile or --cert-key-password-prompt for secure password entry.
--cert-key-passfile=,STRING/
A file containing the password to encrypt the service key file.
-P, --cert-key-password-prompt
Prompt to enter a password for the service key file.
--client-file=,STRING/
Path where a client authentication certificate will be stored.
--client-mode=,0644/
File mode of the created certificate.
--client-key-file=,STRING/
Path where the client's private key will be stored. (default is the client-file)
--client-key-mode=,0600/
File mode of the created certificate key.
--client-key-password=,STRING/
Provide a password for the client key file. Note that this will be visible in the process table for all users, so this flag should be used for testing purposes only. Use --client-keypassfile or --client-key-password-prompt for secure password entry.
--client-key-passfile=,STRING/
A file containing the password to encrypt the client key file.
--client-key-password-prompt
Prompt to enter a password for the client key file.
--dhparams-file=,STRING/
A file to contain a set of generated Diffie-Hellman parameters. If unspecified, no such file will be created.
--dhparams-prime-len=,INT/
The length of the prime number to generate for dhparams, in bits. (default: 2048)
--dhparams-generator={2,3,5}
The generator value for dhparams. (default: 2)
 

Help options:

-?, --help
Show this help message
--usage
Display brief usage message


 

Index

NAME
SYNOPSIS
DESCRIPTION
Help options:
LinuxReviews : manual page archive : man8