SSCG
Section: System Administration Utilities (8)
Updated: March 2021
Page Index
NAME
sscg - Tool for generating x.509 certificates
SYNOPSIS
sscg
[
,OPTION/...]
DESCRIPTION
- -q, --quiet
-
Display no output
unless there is an
error.
- -v, --verbose
-
Display progress
messages.
- -d, --debug
-
Enable logging of
debug messages.
Implies verbose.
Warning! This will
print private key
information to the
screen!
- -V, --version
-
Display the version
number and exit.
- -f, --force
-
Overwrite any
pre-existing files in
the requested locations
- --lifetime=,1-3650/
-
Certificate lifetime
(days). (default: 3650)
- --country=,US/, CZ, etc.
-
Certificate DN:
Country (C). (default:
"US")
- --state=,Massachusetts/, British Columbia, etc.
-
Certificate DN: State
or Province (ST).
- --locality=,Westford/, Paris, etc.
-
Certificate DN:
Locality (L).
- --organization=,My/ Company
-
Certificate DN:
Organization (O).
(default:
"Unspecified")
- --organizational-unit=,Engineering/, etc.
-
Certificate DN:
Organizational Unit
(OU).
- --email=,myname/@example.com
-
Certificate DN: Email
Address (Email).
- --hostname=,server/.example.com
-
The valid hostname of
the certificate. Must
be an FQDN. (default:
current system FQDN)
- --subject-alt-name alt.example.com
-
Optional additional
valid hostnames for
the certificate. In
addition to hostnames,
this option also
accepts explicit
values supported by
RFC 5280 such as
IP:xxx.xxx.xxx.xxx/yyy.yyy.yyy.yyy May be specified multiple times.
- --package=,STRING/
-
Unused. Retained for
compatibility with
earlier versions of
sscg.
- --key-strength=,2048/ or larger
-
Strength of the
certificate private
keys in bits.
(default: 2048)
- --hash-alg={sha256,sha384,sha512}
-
Hashing algorithm to
use for signing.
(default: "sha256")
- --cipher-alg={des-ede3-cbc,aes-256-cbc}
-
Cipher to use for
encrypting key files.
(default:
"aes-256-cbc")
- --ca-file=,STRING/
-
Path where the public
CA certificate will be
stored. (default:
"./ca.crt")
- --ca-mode=,0644/
-
File mode of the
created CA certificate.
- --ca-key-file=,STRING/
-
Path where the CA's
private key will be
stored. If
unspecified, the key
will be destroyed
rather than written to
the disk.
- --ca-key-mode=,0600/
-
File mode of the
created CA key.
- --ca-key-password=,STRING/
-
Provide a password for
the CA key file. Note
that this will be
visible in the process
table for all users,
so it should be used
for testing purposes
only. Use
--ca-keypassfile or
--ca-key-password-prompt for secure password entry.
- --ca-key-passfile=,STRING/
-
A file containing the
password to encrypt
the CA key file.
- -C, --ca-key-password-prompt
-
Prompt to enter a
password for the CA
key file.
- --crl-file=,STRING/
-
Path where an (empty)
Certificate Revocation
List file will be
created, for
applications that
expect such a file to
exist. If unspecified,
no such file will be
created.
- --crl-mode=,0644/
-
File mode of the
created Certificate
Revocation List.
- --cert-file=,STRING/
-
Path where the public
service certificate
will be stored.
(default
"./service.pem")
- --cert-mode=,0644/
-
File mode of the
created certificate.
- --cert-key-file=,STRING/
-
Path where the
service's private key
will be stored.
(default
"service-key.pem")
- --cert-key-mode=,0600/
-
File mode of the
created certificate
key.
- -p, --cert-key-password=,STRING/
-
Provide a password for
the service key file.
Note that this will be
visible in the process
table for all users,
so this flag should be
used for testing
purposes only. Use
--cert-keypassfile or
--cert-key-password-prompt for secure password entry.
- --cert-key-passfile=,STRING/
-
A file containing the
password to encrypt
the service key file.
- -P, --cert-key-password-prompt
-
Prompt to enter a
password for the
service key file.
- --client-file=,STRING/
-
Path where a client
authentication
certificate will be
stored.
- --client-mode=,0644/
-
File mode of the
created certificate.
- --client-key-file=,STRING/
-
Path where the
client's private key
will be stored.
(default is the
client-file)
- --client-key-mode=,0600/
-
File mode of the
created certificate
key.
- --client-key-password=,STRING/
-
Provide a password for
the client key file.
Note that this will be
visible in the process
table for all users,
so this flag should be
used for testing
purposes only. Use
--client-keypassfile
or
--client-key-password-prompt for secure password entry.
- --client-key-passfile=,STRING/
-
A file containing the
password to encrypt
the client key file.
- --client-key-password-prompt
-
Prompt to enter a
password for the
client key file.
- --dhparams-file=,STRING/
-
A file to contain a
set of generated
Diffie-Hellman
parameters. If
unspecified, no such
file will be created.
- --dhparams-prime-len=,INT/
-
The length of the
prime number to
generate for dhparams,
in bits. (default:
2048)
- --dhparams-generator={2,3,5}
-
The generator value
for dhparams.
(default: 2)
Help options:
- -?, --help
-
Show this help message
- --usage
-
Display brief usage
message