certtool 3.5.8 Copyright (C) 2000-2017 Free Software Foundation, and others, all rights reserved. This is free software. It is licensed for use, modification and redistribution under the terms of the GNU General Public License, version 3 or later <http://gnu.org/licenses/gpl.html> Please send bug reports to: <bugs@gnutls.org>

certtool - GnuTLS certificate tool Usage: certtool [ -<flag> [<val>] | --<name>[{=| }<val>] ]... -d, --debug=num Enable debugging - it must be in the range: 0 to 9999 -V, --verbose More verbose output - may appear multiple times --infile=file Input file - file must pre-exist --outfile=str Output file -s, --generate-self-signed Generate a self-signed certificate -c, --generate-certificate Generate a signed certificate --generate-proxy Generates a proxy certificate --generate-crl Generate a CRL -u, --update-certificate Update a signed certificate -p, --generate-privkey Generate a private key --provable Generate a private key or parameters from a seed using a provable method --verify-provable-privkey Verify a private key generated from a seed using a provable method --seed=str When generating a private key use the given hex-encoded seed -q, --generate-request Generate a PKCS #10 certificate request - prohibits the option 'infile' -e, --verify-chain Verify a PEM encoded certificate chain --verify Verify a PEM encoded certificate chain using a trusted list --verify-crl Verify a CRL using a trusted list - requires the option 'load-ca-certificate' --verify-hostname=str Specify a hostname to be used for certificate chain verification --verify-email=str Specify a email to be used for certificate chain verification - prohibits the option 'verify-hostname' --verify-purpose=str Specify a purpose OID to be used for certificate chain verification --verify-allow-broken Allow broken algorithms, such as MD5 for verification --generate-dh-params Generate PKCS #3 encoded Diffie-Hellman parameters --get-dh-params Get the included PKCS #3 encoded Diffie-Hellman parameters --dh-info Print information PKCS #3 encoded Diffie-Hellman parameters --load-privkey=str Loads a private key file --load-pubkey=str Loads a public key file --load-request=str Loads a certificate request file --load-certificate=str Loads a certificate file --load-ca-privkey=str Loads the certificate authority's private key file --load-ca-certificate=str Loads the certificate authority's certificate file --load-crl=str Loads the provided CRL --load-data=str Loads auxiliary data --password=str Password to use --null-password Enforce a NULL password --empty-password Enforce an empty password --hex-numbers Print big number in an easier format to parse --cprint In certain operations it prints the information in C-friendly format -i, --certificate-info Print information on the given certificate --fingerprint Print the fingerprint of the given certificate --key-id Print the key ID of the given certificate --certificate-pubkey Print certificate's public key --pgp-certificate-info Print information on the given OpenPGP certificate --pgp-ring-info Print information on the given OpenPGP keyring structure -l, --crl-info Print information on the given CRL structure --crq-info Print information on the given certificate request --no-crq-extensions Do not use extensions in certificate requests --p12-info Print information on a PKCS #12 structure --p12-name=str The PKCS #12 friendly name to use --p7-generate Generate a PKCS #7 structure --p7-sign Signs using a PKCS #7 structure --p7-detached-sign Signs using a detached PKCS #7 structure --p7-include-cert The signer's certificate will be included in the cert list. - disabled as '--no-p7-include-cert' - enabled by default --p7-time Will include a timestamp in the PKCS #7 structure - disabled as '--no-p7-time' --p7-show-data Will show the embedded data in the PKCS #7 structure - disabled as '--no-p7-show-data' --p7-info Print information on a PKCS #7 structure --p7-verify Verify the provided PKCS #7 structure --p8-info Print information on a PKCS #8 structure --smime-to-p7 Convert S/MIME to PKCS #7 structure -k, --key-info Print information on a private key --pgp-key-info Print information on an OpenPGP private key --pubkey-info Print information on a public key --v1 Generate an X.509 version 1 certificate (with no extensions) --to-p12 Generate a PKCS #12 structure --to-p8 Generate a PKCS #8 structure -8, --pkcs8 Use PKCS #8 format for private keys --rsa Generate RSA key --dsa Generate DSA key --ecc Generate ECC (ECDSA) key --ecdsa an alias for the 'ecc' option --hash=str Hash algorithm to use for signing --inder Use DER format for input certificates, private keys, and DH parameters - disabled as '--no-inder' --inraw an alias for the 'inder' option --outder Use DER format for output certificates, private keys, and DH parameters - disabled as '--no-outder' --outraw an alias for the 'outder' option --bits=num Specify the number of bits for key generate --curve=str Specify the curve used for EC key generation --sec-param=str Specify the security level [low, legacy, medium, high, ultra] --disable-quick-random No effect --template=str Template file to use for non-interactive operation --stdout-info Print information to stdout instead of stderr --ask-pass Enable interaction for entering password when in batch mode. --pkcs-cipher=str Cipher to use for PKCS #8 and #12 operations --provider=str Specify the PKCS #11 provider library -v, --version[=arg] output version information and exit -h, --help display extended usage information and exit -!, --more-help extended usage information passed thru pager Options are specified by doubled hyphens and their name or by a single hyphen and the flag character. Tool to parse and generate X.509 certificates, requests and private keys. It can be used interactively or non interactively by specifying the template command line option. The tool accepts files or URLs supported by GnuTLS. In case PIN is required for the URL access you can provide it using the environment variables GNUTLS_PIN and GNUTLS_SO_PIN. Please send bug reports to: <bugs@gnutls.org>