Skip to content
This repository was archived by the owner on Feb 16, 2023. It is now read-only.

certainly.1.ronn

Latest commit

 

History

History
198 lines (133 loc) · 6.79 KB

certainly.1.ronn

File metadata and controls

198 lines (133 loc) · 6.79 KB
Raw

certainly(1) -- create self-signed certificates with ease

SYNOPSIS

certainly [--std | --reverse-std | --double-std] [--ecdsa | --ed25519 | --rsa] [--ca ] [--client] [...]

certainly [--std | --reverse-std | --double-std] [--ecdsa | --ed25519 | --rsa] --make-ca

certainly --inspect

DESCRIPTION

Creates a self-signed certificate and key with one or more domains associated.

By default, files named after the first domain given are written in the current directory, but flags can be passed to output to standard pipes instead.

With the --ca option, issues a certificate signed by a "CA" instead. The CA certificate/key pair can be created with certainly as well.

The inspect option instead reads a certificate file (or fetches it from a remote site) and outputs terse information about it: whether it's self-signed, its dates, and the domains it covers.

Files are written and read in PEM format. On Unix, file are written with 0600 permissions.

By default, generates ECDSA keys on the P-256 curve.

OPTIONS

  • : A domain to add to the certificate. The first such domain will also be the certificate's common name. IPv4 and v6 addresses are also supported.

  • --std: Outputs first the key then the certificate to STDOUT.

  • --reverse-std: Outputs first the certificated then the key to STDOUT.

  • --double-std: Outputs the key to STDERR, and the certificate to STDOUT. This is useful to write both files to a custom location efficiently, such as: certainly --double-std domain.test > test.crt 2> test.key.

  • --client: Creates a client certificate instead of a server certificate.

  • --ecdsa: Generates ECDSA keys (default). Use this option in scripts when you require an ECDSA key as the default may change.

  • --ed25519: Generates ED25519 keys.

  • --rsa: Generates RSA keys. Key length is 4096. This is slow and the RSA implementation has not been audited; do not use for production or security.

  • --ca : Uses the certificate/key pair .crt and .key to sign the created certificate instead of self-signing.

  • --make-ca : Creates a certificate/key pair suitable for issuing instead of a web certificate.

  • --inspect : Reads the (in PEM format), prints some information about it, and exits. Alternatively takes a URL or domain or IP address.

EXAMPLES

Create a self-signed certificate for test.domain:

$ certainly test.domain
Writing test.domain.key
Writing test.domain.crt

Create a self-signed certificate for several domains:

$ certainly test.domain test.place test.pizza
Writing test.domain.key
Writing test.domain.crt

Output a new key and certificate:

$ certainly --std test.app
-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg2yn3kvq3WzJv8F+V
BxZ+HCo73JQ7ABUrDDvBpUpexlehRANCAAR4gwky7IoIAdKwd3jSs7/VfrR0AsN9
LwYp0O988ZWGYhN+Dko7KuSrtYJ/kVBs+5iQnH2uK2OXKqpv5T8X/pUR
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIICPzCCAeWgAwIBAgIUPQ+Sy8RPt2gt5jW5wS6FRIydakkwCgYIKoZIzj0EAwQw
QTELMAkGA1UEBhMCWloxCzAJBgNVBAgMAkFBMRIwEAYDVQQKDAlDZXJ0YWlubHkx
ETAPBgNVBAMMCHRlc3QuYXBwMB4XDTE4MDkwNTIxMTM1N1oXDTI4MDkwMjIxMTM1
N1owQTELMAkGA1UEBhMCWloxCzAJBgNVBAgMAkFBMRIwEAYDVQQKDAlDZXJ0YWlu
bHkxETAPBgNVBAMMCHRlc3QuYXBwMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
eIMJMuyKCAHSsHd40rO/1X60dALDfS8GKdDvfPGVhmITfg5KOyrkq7WCf5FQbPuY
kJx9ritjlyqqb+U/F/6VEaOBujCBtzAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIF
4DAdBgNVHQ4EFgQU2jmj7l5rSw0yVb/vlWAYkK/YBwkwZgYDVR0jBF8wXaFFpEMw
QTELMAkGA1UEBhMCWloxCzAJBgNVBAgMAkFBMRIwEAYDVQQKDAlDZXJ0YWlubHkx
ETAPBgNVBAMMCHRlc3QuYXBwghQ9D5LLxE+3aC3mNbnBLoVEjJ1qSTATBgNVHREE
DDAKggh0ZXN0LmFwcDAKBggqhkjOPQQDBANIADBFAiBbaxLKxwnSWZy/3VzOOASs
9lz8YQWzc7NCESXzZTAHuAIhAOFKSelBXJEBsNLCtS86JNEvya+3XPWAL9R+O1jp
WMna
-----END CERTIFICATE-----

Write a key and certificate to custom locations:

$ certainly --double-std test.space 2> moon-key.pem > moon-cert.pem

Show some information about a certificate:

$ certainly --inspect test.ninja.crt
[Local]  C=ZZ, O=Certainly, OU=test.ninja from kaydel-ko, CN=test.ninja
Issuer:  C=ZZ, O=Certainly, OU=test.ninja from kaydel-ko, CN=test.ninja

Created on:   Sun Sep 15 01:15:29 2019
Expires on:   Sun Sep 15 01:15:29 2029

Domains:
 DNS: test.ninja
 DNS: test.green
 EMAIL: test@red.link
 DNS: test.technology
 DNS: rofl.lmao.lol
 IPV4: 1.2.3.4

To see more: $ openssl x509 -text -in test.ninja.crt

Show some information about google's certificate:

$ certainly --inspect google.com
[Remote] C=US, ST=California, L=Mountain View, O=Google LLC, CN=*.google.com
Issuer:  C=US, O=Google Trust Services, CN=GTS CA 1O1

Chain:
 Subject: C=US, O=Google Trust Services, CN=GTS CA 1O1
 Issuer:  OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign

Created on:   Sun Aug 23 10:28:57 2019
Expires on:   Sun Nov 21 10:28:57 2019

Domains:
 DNS: *.google.com
 DNS: *.android.com
 DNS: *.appengine.google.com
 DNS: *.cloud.google.com
 DNS: *.crowdsource.google.com
 DNS: *.g.co
(... many more domains ...)

To see more: $ echo Q | openssl s_client google.com:443

Create a CA pair and sign a new certificate:

$ certainly --make-ca ca.test
Writing ca.test.key
Writing ca.test.crt

$ certainly --ca ca.test test.party
Writing test.party.key
Writing test.party.crt

$ certainly --inspect test.party.crt
[Local]  C=ZZ, O=Certainly, OU=test.party from kaydel-ko, CN=test.party
Issuer:  C=ZZ, O=Certainly, OU=ca.test from kaydel-ko, CN=ca.test

Created on:   Sun Sep 15 01:20:44 2019
Expires on:   Sun Sep 15 01:20:44 2029

Domains:
 DNS: test.party

To see more: $ openssl x509 -text -in test.party.crt

DETAILS

Certificates are generated with a common subject of:

  • C (Country): ZZ

  • ST (State): AA

  • O (Organisation): Certainly

They use elliptical curve cryptography using prime256v1 hashed with SHA-256 by default.

This generates small files (easier to inspect and manipulate) and uses algorithms that are well supported by modern tools (browsers, servers, etc) while being up-to-date with security best practices.

In some legacy cases, should you absolutely need to, the --rsa flag instead uses 4096-bit RSA keys.

ED25519 keys are also available with the --ed25519 flag, and produce even smaller keys, but such keys are not well supported by tools at time of writing.

ENVIRONMENT VARIABLES

The distinguished name details can be controlled using the following variables:

  • CERTAINLY_C
  • CERTAINLY_O
  • CERTAINLY_OU

AUTHOR

Félix Saparelli https://passcod.name

Licensed under the Artistic License 2.0.