SHIB-KEYGEN(8) Shibboleth SHIB-KEYGEN(8)NAME
shib-keygen - Generate a key pair for a Shibboleth SP
SYNOPSIS
shib-keygen [-bf] [-e entity-id] [-g group]
[-h hostname] [-o output-dir] [-u user] [-y years]
DESCRIPTION
Generate a self-signed X.509 certificate for a Shibboleth SP. By default, the certificate will be for the local fully-qualified (as
returned by "hostname --fqdn") hostname. An entity ID can be specified with the -e flag. The openssl command-line client is used to
generate the key pair. By default, the public certificate will be created in /etc/shibboleth/sp-cert.pem and the private key in
/etc/shibboleth/sp-key.pem.
OPTIONS -b Suppress all standard error output when creating the certificate. This option is normally only used by the package build.
-e entity-id
Add entity-id (which should be a URI) as an alternative name for the certificate.
-f Remove /etc/shibboleth/sp-cert.pem and /etc/shibboleth/sp-key.pem before generating a new certificate. Without this option, if those
files already exist, shib-keygen prints an error and exits rather than overwriting them.
-g group
After generating the key and certificate, change the group ownership of the key file to this group. By default, the group used is
"_shibd".
-h hostname
Specify the fully-qualified domain name for which to generate a certificate. If this option isn't given, the hostname defaults to the
result of "hostname --fqdn".
-o output-dir
Store sp-cert.pem and sp-key.pem in the directory output-dir rather than the default of /etc/shibboleth.
-u user
After generating the key and certificate, change the ownership of the key file to this user. This is used to allow the key to be read
by a non-root user so that shibd can be run as a non-root user. By default, the key is owned by "_shibd".
-y years
The number of years for which the certificate should be valid. The default expiration time is ten years into the future.
FILES
/etc/shibboleth/sp-cert.cnf
The OpenSSL configuration file used for generating the self-signed certificate. This configuration file is generated when the script
is run and deleted afterwards.
/etc/shibboelth/sp-cert.pem
The default location of the public certificate created by this script.
/etc/shibboleth/sp-key.pem
The default location of the private key for the certificate created by this script.
These three files are stored in the directory given with -o instead, if that option is given.
AUTHOR
This manual page was written by Russ Allbery for Debian GNU/Linux.
COPYRIGHT
Copyright 2008, 2011 Russ Allbery. This manual page is hereby placed into the public domain by its author.
2.4.3 2012-02-16 SHIB-KEYGEN(8)
Check Out this Related Man Page
certtool(1) General Commands Manual certtool(1)NAME
certtool - Manipulate certificates and keys.
SYNOPSIS
certtool [options]
DESCRIPTION
Generate X.509 certificates, certificate requests, and private keys.
OPTIONS
Program control options
-d, --debug LEVEL
Specify the debug level. Default is 1.
-h, --help
Shows this help text
-v, --version
Shows the program's version
Getting information on X.509 certificates
-i, --certificate-info
Print information on a certificate.
-k, --key-info
Print information on a private key.
-l, --crl-info
Print information on a CRL.
--p12-info
Print information on a PKCS #12 structure.
Getting information on Openpgp certificates
--pgp--certificate-info
Print information on an OpenPGP certificate.
--pgp--key-info
Print information on an OpenPGP private key.
--pgp--ring-info
Print information on a keyring.
Generating/verifying X.509 certificates/keys
-c, --generate-certificate
Generate a signed certificate.
-e, --verify-chain
Verify a PEM encoded certificate chain. The last certificate in the chain must be a self signed one.
--generate-dh-params
Generate PKCS #3 encoded Diffie-Hellman parameters.
--load-ca-certificate FILE
Certificate authority's certificate file to use.
--load-ca-privkey FILE
Certificate authority's private key file or PKCS #11 URL to use.
--load-certificate FILE
Certificate file to use.
--load-privkey FILE
Private key file or PKCS #11 URL to use.
--load-pubkey FILE
Public key file or PKCS #11 URL to use.
--load-request FILE
Certificate request file to use.
-p, --generate-privkey
Generate a private key.
-q, --generate-request
Generate a PKCS #10 certificate request.
-s, --generate-self-signed
Generate a self-signed certificate.
-u, --update-certificate
Update a signed certificate.
Controlling output
-8, --pkcs8
Use PKCS #8 format for private keys.
--pkcs-cipher
The cipher to use when doing pkcs encryption. Valid options are 3des,aes-128,aes-192,aes-256,rc2-40
--dsa Generate a DSA key.
--bits BITS
Specify the number of bits for key generation.
--export-ciphers
Use weak encryption algorithms.
--inraw
Use RAW/DER format for input certificates and private keys.
--infile FILE
Input file.
--outraw
Use RAW/DER format for output certificates and private keys.
--outfile FILE
Output file.
--password PASSWORD
Password to use.
--to-p12
Generate a PKCS #12 structure.
--template
Use a template file to read input. See the doc/certtool.cfg in the distribution, for an example.
--fix-key
Some previous versions of certtool generated wrongly the optional parameters in a private key. This may affect programs that used
them. To fix an old private key use --key-info in combination with this parameter.
--v1 When generating a certificate use the X.509 version 1 format. This does not add any extensions (such as indication for a CA) but
some programs do need these.
EXAMPLES
To create a private key, run:
$ certtool --generate-privkey --outfile key.pem
To create a certificate request (needed when the certificate is issued by another party), run:
$ certtool --generate-request --load-privkey key.pem
--outfile request.pem
To create a certificate request using a key stored in a PKCS #11 token, run:
$ ./certtool --generate-request --load-privkey "pkcs11:..."
--load-pubkey "pkcs11:..." --outfile request.pem
To generate a certificate using the previous request, use the command:
$ certtool --generate-certificate --load-request request.pem
--outfile cert.pem --load-ca-certificate ca-cert.pem
--load-ca-privkey ca-key.pem
To generate a certificate using the private key only, use the command:
$ certtool --generate-certificate --load-privkey key.pem
--outfile cert.pem --load-ca-certificate ca-cert.pem
--load-ca-privkey ca-key.pem
To view the certificate information, use:
$ certtool --certificate-info --infile cert.pem
To generate a PKCS #12 structure using the previous key and certificate, use the command:
$ certtool --load-certificate cert.pem --load-privkey key.pem
--to-p12 --outder --outfile key.p12
AUTHOR
Nikos Mavrogiannopoulos <nmav@gnutls.org> and others; see /usr/share/doc/gnutls-bin/AUTHORS for a complete list.
This manual page was written by Ivo Timmermans <ivo@debian.org>, for the Debian GNU/Linux system (but may be used by others).
May 23rd 2005 certtool(1)