ipsec pki --acert


pki --acert [--in file] [--group membership] --issuerkey file|--issuerkeyid hex
             --issuercert file [--lifetime hours] [--not-before datetime]
            [--not-after datetime] [--dateform form] [--serial hex]
            [--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem] [--debug level]

           --help            (-h)  show usage information
           --in              (-i)  holder certificate to issue an attribute certificate for, default: stdin
           --group           (-m)  group membership the AC shall certify (included as string), may be repeated
           --issuerkey       (-k)  issuer private key
           --issuerkeyid     (-x)  smartcard or TPM issuer private key object handle
           --issuercert      (-c)  issuer certificate
           --lifetime        (-l)  hours the certificate is valid, default: 24
           --not-before      (-F)  absolute time when the validity of the AC begins
           --not-after       (-T)  absolute time when the validity of the AC ends
           --dateform        (-D)  strptime(3) format for the --not-before and --not-after options, default: %d.%m.%y %T
           --serial          (-s)  serial number in hex, default: random
           --digest          (-g)  digest to use for signature creation, default: key-specific
           --outform         (-f)  encoding of generated cert, default: der
           --debug           (-v)  set debug level, default: 1
           --options         (-+)  read command line options from file


Issue an X.509 attribute certificate using an issuer certificate with its private key and the holder certificate.


  • Create an options file to save repetitive typing
    cat > acert.opt
    --issuercert aacert.der --issuerkey aakey.der
    --digest sha256 --lifetime 4
  • Issue an attribute certificate based on a holder certificate and the options above
    pki --acert --options acert.opt --in holder.der --group sales --group finance > ac.der