8.5 Invoking certtool

This is a program to generate X.509 certificates, certificate requests, CRLs and private keys. The program can be used interactively or non interactively by specifying the --template command line option. See below for an example of a template file.

How to use certtool interactively:

• To generate parameters for Diffie Hellman key exchange, use the command:

            $ certtool --generate-dh-params --outfile dh.pem
       

• To generate parameters for the RSA-EXPORT key exchange, use the command:

            $ certtool --generate-privkey --bits 512 --outfile rsa.pem
       

• To create a self signed certificate, use the command:

            $ certtool --generate-privkey --outfile ca-key.pem
            $ certtool --generate-self-signed --load-privkey ca-key.pem \
               --outfile ca-cert.pem
       

  Note that a self-signed certificate usually belongs to a certificate authority, that signs other certificates.

• To create a private key, run:

            $ certtool --generate-privkey --outfile key.pem
       

• To create a certificate request, run:

            $ certtool --generate-request --load-privkey key.pem \
              --outfile request.pem
       

• To generate a certificate using the previous request, use the command:

            $ certtool --generate-certificate --load-request request.pem \
               --outfile cert.pem \
               --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem
       

• To view the certificate information, use:

            $ certtool --certificate-info --infile cert.pem
       

• To generate a PKCS #12 structure using the previous key and certificate, use the command:

            $ certtool --load-certificate cert.pem --load-privkey key.pem \
              --to-p12 --outder --outfile key.p12
       

Certtool's template file format:

• Firstly create a file named 'cert.cfg' that contains the information about the certificate. An example file is listed below.
• Then execute:

            $ certtool --generate-certificate cert.pem --load-privkey key.pem  \
               --template cert.cfg \
               --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem
       

An example certtool template file:

     # X.509 Certificate options
     #
     # DN options
     
     # The organization of the subject.
     organization = "Koko inc."
     
     # The organizational unit of the subject.
     unit = "sleeping dept."
     
     # The locality of the subject.
     # locality =
     
     # The state of the certificate owner.
     state = "Attiki"
     
     # The country of the subject. Two letter code.
     country = GR
     
     # The common name of the certificate owner.
     cn = "Cindy Lauper"
     
     # A user id of the certificate owner.
     #uid = "clauper"
     
     # If the supported DN OIDs are not adequate you can set
     # any OID here.
     # For example set the X.520 Title and the X.520 Pseudonym
     # by using OID and string pairs.
     #dn_oid = "2.5.4.12" "Dr." "2.5.4.65" "jackal"
     
     # This is deprecated and should not be used in new
     # certificates.
     # pkcs9_email = "none@none.org"
     
     # The serial number of the certificate
     serial = 007
     
     # In how many days, counting from today, this certificate will expire.
     expiration_days = 700
     
     # X.509 v3 extensions
     
     # A dnsname in case of a WWW server.
     #dns_name = "www.none.org"
     
     # An IP address in case of a server.
     #ip_address = "192.168.1.1"
     
     # An email in case of a person
     email = "none@none.org"
     
     # An URL that has CRLs (certificate revocation lists)
     # available. Needed in CA certificates.
     #crl_dist_points = "http://www.getcrl.crl/getcrl/"
     
     # Whether this is a CA certificate or not
     #ca
     
     # Whether this certificate will be used for a TLS client
     #tls_www_client
     
     # Whether this certificate will be used for a TLS server
     #tls_www_server
     
     # Whether this certificate will be used to sign data (needed
     # in TLS DHE ciphersuites).
     signing_key
     
     # Whether this certificate will be used to encrypt data (needed
     # in TLS RSA ciphersuites). Note that it is prefered to use different
     # keys for encryption and signing.
     #encryption_key
     
     # Whether this key will be used to sign other certificates.
     #cert_signing_key
     
     # Whether this key will be used to sign CRLs.
     #crl_signing_key
     
     # Whether this key will be used to sign code.
     #code_signing_key
     
     # Whether this key will be used to sign OCSP data.
     #ocsp_signing_key
     
     # Whether this key will be used for time stamping.
     #time_stamping_key