ezgh private-ca ca issue

ezgh private-ca ca issue <ca> (--csr <file> | --generate-key <algorithm> --san kind:name…) [--profile p] [--validity-days n] [--out file] [flags]

Issue a certificate from an active subordinate CA.

From your CSR (--csr, a PEM file or - for stdin): its signature proves you hold the key, and only its key, common name and names are used; --san replaces its names. It’s usually signed at once.

From a key EZGH generates (--generate-key ecdsa-p256, ecdsa-p384, rsa-2048, rsa-3072 or rsa-4096, with at least one --san): EZGH keeps the key until you forget it, and ezgh private-ca certificate export-key exports it encrypted with your passphrase.

ezgh waits for a certificate that isn’t signed at once (at most --wait-timeout; --no-wait doesn’t).

--san is kind:name: dns:api.corp.example, ip:10.0.0.7, uri:spiffe://corp.example/api or email:ops@corp.example, each within the CA’s name constraints. --profile is tlsServer (default), tlsClient or tlsServerClient. --validity-days (default 30) is at most the CA’s longest certificate. --out writes the certificate and its chain to a new file (mode 0600; --force replaces one).

Part of ezgh private-ca ca.

Examples

ezgh private-ca ca issue corp-issuing --csr req.pem --profile tlsServer --validity-days 30 --out cert.pem
ezgh private-ca ca issue corp-issuing --generate-key ecdsa-p256 --san dns:a.corp.example

Flags

This command also takes the global flags.