---
title: "ezgh private-ca ca issue"
description: "Issue a certificate from a CSR or a generated key."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ezgh private-ca ca issue

{/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */}

```sh
ezgh private-ca ca issue <ca> (--csr <file> | --generate-key <algorithm> --san kind:name…) [--profile p] [--validity-days n] [--out file] [flags]
```

Issue a certificate from an active subordinate CA.

From your CSR (`--csr`, a PEM file or - for stdin): its signature proves you hold the key, and only its key, common name and names are used; `--san` replaces its names. It's usually signed at once.

From a key EZGH generates (`--generate-key` ecdsa-p256, ecdsa-p384, rsa-2048, rsa-3072 or rsa-4096, with at least one `--san`): EZGH keeps the key until you forget it, and `ezgh private-ca certificate export-key` exports it encrypted with your passphrase.

ezgh waits for a certificate that isn't signed at once (at most `--wait-timeout`; `--no-wait` doesn't).

`--san` is kind:name: dns:api.corp.example, ip:10.0.0.7, uri:spiffe://corp.example/api or email:ops@corp.example, each within the CA's name constraints. `--profile` is tlsServer (default), tlsClient or tlsServerClient. `--validity-days` (default 30) is at most the CA's longest certificate. `--out` writes the certificate and its chain to a new file (mode 0600; `--force` replaces one).

Part of [`ezgh private-ca ca`](/cli/reference/private-ca-ca).

## Examples

```sh
ezgh private-ca ca issue corp-issuing --csr req.pem --profile tlsServer --validity-days 30 --out cert.pem
ezgh private-ca ca issue corp-issuing --generate-key ecdsa-p256 --san dns:a.corp.example
```

## Flags

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--common-name` | string |  | the subject's common name, with `--generate-key` |
| `--csr` | string |  | a PEM certificate signing request (- for stdin) |
| `--force` | boolean |  | replace `--out` if it exists |
| `--generate-key` | string |  | have EZGH generate the key: ecdsa-p256, ecdsa-p384, rsa-2048, rsa-3072 or rsa-4096 |
| `--no-wait` | boolean |  | don't wait for a certificate that isn't signed at once |
| `--out` | string |  | write the certificate and its chain to this file |
| `--profile` | string | `tlsServer` | tlsServer, tlsClient or tlsServerClient |
| `--san` | string, repeatable |  | a name, kind:value (dns:, ip:, uri:, email:; repeat) |
| `--validity-days` | int | `30` | how long it's valid, at most the CA's longest certificate |
| `--wait-timeout` | duration | `10m0s` | how long to wait for it |

This command also takes the [global flags](/cli/reference#global-flags).

Source: https://docs.ezghcloud.com/cli/reference/private-ca-ca-issue/index.mdx