ezgh private-ca certificate export-key <id> [--out key.pem] [--passphrase-file f] [--certificate-out cert.pem] [flags]Export the private key EZGH generated for a certificate, as encrypted PKCS#8 PEM (PBES2, AES-256-CBC, PBKDF2-SHA256): you need the passphrase to use it. The passphrase (12–1024 characters) comes from --passphrase-file (the file’s content, less one trailing newline) or is typed twice on a terminal, used exactly as given either way; it’s never a flag’s value. --out writes the key to a new file (mode 0600), else it’s printed on stdout; --certificate-out writes the certificate and its chain. Neither replaces a file, or follows a symlink, without --force. Both, and -o, are checked before anything is exported.
Exporting needs certificates.privateCertificates.exportKey, which no managed policy grants, and is recorded in Trails. EZGH keeps the key until ezgh private-ca certificate forget-key, the certificate is deleted, or 30 days after it expires. Certificates issued from a CSR have no key to export.
Part of ezgh private-ca certificate.
Examples
ezgh private-ca certificate export-key 019a1b2d-… --out key.pem --certificate-out cert.pemFlags
| Flag | Type | Default | Description |
|---|---|---|---|
--certificate-out |
string | write the certificate and its chain to this new file | |
--force |
boolean | replace --out and --certificate-out if they exist |
|
--out |
string | write the encrypted key to this file (mode 0600) | |
--passphrase-file |
string | read the passphrase from this file, less one trailing newline (- for stdin) |
This command also takes the global flags.