ezgh private-ca works in a project (--project, EZGH_PROJECT or the profile’s). CAs and ACME
bindings are named by name, slug or ID; issued certificates by ID. Every command takes -o json.
ezgh private-ca ca list | get <ca> | csr <ca> | renew <ca> [--wait] | enable <ca> | restore <ca>
ezgh private-ca ca create --name n --type root|subordinate [--parent ca | --external] [--key-algorithm a]
[--common-name cn] [--permitted-dns d]… [--max-leaf-validity-days n] [--wait]
ezgh private-ca ca update <ca> [--name n] [--description d] [--max-leaf-validity-days n]
ezgh private-ca ca disable <ca> | delete <ca> [--window 7-30] | revoke <ca> --reason r
ezgh private-ca ca import <ca> --chain signed.pem [--wait]
ezgh private-ca ca issue <ca> (--csr req.pem | --generate-key a --san dns:name…) [--profile p] [--validity-days n] [--out cert.pem]
ezgh private-ca acme-binding create <ca> --name n [--allowed-name n]… | list <ca> | delete <ca> <binding>
ezgh private-ca certificate list [--ca <ca>] [--status issued|revoked|expired] [--key-source s] [--search text]
ezgh private-ca certificate get <id> [--out f] | revoke <id> --reason r | forget-key <id> | delete <id>
ezgh private-ca certificate export-key <id> [--out key.pem] [--passphrase-file f] [--certificate-out cert.pem]--waitwaits until a created, imported or renewed CA is active, for at most--wait-timeout(10 minutes by default). A certificate that isn’t signed at once is always waited for (--no-waitdoesn’t).export-keyasks for the passphrase twice on a terminal, or reads it from--passphrase-file(the file’s content, less one trailing newline); either way it’s used exactly as given, and it’s never a flag’s value.--outand--certificate-outwrite new files with mode 0600, and don’t follow symlinks;--forcereplaces an existing one. They’re checked before anything is issued or exported.disable,delete,revoke,forget-keyand a binding’sdeleteask first;--yesconfirms in scripts.- An ACME binding’s HMAC key is printed once, by
acme-binding create.
The command reference lists every flag.