---
title: "CLI"
description: "Manage private CAs, their certificates and ACME bindings with ezgh private-ca."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CLI

`ezgh private-ca` works in a project (`--project`, `EZGH_PROJECT` or the profile's). CAs and ACME
bindings are named by name, slug or ID; issued certificates by ID. Every command takes `-o json`.

```text
ezgh private-ca ca list | get <ca> | csr <ca> | renew <ca> [--wait] | enable <ca> | restore <ca>
ezgh private-ca ca create --name n --type root|subordinate [--parent ca | --external] [--key-algorithm a]
                            [--common-name cn] [--permitted-dns d]… [--max-leaf-validity-days n] [--wait]
ezgh private-ca ca update <ca> [--name n] [--description d] [--max-leaf-validity-days n]
ezgh private-ca ca disable <ca> | delete <ca> [--window 7-30] | revoke <ca> --reason r
ezgh private-ca ca import <ca> --chain signed.pem [--wait]
ezgh private-ca ca issue <ca> (--csr req.pem | --generate-key a --san dns:name…) [--profile p] [--validity-days n] [--out cert.pem]
ezgh private-ca acme-binding create <ca> --name n [--allowed-name n]… | list <ca> | delete <ca> <binding>
ezgh private-ca certificate list [--ca <ca>] [--status issued|revoked|expired] [--key-source s] [--search text]
ezgh private-ca certificate get <id> [--out f] | revoke <id> --reason r | forget-key <id> | delete <id>
ezgh private-ca certificate export-key <id> [--out key.pem] [--passphrase-file f] [--certificate-out cert.pem]
```

- `--wait` waits until a created, imported or renewed CA is active, for at most `--wait-timeout`
  (10 minutes by default). A certificate that isn't signed at once is always waited for (`--no-wait`
  doesn't).
- `export-key` asks for the passphrase twice on a terminal, or reads it from `--passphrase-file`
  (the file's content, less one trailing newline); either way it's used exactly as given, and it's
  never a flag's value.
- `--out` and `--certificate-out` write new files with mode 0600, and don't follow symlinks;
  `--force` replaces an existing one. They're checked before anything is issued or exported.
- `disable`, `delete`, `revoke`, `forget-key` and a binding's `delete` ask first; `--yes` confirms
  in scripts.
- An ACME binding's HMAC key is printed once, by `acme-binding create`.

The [command reference](/cli/reference) lists every flag.

Source: https://docs.ezghcloud.com/private-ca/cli/index.mdx