PKI --ACERT(1) strongSwan PKI --ACERT(1)

# [NAME](#NAME)

pki --acert - Issue an attribute certificate

# [SYNOPSIS](#SYNOPSIS)

`pki --acert` \[**--in** *file*] \[**--group** *membership*] **--issuerkey file|--issuerkeyid hex** **--issuercert file** \[**--lifetime** *hours*] \[**--not-before** *datetime*] \[**--not-after** *datetime*] \[**--serial** *hex*] \[**--digest** *digest*] \[**--rsa-padding** *padding*] \[**--outform** *encoding*] \[**--debug** *level*]

`pki --acert` **--options file**

`pki --acert` **-h** | **--help**

# [DESCRIPTION](#DESCRIPTION)

This sub-command of [**pki**(1)](/man/enterprise-packages/strongswan/pki.1) is used to issue an attribute certificate using an issuer certificate with its private key and the holder certificate.

# [OPTIONS](#OPTIONS)

[**-h, --help**](#h,)

Print usage information with a summary of the available options.

[**-v, --debug level**](#v,)

Set debug level, default: 1.

**-+, --options file**

Read command line options from *file*.

[**-i, --in file**](#i,)

Holder certificate to issue an attribute certificate for. If not given the certificate is read from *STDIN*.

[**-m, --group membership**](#m,)

Group membership the attribute certificate shall certify. The specified group is included as a string. To include multiple groups, the option can be repeated.

[**-k, --issuerkey file**](#k,)

Issuer private key file. Either this or **--issuerkeyid** is required.

[**-x, --issuerkeyid hex**](#x,)

Smartcard or TPM issuer private key object handle in hex format with an optional h0x prefix. Either this or **--issuerkey** is required.

[**-c, --issuercert file**](#c,)

Issuer certificate file. Required.

[**-l, --lifetime hours**](#l,)

Hours the attribute certificate is valid, default: 24. Ignored if both an absolute start and end time are given.

[**-F, --not-before datetime**](#F,)

Absolute time when the validity of the AC begins. The datetime format is defined by the **--dateform** option.

[**-T, --not-after datetime**](#T,)

Absolute time when the validity of the AC ends. The datetime format is defined by the **--dateform** option.

[**-D, --dateform form**](#D,)

[strptime(3)](/man/enterprise-packages/strongswan/strptime.3) format for the **--not-before** and **--not-after** options, default: **%d.%m.%y %T**

[**-s, --serial hex**](#s,)

Serial number in hex. It is randomly allocated by default.

[**-g, --digest digest**](#g,)

Digest to use for signature creation. One of *md5*, *sha1*, *sha224*, *sha256*, *sha384*, or *sha512*. The default is determined based on the type and size of the signature key.

[**-R, --rsa-padding padding**](#R,)

Padding to use for RSA signatures. Either *pkcs1* or *pss*, defaults to *pkcs1*.

[**-f, --outform encoding**](#f,)

Encoding of the created certificate file. Either *der* (ASN.1 DER) or *pem* (Base64 PEM), defaults to *der*.

# [EXAMPLES](#EXAMPLES)

To save repetitive typing, command line options can be stored in files. Lets assume *acert.opt* contains the following contents:

```


  --issuercert aacert.der --issuerkey aakey.der --digest sha256 --lifetime 4
```

Then the following command can be used to issue an attribute certificate based on a holder certificate and the options above:

```


  pki --acert --options acert.opt --in holder.der --group sales --group finance -f pem
```

# [SEE ALSO](#SEE_ALSO)

[**pki**(1)](/man/enterprise-packages/strongswan/pki.1)

2014-02-05 6.1.0

---

Document: pki---acert(1) from strongswan 6.1.0-r3 (Chainguard OS)
Source: https://github.com/strongswan/strongswan