PKI --VERIFY(1) strongSwan PKI --VERIFY(1)

# [NAME](#NAME)

pki --verify - Verify a certificate using a CA certificate

# [SYNOPSIS](#SYNOPSIS)

`pki --verify` \[**--in** *file*] \[**--cacert** *file*] \[**--crl** *file*] \[**--debug** *level*] \[**--online**]

`pki --verify` **--options file**

`pki --verify` **-h** | **--help**

# [DESCRIPTION](#DESCRIPTION)

This sub-command of [**pki**(1)](/man/enterprise-packages/strongswan/pki.1) verifies a certificate using an optional CA certificate.

# [OPTIONS](#OPTIONS)

[**-h, --help**](#h,)

Print usage information with a summary of the available options.

[**-v, --debug level**](#v,)

Set debug level, default: 1.

**-+, --options file**

Read command line options from *file*.

[**-i, --in file**](#i,)

X.509 certificate to verify. If not given it is read from *STDIN*.

[**-c, --cacert file**](#c,)

CA certificate to use for trustchain verification. If not given the certificate is assumed to be self-signed. May optionally be a path to a directory from which CA certificates are loaded. Can be used multiple times.

[**-l, --crl file**](#l,)

Local CRL to use for trustchain verification. May optionally be a path to a directory from which CRLs are loaded. Can be used multiple times. Implies **-o**.

[**-o, --online**](#o,)

Enable online CRL/OCSP revocation checking.

# [EXIT STATUS](#EXIT_STATUS)

The exit status is 0 if the certificate was verified successfully, 1 if the certificate is untrusted, 2 if the certificate's lifetimes are invalid, and 3 if the certificate was verified successfully but the online revocation check indicated that it has been revoked.

# [SEE ALSO](#SEE_ALSO)

[**pki**(1)](/man/enterprise-packages/strongswan/pki.1)

2016-08-19 6.1.0

---

Document: pki---verify(1) from strongswan 6.1.0-r5 (Chainguard OS)
Source: https://github.com/strongswan/strongswan