YUBIHSM-SHELL(1) User Commands YUBIHSM-SHELL(1)

# [NAME](#NAME)

yubihsm-shell - manual page for yubihsm-shell 2.8.0

# [SYNOPSIS](#SYNOPSIS)

**yubihsm-shell** \[*OPTION*]...

# [DESCRIPTION](#DESCRIPTION)

[**-a**, **--action**=*ENUM*](#a)

Action to perform (possible values="benchmark", "blink-device", "create-otp-aead", "decrypt-aesccm", "decrypt-aescbc", "decrypt-aesecb", "decrypt-oaep", "decrypt-otp", "decrypt-pkcs1v15", "delete-object", "derive-ecdh", "encrypt-aesccm", "encrypt-aescbc", "encrypt-aesecb", "generate-asymmetric-key", "generate-csr", "generate-hmac-key", "generate-otp-aead-key", "generate-wrap-key", "generate-symmetric-key", "get-device-info", "get-logs", "get-object-info", "get-opaque", "get-option", "get-pseudo-random", "get-public-key", "get-storage-info", "get-template", "get-wrapped", "get-rsa-wrapped", "get-rsa-wrapped-key", "get-device-pubkey", "list-objects", "put-asymmetric-key", "put-authentication-key", "put-hmac-key", "put-opaque", "put-option", "put-otp-aead-key", "put-symmetric-key", "put-template", "put-wrap-key", "put-rsa-wrapkey", "put-public-wrapkey", "put-wrapped", "put-rsa-wrapped", "put-rsa-wrapped-key", "randomize-otp-aead", "reset", "set-log-index", "sign-attestation-certificate", "sign-ecdsa", "sign-eddsa", "sign-hmac", "sign-pkcs1v15", "sign-pss", "sign-ssh-certificate")

[**-p**, **--password**=*STRING*](#p)

Authentication password

[**--authkey**=*SHORT*](#authkey)

Authentication key (default=\`1')

[**-i**, **--object-id**=*SHORT*](#i)

Object ID (default=\`0')

[**-l**, **--label**=*STRING*](#l)

Object label (default=\`')

[**-d**, **--domains**=*STRING*](#d)

Object domains (default=\`1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16')

[**-c**, **--capabilities**=*STRING*](#c)

Capabilities for an object (default=\`0')

[**-t**, **--object-type**=*STRING*](#t)

Object type (default=\`any')

[**-y**, **--ykhsmauth-label**=*STRING*](#y)

Credential label on YubiKey (implicitly enables ykhsmauth)

[**-r**, **--ykhsmauth-reader**=*STRING* Only use a matching YubiKey reader name](#r)

(default=\`')

[**--delegated**=*STRING*](#delegated)

Delegated capabilities (default=\`0')

[**--new-password**=*STRING*](#new)

New authentication password

[**-A**, **--algorithm**=*STRING*](#A)

Operation algorithm (default=\`any')

[**--oaep**=*STRING*](#oaep)

OAEP algorithm. Used primarily with asymmetric wrap (default=\`rsa-oaep-sha256')

[**--mgf1**=*STRING*](#mgf1)

MGF1 algorithm. Used primarily with asymmetric wrap (default=\`mgf1-sha256')

[**--nonce**=*INT*](#nonce)

OTP nonce

[**--iv**=*STRING*](#iv)

An initialization vector as a hexadecimal string

[**--count**=*INT*](#count)

Number of bytes to request (default=\`256')

[**--duration**=*INT*](#duration)

Blink duration in seconds (default=\`10')

[**--wrap-id**=*SHORT*](#wrap)

Wrap key ID

[**--include-seed**](#include)

Include seed when exporting an ED25519 key under wrap (default=off)

[**--template-id**=*SHORT*](#template)

Template ID

[**--attestation-id**=*SHORT*](#attestation)

Attestation ID

[**--log-index**=*INT*](#log)

Log index

[**--opt-name**=*STRING*](#opt)

Device option name

[**--opt-value**=*STRING*](#opt~2)

Device option value

[**--with-compression**](#with)

Compress a X509Certificate before importing it into the device or detect compressed certificates when listing objects (default=off)

[**-S**, **--subject**=*STRING*](#S)

The subject to use for certificate request. The subject must be written as: /CN=host.example.com/OU=test/O=example.com/

[**--in**=*STRING*](#in)

Input data (filename) (default=\`-')

[**--out**=*STRING*](#out)

Output data (filename) (default=\`-')

[**--informat**=*ENUM*](#informat)

Input format (possible values="default", "base64", "binary", "PEM", "password", "hex", "ASCII" default=\`default')

[**--outformat**=*ENUM*](#outformat)

Input and output format (possible values="default", "base64", "binary", "PEM", "hex", "ASCII" default=\`default')

[**-f**, **--config-file**=*STRING*](#f)

Configuration file to read (default=\`')

[**-C**, **--connector**=*STRING*](#C)

List of connectors to use

[**--cacert**=*STRING*](#cacert)

HTTPS cacert for connector

[**--cert**=*STRING*](#cert)

HTTPS client certificate to authenticate with

[**--key**=*STRING*](#key)

HTTPS client certificate key

[**--proxy**=*STRING*](#proxy)

Proxy server to use for connector

[**--noproxy**=*STRING*](#noproxy)

Comma separated list of hosts ignore proxy for

[**-v**, **--verbose**=*INT*](#v)

Print more information (default=\`0')

[**-P**, **--pre-connect**](#P)

Connect immediately in interactive mode (default=off)

[**--device-pubkey**=*STRING*](#device)

List of device public keys allowed for asymmetric authentication

[**-h**, **--help**](#h)

display help and exit

[**-V**, **--version**](#V)

output version and exit

October 2026 yubihsm-shell 2.8.0

---

Document: yubihsm-shell(1) from yubihsm-shell 2.8.0-r0 (Chainguard OS)