/usr/bin/certutil

-A              Add a certificate to the database        (create if needed)
   All options under -E apply
-B              Run a series of certutil commands from a batch file
   -i batch-file     Specify the batch file
-E              Add an Email certificate to the database (create if needed)
   -n cert-name      Specify the nickname of the certificate to add
   -t trustargs      Set the certificate trust attributes:
                          trustargs is of the form x,y,z where x is for SSL, y is for S/MIME,
                          and z is for code signing. Use ,, for no explicit trust.
                          p 	 prohibited (explicitly distrusted)
                          P 	 trusted peer
                          c 	 valid CA
                          T 	 trusted CA to issue client certs (implies c)
                          C 	 trusted CA to issue server certs (implies c)
                          u 	 user cert
                          w 	 send warning
                          g 	 make step-up cert
   -f pwfile         Specify the password file
   -d certdir        Cert database directory (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix
   -a                The input certificate is encoded in ASCII (RFC1113)
   -i input          Specify the certificate file (default is stdin)

-C              Create a new binary certificate from a BINARY cert request
   -c issuer-name    The nickname of the issuer cert
   -i cert-request   The BINARY certificate request file
   -o output-cert    Output binary cert to this file (default is stdout)
   -x                Self sign
   --pss-sign        Sign the certificate with RSA-PSS (the issuer key must be rsa)
   -m serial-number  Cert serial number
   -w warp-months    Time Warp
   -v months-valid   Months valid (default is 3)
   -f pwfile         Specify the password file
   -d certdir        Cert database directory (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix
   -Z hashAlg
                     Specify the hash algorithm to use. Possible keywords:
                     "MD2", "MD4", "MD5", "SHA1", "SHA224",
                     "SHA256", "SHA384", "SHA512"
   -1 | --keyUsage keyword,keyword,...
                     Create key usage extension. Possible keywords:
                     "digitalSignature", "nonRepudiation", "keyEncipherment",
                     "dataEncipherment", "keyAgreement", "certSigning",
                     "crlSigning", "critical"
   -2                Create basic constraint extension
   -3                Create authority key ID extension
   -4                Create crl distribution point extension
   -5 | --nsCertType keyword,keyword,...
                     Create netscape cert type extension. Possible keywords:
                     "sslClient", "sslServer", "smime", "objectSigning",
                     "sslCA", "smimeCA", "objectSigningCA", "critical".
   -6 | --extKeyUsage keyword,keyword,...
                     Create extended key usage extension. Possible keywords:
                     "serverAuth", "clientAuth","codeSigning",
                     "emailProtection", "timeStamp","ocspResponder",
                     "stepUp", "msTrustListSign", "x509Any",
                     "ipsecIKE", "ipsecIKEEnd", "ipsecIKEIntermediate",
                     "ipsecEnd", "ipsecTunnel", "ipsecUser",
                     "critical"
   -7 emailAddrs     Create an email subject alt name extension
   -8 dnsNames       Create an dns subject alt name extension
   -a                The input certificate request is encoded in ASCII (RFC1113)

-G              Generate a new key pair
   -h token-name     Name of token in which to generate key (default is internal)
   -k key-type       Type of key pair to generate ("dsa", "ec", "rsa" (default))
   -g key-size       Key size in bits, (min 512, max 8192, default 2048) (not for ec)
   -y exp            Set the public exponent value (3, 17, 65537) (rsa only)
   -f password-file  Specify the password file
   -z noisefile      Specify the noise file to be used
   -q pqgfile        read PQG value from pqgfile (dsa only)
   -q curve-name     Elliptic curve name (ec only)
                     One of nistp256, nistp384, nistp521, curve25519.
                     If a custom token is present, the following curves are also supported:
                     sect163k1, nistk163, sect163r1, sect163r2,
                     nistb163, sect193r1, sect193r2, sect233k1, nistk233,
                     sect233r1, nistb233, sect239k1, sect283k1, nistk283,
                     sect283r1, nistb283, sect409k1, nistk409, sect409r1,
                     nistb409, sect571k1, nistk571, sect571r1, nistb571,
                     secp160k1, secp160r1, secp160r2, secp192k1, secp192r1,
                     nistp192, secp224k1, secp224r1, nistp224, secp256k1,
                     secp256r1, secp384r1, secp521r1,
                     prime192v1, prime192v2, prime192v3,
                     prime239v1, prime239v2, prime239v3, c2pnb163v1,
                     c2pnb163v2, c2pnb163v3, c2pnb176v1, c2tnb191v1,
                     c2tnb191v2, c2tnb191v3,
                     c2pnb208w1, c2tnb239v1, c2tnb239v2, c2tnb239v3,
                     c2pnb272w1, c2pnb304w1,
                     c2tnb359w1, c2pnb368w1, c2tnb431r1, secp112r1,
                     secp112r2, secp128r1, secp128r2, sect113r1, sect113r2
                     sect131r1, sect131r2
   -q curve-name     Edwards elliptic curve name (ed only)
                     One of ed25519.
   -q paramset       ML-DSA parameter set (mldsa only)
                     valid values are ml-dsa-44,  ml-dsa-65, ml-dsa-87:
   -d keydir         Key database directory (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix
   --keyAttrFlags attrflags
                     PKCS #11 key Attributes.
                     Comma separated list of key attribute attribute flags,
                     selected from the following list of choices:
                     {token | session} {public | private} {sensitive | insensitive}
                     {modifiable | unmodifiable} {extractable | unextractable}
   --keyOpFlagsOn opflags
   --keyOpFlagsOff opflags
                     PKCS #11 key Operation Flags.
                     Comma separated list of one or more of the following:
                     encrypt, decrypt, sign, sign_recover, verify,
                     verify_recover, wrap, unwrap, derive

-D              Delete a certificate from the database
   -n cert-name      The nickname of the cert to delete
   -d certdir        Cert database directory (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix

--rename        Change the database nickname of a certificate
   -n cert-name      The old nickname of the cert to rename
   --new-n new-name  The new nickname of the cert to rename
   -d certdir        Cert database directory (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix

-F              Delete a key and associated certificate from the database
   -n cert-name      The nickname of the key to delete
   -k key-id         The key id of the key to delete, obtained using -K
   -d certdir        Cert database directory (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix

-U              List all modules
   -d moddir         Module database directory (default is '~/.netscape')
   -P dbprefix       Cert & Key database prefix
   -X                force the database to open R/W

-K              List all private keys
   -h token-name     Name of token to search ("all" for all tokens)
   -k key-type       Key type ("all" (default), "dsa", "ec", "ed", "mldsa", "rsa")
   -n name           The nickname of the key or associated certificate
   -f password-file  Specify the password file
   -d keydir         Key database directory (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix
   -X                force the database to open R/W

-L              List all certs, or print out a single named cert (or a subset)
   -h token-name     Name of token to search ("all" for all tokens)
   -n cert-name      Pretty print named cert (list all if unspecified)
   --email email-address
                     Pretty print cert with email address (list all if unspecified)
   -d certdir        Cert database directory (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix
   -X                force the database to open R/W
   -r                For single cert, print binary DER encoding
   -a                For single cert, print ASCII encoding (RFC1113)
   --dump-ext-val OID
                     For single cert, print binary DER encoding of extension OID

--build-flags   Print enabled build flags relevant for NSS test execution

-M              Modify trust attributes of certificate
   -n cert-name      The nickname of the cert to modify
   -t trustargs      Set the certificate trust attributes (see -A above)
   -d certdir        Cert database directory (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix

-N              Create a new certificate database
   -d certdir        Cert database directory (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix
   -f password-file  Specify the password file
   --empty-password  use empty password when creating a new database

-T              Reset the Key database or token
   -d certdir        Cert database directory (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix
   -h token-name     Token to reset (default is internal)
   -0 SSO-password   Set token's Site Security Officer password

-O              Print the chain of a certificate
   -n cert-name      The nickname of the cert to modify
   -d certdir        Cert database directory (default is ~/.netscape)
   -a                Input the certificate in ASCII (RFC1113); default is binary
   -P dbprefix       Cert & Key database prefix
   -X                force the database to open R/W
   --simple-self-signed don't search for a chain if issuer name equals subject name

-R              Generate a certificate request (stdout)
   -s subject        Specify the subject name (using RFC1485)
   -o output-req     Output the cert request to this file
   -k key-type-or-id Type of key pair to generate ("dsa", "ec", "rsa" (default))
                     or nickname of the cert key to use, or key id obtained using -K
   -h token-name     Name of token in which to generate key (default is internal)
   -g key-size       Key size in bits, RSA keys only (min 512, max 8192, default 2048)
   --pss             Create a certificate request restricted to RSA-PSS (rsa only)
   -q pqgfile        Name of file containing PQG parameters (dsa only)
   -q curve-name     Elliptic curve name (ec only)
                     See the "-G" option for a full list of supported names.
   -q curve-name     Edwards elliptic curve name (ed only)
                     See the "-G" option for a full list of supported names.
   -q paramset       ML-DSA parameter set (mldsa only)
                     See the "-G" option for a full list of supported names.
   -f pwfile         Specify the password file
   -d keydir         Key database directory (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix
   -p phone          Specify the contact phone number ("123-456-7890")
   -Z hashAlg
                     Specify the hash algorithm to use. Possible keywords:
                     "MD2", "MD4", "MD5", "SHA1", "SHA224",
                     "SHA256", "SHA384", "SHA512"
   -a                Output the cert request in ASCII (RFC1113); default is binary
   See -S for available extension options
   See -G for available key flag options

-V              Validate a certificate
   -n cert-name      The nickname of the cert to Validate
   -b time           validity time ("YYMMDDHHMMSS[+HHMM|-HHMM|Z]")
   -e                Check certificate signature
   -u certusage      Specify certificate usage:
                          C 	 SSL Client
                          V 	 SSL Server
                          I 	 IPsec
                          L 	 SSL CA
                          A 	 Any CA
                          Y 	 Verify CA
                          S 	 Email signer
                          R 	 Email Recipient
                          O 	 OCSP status responder
                          J 	 Object signer
   -d certdir        Cert database directory (default is ~/.netscape)
   -a                Input the certificate in ASCII (RFC1113); default is binary
   -P dbprefix       Cert & Key database prefix
   -X                force the database to open R/W

-W              Change the key database password
   -d certdir        cert and key database directory
   -f pwfile         Specify a file with the current password
   -@ newpwfile      Specify a file with the new password in two lines

--upgrade-merge Upgrade an old database and merge it into a new one
   -d certdir        Cert database directory to merge into (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix of the target database
   -f pwfile         Specify the password file for the target database
   --source-dir certdir
                     Cert database directory to upgrade from
   --source-prefix dbprefix
                     Cert & Key database prefix of the upgrade database
   --upgrade-id uniqueID
                     Unique identifier for the upgrade database
   --upgrade-token-name name
                     Name of the token while it is in upgrade state
   -@ pwfile         Specify the password file for the upgrade database

--merge         Merge source database into the target database
   -d certdir        Cert database directory of target (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix of the target database
   -f pwfile         Specify the password file for the target database
   --source-dir certdir
                     Cert database directory of the source database
   --source-prefix dbprefix
                     Cert & Key database prefix of the source database
   -@ pwfile         Specify the password file for the source database

-S              Make a certificate and add to database
   -n key-name       Specify the nickname of the cert
   -s subject        Specify the subject name (using RFC1485)
   -c issuer-name    The nickname of the issuer cert
   -t trustargs      Set the certificate trust attributes (see -A above)
   -k key-type-or-id Type of key pair to generate ("dsa", "ec", "rsa" (default))
   -h token-name     Name of token in which to generate key (default is internal)
   -g key-size       Key size in bits, RSA keys only (min 512, max 8192, default 2048)
   --pss             Create a certificate restricted to RSA-PSS (rsa only)
   -q pqgfile        Name of file containing PQG parameters (dsa only)
   -q curve-name     Elliptic curve name (ec only)
                     See the "-G" option for a full list of supported names.
   -q curve-name     Edwards elliptic curve name (ed only)
                     See the "-G" option for a full list of supported names.
   -q paramset       ML-DSA parameter set (mldsa only)
                     See the "-G" option for a full list of supported names.
   -x                Self sign
   --pss-sign        Sign the certificate with RSA-PSS (the issuer key must be rsa)
   -m serial-number  Cert serial number
   -w warp-months    Time Warp
   -v months-valid   Months valid (default is 3)
   -f pwfile         Specify the password file
   -d certdir        Cert database directory (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix
   -p phone          Specify the contact phone number ("123-456-7890")
   -Z hashAlg
                     Specify the hash algorithm to use. Possible keywords:
                     "MD2", "MD4", "MD5", "SHA1", "SHA224",
                     "SHA256", "SHA384", "SHA512"
   -1                Create key usage extension
   -2                Create basic constraint extension
   -3                Create authority key ID extension
   -4                Create crl distribution point extension
   -5                Create netscape cert type extension
   -6                Create extended key usage extension
   -7 emailAddrs     Create an email subject alt name extension
   -8 DNS-names      Create a DNS subject alt name extension
   --extAIA          Create an Authority Information Access extension
   --extSIA          Create a Subject Information Access extension
   --extCP           Create a Certificate Policies extension
   --extPM           Create a Policy Mappings extension
   --extPC           Create a Policy Constraints extension
   --extIA           Create an Inhibit Any Policy extension
   --extSKID         Create a subject key ID extension
   See -G for available key flag options
   --extNC           Create a name constraints extension
   --extSAN type:name[,type:name]...
                     Create a Subject Alt Name extension with one or multiple names
                     - type: directory, dn, dns, edi, ediparty, email, ip, ipaddr,
                             other, registerid, rfc822, uri, x400, x400addr
   --extGeneric OID:critical-flag:filename[,OID:critical-flag:filename]...
                     Add one or multiple extensions that certutil cannot encode yet,
                     by loading their encodings from external files.
                     - OID (example): 1.2.3.4
                     - critical-flag: critical or not-critical
                     - filename: full path to a file containing an encoded extension