HXTOOL(1)

NAME
hxtool - PKIX command-line utility

SYNOPSIS
hxtool [- -version] [- -help] [- -openssl-cnf=file] [- -openssl-propq=propq] [sub-command]
hxtool list-oids
hxtool cms-create-sd [-c certificate-store | - -certificate=certificate-store] [-s signer-friendly-name | - -signer=signer-friendly-name] [- -anchors=certificate-store] [- -pool=certificate-pool] [- -pass=PASS:password] [- -pass=FILE:path] [- -pass=PROMPT] [- -peer-alg=oid] [- -content-type=oid] [- -content-info] [- -pem] [- -detached-signature] [- -signer] [- -id-by-name] [- -embedded-certs] [- -embed-leaf-only] in-file out-file
hxtool cms-verify-sd [-D certificate-store | - -anchors=certificate-store] [-c certificate-store | - -certificate=certificate-store] [- -pass=PASS:password] [- -pass=FILE:path] [- -pass=PROMPT] [- -missing-revoke] [- -content-info] [- -pem] [- -signer-allowed] [- -allow-wrong-oid] [- -signed-content=value] [- -oid-sym] in-file [out-file]
hxtool cms-unenvelope [-c certificate-store | - -certificate=certificate-store] [- -pass=PASS:password] [- -pass=FILE:path] [- -pass=PROMPT] [- -content-info] [- -allow-weak-crypto] in-file out-file
hxtool cms-envelope [-c certificate-store | - -certificate=certificate-store] [- -pass=PASS:password] [- -pass=FILE:path] [- -pass=PROMPT] [- -encryption-type=enctype] [- -content-type=oid] [- -content-info] [- -allow-weak-crypto] in-file out-file
hxtool verify [- -pass=PASS:password] [- -pass=FILE:path] [- -pass=PROMPT] [- -allow-proxy-certificate] [- -missing-revoke] [- -time=value] [-v | - -verbose] [- -max-depth=value] [- -hostname=value] cert:foo chain:cert1 chain:cert2 anchor:anchor1 anchor:anchor2
hxtool print [- -pass=PASS:password] [- -pass=FILE:path] [- -pass=PROMPT] [- -content] [- -raw-json] [- -never-fail] [- -info] certificate ...
hxtool validate [- -pass=PASS:password] [- -pass=FILE:path] [- -pass=PROMPT] certificate ...
hxtool certificate-copy [- -in-pass=PASS:password] [- -in-pass=FILE:path] [- -in-pass=PROMPT] [- -out-pass=PASS:password] [- -out-pass=FILE:path] [- -out-pass=PROMPT] [- -append] [- -root-certs] [- -private-keys] in-certificates-1 ... out-certificate
hxtool ocsp-fetch [- -pass=PASS:password] [- -pass=FILE:path] [- -pass=PROMPT] [- -sign=certificate] [- -url-path=url] [- -nonce] [- -pool=certificate-store] outfile certs ...
hxtool ocsp-verify [- -ocsp-file=value] certificates ...
hxtool ocsp-print [- -verbose] ocsp-response-file ...
hxtool revoke-print [- -verbose] ocsp/crl files
hxtool generate-key [- -type=value] [- -key-bits=value] [- -verbose] output-file
hxtool request-create [- -ca] [- -ca-path-length=value] [- -ee] [- -subject=value] [- -eku=oid-string] [- -email=value] [- -jid=value] [- -dnsname=value] [- -kerberos=value] [- -ms-kerberos=value] [- -registered=value] [- -dn=value] [- -type=value] [- -key=value] [- -generate-key=value] [- -key-bits=value] [- -verbose] output-file
hxtool request-print [- -verbose] requests ...
hxtool query [- -exact] [- -private-key] [- -friendlyname=name] [- -eku=oid-string] [- -expr=expression] [- -keyEncipherment] [- -digitalSignature] [- -print] [- -pass=PASS:password] [- -pass=FILE:path] [- -pass=PROMPT] certificates ...
hxtool info
hxtool random-data bytes
hxtool crypto-available [- -type=value] [- -oid-syms]
hxtool crypto-select [- -type=value] [- -certificate=value] [- -peer-cmstype=value] [- -oid-sym]
hxtool hex [-d | - -decode]
hxtool certificate-sign [- -issue-ca] [- -issue-proxy] [- -domain-controller] [- -subject=value] [- -ca-certificate=value] [- -self-signed] [- -ca-private-key=value] [- -certificate=value] [- -type=value] [- -lifetime=value] [- -signature-algorithm=value] [- -serial-number=value] [- -path-length=value] [- -eku=oid-string] [- -ku=value] [- -hostname=value] [- -dnssrv=value] [- -email=value] [- -pk-init-principal=value] [- -ms-upn=value] [- -jid=value] [- -permanent-id=value] [- -hardware-module-name=value] [- -policy=value] [- -policy-mapping=value] [- -pkinit-max-life=value] [- -req=value] [- -certificate-private-key=value] [- -generate-key=value] [- -key-bits=value] [- -crl-uri=value] [- -template-certificate=value] [- -template-fields=value]
hxtool test-crypto [- -pass=PASS:password] [- -pass=FILE:path] [- -pass=PROMPT] [- -verbose] certificates...
hxtool statistic-print [- -type=value]
hxtool crl-sign [- -signer=value] [- -pass=PASS:password] [- -pass=FILE:path] [- -pass=PROMPT] [- -crl-file=value] [- -lifetime=value] certificates...
hxtool acert [-v | - -verbose] [- -end-entity] [- -ca] [- -cert-num=value] [- -expr=expression] [-M EMAIL | - -has-email-san=EMAIL] [-X jabber-address | - -has-xmpp-san=jabber-address] -Op Fl U Ar UPN | Fl Fl has-ms-upn-san Ns = Ns Ar UPN [-D FQDN | - -has-dnsname-san=FQDN] [-P PRINCIPAL | - -has-pkinit-san=PRINCIPAL] [-R OID | - -has-registeredID-san=OID] [-E OID | - -has-eku=OID] [-K key usage element | - -has-ku=key usage element] [- -exact] [-n | - -valid-now] [- -valid-at=datetime] [- -not-after-eq=datetime] [- -not-after-lt=datetime] [- -not-after-gt=datetime] [- -not-before-eq=datetime] [- -not-before-lt=datetime] [- -not-before-gt=datetime] [- -has-private-key] [- -lacks-private-key] certificate-store
hxtool jwt-sign [-a algorithm | - -algorithm=algorithm] [-k file | - -private-key=file] [-i issuer | - -issuer=issuer] [-s subject | - -subject=subject] [-A audience | - -audience=audience] [-l seconds | - -lifetime=seconds] [-o file | - -output=file]
hxtool jwt-verify [-k file | - -public-key=file] [-A audience | - -audience=audience] [-t token | - -token=token]
hxtool pem-to-jwk [-i file | - -input=file] [-o file | - -output=file] file ... [pem-file]
hxtool help file ... [command]

DESCRIPTION
hxtool is a command-line utility for making certificate signing requests (CSRs), displaying CSRs, displaying certificates, signing certificates, validating certificates, managing certificate revocation lists (CRLs), etc.

Every sub-command has its own help message, shown when invoked with the - -help or -h option.

Many sub-commands' command-line options refer to certificate and private key stores, supporting DER, PEM, and PKCS#12 files, as well as PKCS#11 hard and soft tokens, and others certificate stores. See CERTIFICATE STORES below for how to refer to certificates and private keys.

The - -pass=PASS:password, - -pass=FILE:path, and - -pass=PROMPT options are for specifying passwords for PKCS#8 (PEM) and PKCS#12 stores, and if needed and not given, will be prompted for. Note that it's not secure to pass passwords as command-line arguments on multi-tenant systems. For PKCS#11 stores the details of how a PIN is provided varies by OpenSSL provider. See CERTIFICATE STORES for details of how to specify PINs for PKCS#11 tokens.

The - -openssl-cnf=file option is for specifying an alternative OpenSSL configuration file, which can be useful for enabling FIPS or PKCS#11 providers for this program but not by default for all programs. The - -openssl-propq=propq option is for specifying OpenSSL property queries. See property(7).

SUPPORTED COMMANDS

list-oids
    List known OIDs.

cms-create-sd, cms-sign
    Wrap a file within a SignedData object.

cms-verify-sd
    Verify a file within a SignedData object.

cms-unenvelope
    Unenvelope a file containing an EnvelopedData object.

cms-envelope
    Envelope a file containing an EnvelopedData object.

verify
    Verify a certificate and its certification path up to a trust anchor, possibly checking CRLs.

print
    Print a human-readable rendering of certificates in a store. See CERTIFICATE STORES.

validate
    Validate content of a certificate (but not a full chain).

certificate-copy, cc
    Copy certificates and possibly private keys from one store to another. See CERTIFICATE STORES.

ocsp-fetch
    Fetch OCSP responses for the given certificates.

ocsp-verify
    Verify that certificates are in OCSP file and valid.

ocsp-print
    Print a human-readable rendering of OCSP responses.

revoke-print
    Print a human-readable rendering of a CRL or OCSP response chain.

generate-key
    Generate a private key.

request-create
    Create a CRMF or PKCS#10 request (CSR).

request-print
    Print a human-readable rendering of a CSR.

query
    Query a certificate store for matching certificates.

info
    Print information about supported algorithms.

random-data
    Generate random bytes and print them to standard output.

crypto-available
    Print available CMS crypto types.

crypto-select
    Print selected CMS type based on peer capabilities.

hex Hex-encode or decode input.

certificate-sign, cert-sign, issue-certificate, ca
    Issue a certificate, signing it with a Certification Authority (CA) certificate, or self-signing it. This can issue End Entity (EE), intermediate Certification Authority (CA), and root (self-signed) CA certificates.

test-crypto
    Test crypto system related to the certificates.

statistic-print
    Print statistics.

crl-sign
    Create or update a CRL.

acert
    Assert certificate content (for testing).

jwt-sign
    Create a signed JWT. This is used mainly for testing — this is not intended for implementing a security token service (STS). Users who wish to implement an STS should use hx509_jws_sign(3).

jwt-verify
    Verify a JWT and print claims. This is used mainly for testing — this is not intended for implementing Bearer token acceptors. Users who wish to implement Bearer token acceptors should use hx509_jws_verify(3).

pem-to-jwk
    Convert PEM key to JWK format.

help,?
    Show help.

Other sub-commands reported by the help sub-command are not stable or fully supported at this time.

COMMAND OPTIONS

  list-oids
List known OIDs.

  cms-create-sd
Wrap a file within a CMS SignedData object.
-c certificate-store, - -certificate=certificate-store
    Certificate stores to pull certificates from.
-s signer-friendly-name, - -signer=signer-friendly-name
    Certificate to sign with.
- -anchors=certificate-store
    Trust anchors.
- -pool=certificate-pool
    Certificate store to pull certificates from.
- -pass=PASS:password
- -pass=FILE:path
- -pass=PROMPT
- -peer-alg=oid
    OID that the peer supports.
- -content-type=oid
    Content type OID.
- -content-info
    Wrap output data in a ContentInfo.
- -pem
    Wrap output data in PEM armor.
- -detached-signature
    Create a detached signature.
- -signer
    Do not sign.
- -id-by-name
    Use subject name for CMS Identifier.
- -embedded-certs
    Don't embed certificates.
- -embed-leaf-only
    Only embed leaf certificate.

  cms-verify-sd
Verify a file within a CMS SignedData object.
-D certificate-store, - -anchors=certificate-store
    Trust anchors.
-c certificate-store, - -certificate=certificate-store
    Certificate store to pull certificates from. [- -pass=PASS:password] [- -pass=FILE:path] [- -pass=PROMPT]
- -missing-revoke
    Missing CRL/OCSP is ok.
- -content-info
    Unwrap input data that's in a ContentInfo.
- -pem
    Unwrap input data from PEM armor.
- -signer-allowed
    Allow no signer.
- -allow-wrong-oid
    Allow wrong OID flag.
- -signed-content=value
    File containing content.
- -oid-sym
    Show symbolic name for OID.

  cms-unenvelope
Unenvelope a file containing an EnvelopedData object.
-c certificate-store, - -certificate=certificate-store
    Certificate used to decrypt the data. [- -pass=PASS:password] [- -pass=FILE:path] [- -pass=PROMPT]
- -content-info
    Wrapped output data in a ContentInfo.
- -allow-weak-crypto
    Allow weak crypto.

  cms-envelope
Envelope a file as an EnvelopedData object.
-c certificate-store, - -certificate=certificate-store
    Certificates used to receive the data. [- -pass=PASS:password] [- -pass=FILE:path] [- -pass=PROMPT]
- -encryption-type=enctype
    Encryption type.
- -content-type=oid
    Content type OID.
- -content-info
    Wrap output data in a ContentInfo.
- -allow-weak-crypto
    Allow weak crypto.

  verify
Verify certificate chain.
[- -pass=PASS:password] [- -pass=PROMPT] Password.
- -allow-proxy-certificate
    Allow proxy certificates.
- -missing-revoke
    Missing CRL/OCSP is ok.
- -time=value
    Time when to validate the chain.
-v, - -verbose
    Verbose logging.
- -max-depth=value
    Maximum search length of certificate trust anchor.
- -hostname=value
    Match hostname to certificate.

  print
Print certificates.
[- -pass=PASS:password] [- -pass=FILE:path] [- -pass=PROMPT] Password.
- -content
    Print the content of the certificates.
- -raw-json
    Print the DER content of the certificates as JSON.
- -never-fail
    Never fail with an error code.
- -info
    Print information about the certificate store.

The - -raw-json option prints the certificate(s) in the given store as a JSON dump of their DER using an experimental (i.e., unstable) schema.

  validate
Validate content of certificates.
- -pass=password
    Password, prompter, or environment.

  certificate-copy
Copy certificates and keys from one store to another.
- -in-pass=password
    Password, prompter, or environment for input store.
- -out-pass=password
    Password, prompter, or environment for output store.
- -append
    Append source to destination.
- -root-certs
    Do not copy root certificates.
- -private-keys
    Do not copy private keys.

Use the certificate-copy command to copy certificates from one store to another. This is useful for, e.g., converting DER files to PEM or vice-versa, removing private keys, adding certificate chains, and removing root certificates from chains.

  ocsp-fetch
Fetch OCSP responses for the given certificates.
- -pass=password
    Password, prompter, or environment.
- -sign=certificate
    Certificate used to sign the request.
- -url-path=url
    Part after host in URL to put in the request.
- -nonce
    Don't include nonce in request.
- -pool=certificate-store
    Pool to find parent certificate in.

  ocsp-verify
Verify OCSP responses.
- -ocsp-file=value
    OCSP file.

  ocsp-print
Print OCSP responses.
- -verbose
    Verbose output.

  revoke-print
Print OCSP/CRL files.
- -verbose
    Verbose output.

  generate-key
Generate a private key.
- -type=value
    Key type.
- -key-bits=value
    Number of bits in the generated key.
- -verbose
    Verbose status.

  request-create
Create a CRMF or PKCS#10 request.
- -ca
    Request CA certificate.
- -ca-path-length=value
    Path length constraint for CA certificate.
- -ee
    Include BasicConstraints with cA set to false.
- -subject=value
    Subject DN.
- -eku=oid-string
    Add Extended Key Usage OID.
- -email=value
    Email address in SubjectAltName.
- -jid=value
    XMPP (Jabber) address in SubjectAltName.
- -dnsname=value
    Hostname or domainname in SubjectAltName.
- -kerberos=value
    Kerberos principal name as SubjectAltName.
- -ms-kerberos=value
    Kerberos principal name as SubjectAltName (Microsoft variant).
- -registered=value
    Registered object ID as SubjectAltName.
- -dn=value
    Directory name as SubjectAltName.
- -type=value
    Type of request CRMF or PKCS10, defaults to PKCS10.
- -key=value
    Key-pair.
- -generate-key=value
    Key type.
- -key-bits=value
    Number of bits in the generated key.
- -verbose
    Verbose status.

  request-print
Print requests.
- -verbose
    Verbose printing.

  query
Query certificates for a match.
- -exact
    Exact match.
- -private-key
    Search for private key.
- -friendlyname=name
    Match on friendly name.
- -eku=oid-string
    Match on EKU.
- -expr=expression
    Match on expression.
- -keyEncipherment
    Match keyEncipherment certificates.
- -digitalSignature
    Match digitalSignature certificates.
- -print
    Print matches.
- -pass=password
    Password, prompter, or environment.

  info
Print information about supported algorithms.

  random-data
Generate random bytes and print them to standard output.

  crypto-available
Print available CMS crypto types.
- -type=value
    Type of CMS algorithm.
- -oid-syms
    Show symbolic names for OIDs.

  crypto-select
Print selected CMS type.
- -type=value
    Type of CMS algorithm.
- -certificate=value
    Source certificate limiting the choices.
- -peer-cmstype=value
    Peer limiting CMS types.
- -oid-sym
    Show symbolic name for OID.

  hex
Encode input to hex.
-d, - -decode
    Decode instead of encode.

  certificate-sign , Ss cert-sign , Ss issue-certificate , Ss ca
Issue a certificate, signing it with a Certification Authority (CA) certificate, or self-signing it. This can issue End Entity (EE), intermediate Certification Authority (CA), and root (self-signed) CA certificates. This command is intended to be used to operate a CA.
- -issue-ca
    Issue a CA certificate. If this option is not used then an EE certificate will be issued.
- -issue-proxy
    Issue a proxy certificate.
- -ca-certificate=value
    The certificate of the CA that will sign the certificate to be issued. For example, - -ca-private-key=PEM-FILE:/path/to/file, - -ca-private-key=DER-FILE:/path/to/file, - -ca-private-key=PKCS12:/path/to/file.
- -self-signed
    Issue a self-signed certificate.
- -ca-private-key=value
    Private key for the signer of the certificate. This is a CA's private key when - -self-signed is not used, or a proxy signer if - -issue-proxy is used. For example, - -ca-private-key=PEM-FILE:/path/to/file, - -ca-private-key=DER-FILE:/path/to/file, - -ca-private-key=PKCS12:/path/to/file, - -ca-private-key=PKCS11:<pkcs11 scheme URI>. See CERTIFICATE STORES for more details.
- -req=value
    A certificate signing request (CSR). For example, - -req=PKCS10:/path/to/file where the file contains a DER-encoded PKCS#10 CertificationRequest. Note that extensions requested by the CSR are ignored, though you can view the CSR's requested extensions with the hxtool request-print command.
- -type=value
    Types of certificate to issue (can be used more than once). Available types:

    https-server
        Issue a certificate suitable for an HTTPS server (because it has the ‘id-kp-serverAuth’ Extended Key Usage (EKU) object identifier (OID)).

    https-client
        Issue a certificate suitable for an HTTPS client (because it has the ‘id-kp-clientAuth’ EKU).

    email-client
        Issue a certificate suitable for SUBMIT, IMAP, and S/MIME (because it has the ‘id-kp-emailProtection’ EKU).

    pkinit-client
        Issue a certificate suitable for a PKINIT client user (because it has the ‘id-pkinit-KPClientAuth’, ‘id-kp-clientAuth’, and ‘id-pkinit-ms-eku’, EKUs).

    pkinit-kdc
        Issue a certificate suitable for a KDC (for PKINIT) (because it has the ‘id-pkinig-keyPurposeKdc’ EKU).
- -certificate=value
    Where to write the certificate to be issued. See - -ca-certificate=value.
- -generate-key=value
    Generate a private key of the given type whose public key will be the subject public key (SPK) of the certificate to be issued.
- -key-bits=value
    Number of bits in the generated key. Use this when using - -generate-key=rsa.
- -certificate-private-key=value
    Where to store the private key, if - -generate-key=value is given, or where to read the private key from. See - -ca-private-key=value.
- -template-certificate=value
    Use the given certificate as a template. See - -ca-certificate=value.
- -template-fields=value
    This option can be given multiple times, each one having one of the following values indicating that an item from the
- -crl-uri=value
    URI to certificate revocation list (CRL). This will be included in the certificate to be issued, and will be used by relying parties to check the revocation status of the issued certificate.
- -policy=value
    Certificate Policy OID and optional URI and/or notice (OID:URI<space>notice_text).
- -policy-mapping=value
    Certificate Policy mapping (OID:OID).
- -template-certificate=value
    certificate is to be used as part of the template:

    ExtendedKeyUsage
        I.e., include the EKU OIDs from the template certificate in the certificate to be issued.

    KeyUsage
        I.e., include the KUs from the template certificate in the certificate to be issued.

    SPKI
        This is useful for issuing additional certificates for the same subject public key of an existing certificate.

    notBefore

    notAfter
        These copy the corresponding certificate constraints from the template. (These are not useful. A future version will add a template field value for certificate lifetime where by the difference between notAfter and notBefore will be used to set the new certificate's notAfter.)

    pkinitMaxLife
        Take the PKINIT ticket max life extension value from the template certificate.

    subject
        Take the subject name from the template certificate.
- -lifetime=value
    Lifetime of to-be-issued certificate.
- -serial-number=value
    Serial number of certificate. (Do not use. Allow the CA to choose the serial number randomly instead.)
- -subject=value
    Subject name of issued certificate. The subject name can and should be left empty when subject alternative names are included in the certificate.
- -eku=oid-string
    Add a given Extended Key Usage (EKU) OID. Note that the - -type -=TYPE option allows for certain EKU OIDs to be added without having to name them. OIDs can be referenced by name, such as “id-pkix-kp-serverAuth” or as a sequence of numeric arcs separated by spaces or periods. E.g., - -eku=id-pkix-kp-serverAuth, - -eku=1.2.3.4.5.6.
- -ku=value
    Key Usage (digitalSignature, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly).
- -signature-algorithm=value
    Signature algorithm to use.
- -path-length=value
    Maximum path length (CA and proxy certificates); use -1 for no limit.
- -hostname=value
    Adds a dNSName subject alternative name (SAN) to the certificate to be issued. These are the DNS names this certificate is allowed to serve.
- -dnssrv=value
    Adds a DNS SRV SAN to the certificate to be issued. These are the DNS SRV names this certificate is allowed to serve.
- -email=value
    Adds an rfc8222Name SAN to the certificate to be issued. These are the email addresses assigned to this certificate, which can be used for authorization in email-related protocols such as SUBMIT, IMAP, and S/MIME.
- -pk-init-principal=PRINCIPAL-NAME
    Adds a Kerberos principal name SAN to the certificate to be issued. For - -type=pkinit-client certificates these are the client principals the certificate holder can use to get tickets for using PKINIT. For - -type=pkinit-kdc certificates these are the service principals (typically ‘krbtgt’ principals) the certificate holder can be a Kerberos Authentication Service (AS) for when using PKINIT.
- -pkinit-max-life=value
    Maximum Kerberos ticket lifetime extension for PKINIT. This is a Heimdal-specific certificate extension with OID id-heim-ce-pkinit-princ-max-life / 1.2.752.43.16.4 whose value is a DER-encoded INTEGER count of seconds ranging from 0 to 4294967295. Kerberos KDCs that support this extension will bound the lifetime of any tickets issued to the client to be no more than the lifetime in this extension (note that the KDC may further restrict the lifetime).
- -ms-upn=UPN
    Adds a Microsoft user principal name (UPN) SAN to the certificate to be issued. These are UPNs that the certificate holder can use to get tickets for using PKINIT.
- -jid=value
    Adds an XMPP / Jabber ID SAN to the certificate to be issued. These are the names that the certificate holder can use when connected to XMPP / Jabber instant messaging.
- -permanent-id=value
    PermanentIdentifier ([oid]:[serial]).
- -hardware-module-name=value
    HardwareModuleName (oid:serial).
- -domain-controller
    Issue a certificate suitable for authenticating an Active Directory domain controller.

  test-crypto
Test crypto system related to the certificates.
- -pass=password
    Password, prompter, or environment.
- -verbose
    Verbose printing.

  statistic-print
Print statistics.
- -type=value
    Type of statistics.

  crl-sign
Create a CRL.
- -signer=value
    Signer certificate.
- -pass=password
    Password, prompter, or environment.
- -crl-file=value
    CRL output file.
- -lifetime=value
    Time the CRL will be valid.

  acert
Assert certificate content.
-v, - -verbose
    Verbose output.
- -end-entity
    Check the first EE certificate in the store.
- -ca
    Check the first CA certificate in the store.
- -cert-num=value
    Check the nth certificate in the store.
- -expr=expression
    Test the first certificate matching expression.
-M email-address, - -has-email-san=email-address
    Check that cert has email SAN.
-X jabber address, - -has-xmpp-san=jabber address
    Check that cert has XMPP SAN.
-U UPN, - -has-ms-upn-san=UPN
    Check that cert has UPN SAN.
-D domainname, - -has-dnsname-san=domainname
    Check that cert has domainname SAN.
-P Kerberos principal name, - -has-pkinit-san=Kerberos principal name
    Check that cert has PKINIT SAN.
-R OID, - -has-registeredID-san=OID
    Check that cert has registeredID SAN.
-E OID, - -has-eku=OID
    Check that cert has EKU.
-K key usage element, - -has-ku=key usage element
    Check that cert has key usage.
- -exact
    Check that cert has only given SANs/EKUs/KUs.
-n, - -valid-now
    Check that current time is in certificate's validity period.
- -valid-at=datetime
    Check that the certificate is valid at given time.
- -not-after-eq=datetime
    Check that the certificate's notAfter is as given.
- -not-after-lt=datetime
    Check that the certificate's notAfter is before the given time.
- -not-after-gt=datetime
    Check that the certificate's notAfter is after the given time.
- -not-before-eq=datetime
    Check that the certificate's notBefore is as given.
- -not-before-lt=datetime
    Check that the certificate's notBefore is before the given time.
- -not-before-gt=datetime
    Check that the certificate's notBefore is after the given time.
- -has-private-key
    Check that the certificate has a private key.
- -lacks-private-key
    Check that the certificate does not have a private key.

  jwt-sign
Create a signed JWT.
-a algorithm, - -algorithm=algorithm
    Signature algorithm (RS256, ES256, EdDSA, etc.).
-k file, - -private-key=file
    Private key file (PEM format).
-i issuer, - -issuer=issuer
    Issuer claim (iss).
-s subject, - -subject=subject
    Subject claim (sub).
-A audience, - -audience=audience
    Audience claim (aud).
-l seconds, - -lifetime=seconds
    Token lifetime in seconds.
-o file, - -output=file
    Output file (default: stdout).

  jwt-verify
Verify a JWT and print claims.
-k file, - -public-key=file
    Public key file(s) (PEM format).
-A audience, - -audience=audience
    Required audience.
-t token, - -token=token
    JWT token (or read from stdin).

  pem-to-jwk
Convert PEM key to JWK format.
-i file, - -input=file
    PEM key file.
-o file, - -output=file
    Output file (default: stdout).

  help
Show help.

CERTIFICATE STORES
Stores of certificates and/or keys have string names that can be used with hxtool's commands as well as in various configuration parameters and command-line arguments of Heimdal's Kerberos implementation (for PKINIT).

For example, ‘FILE:/path/to/file’, ‘PEM-FILE:/path/to/file’, ‘DER-FILE:/path/to/file’, etc. See below for a full list of store types.

A certificate store name starts with a store TYPE followed by a colon followed by a name of form specific to that store type.

Private keys can be stored in the same stores as the certificates that certify their public keys.

Private keys can also be stored in separate files, but still be referenced in one certificate store name by joining two with a comma: ‘FILE:/path/to/certificate,/path/to/private/key’

Heimdal supports a variety of certificate and private key store types:

PEM-FILE:/path
    If writing, PEM will be written (private keys may be written in algorithm-specific formats or in PKCS#8). If reading, PEM will be expected (private keys may be in algorithm-specific formats or in PKCS#8).

DER-FILE:/path
    If writing, DER will be written. If reading, DER will be expected. Private keys will be in algorithm-specific formats.

FILE:/path
    If writing, PEM will be written as if ‘PEM-FILE’ had been used. If reading, PEM or DER will be detected and read as if ‘PEM-FILE’ or ‘DER-FILE’ had been used.

PKCS12:/path
    If writing, PKCS#12 will be written. If reading, PKCS#12 will be expected. Note that PKCS#12 support is currently very limited.

DIR:/path
    OpenSSL-style hashed directory of trust anchors.

KEYCHAIN:system-anchors
    On OS X this refers to the system's trust anchors.

KEYCHAIN:FILE:/path
    On OS X this refers to an OS X keychain at the given path.

PKCS11:<provider-specific>[,config=/path-to-openssl.cnf]
    Loads the given PKCS#11 object using the configured OpenSSL provider. When using the Latchset OpenSSL PKCS#11 provider, https://github.com/latchset/pkcs11-provider, for example, then <provider-specific> identifier is a PKCS#11 URI (see RFC 7512). Examples:

    PKCS11:pkcs11:token=MyToken

    PKCS11:pkcs11:slot-id=0;object=MyCert

    PKCS11:pkcs11:token=SmartCard,config=/etc/op11.cnf
    The config=PATH option is Heimdal-specific and not part of the PKCS#11 URI. Use the config=PATH option to refer to an OpenSSL configuration other than the default, such as when you want to configure the PKCS#11 provider but not enable it by default. The OpenSSL configuration file path must not contain a comma.

    Note that hxtool will not itself prompt for PINs with which to unlock tokens, however OpenSSL providers that use PKCS#11 URIs can take the PIN from the “pin-value” attribute or obtain the PIN from the “pin-source” attribute (which allows one to specify a file or a program to execute which might then prompt). See RFC 7512.

NULL:
    An empty store.

MEMORY:name
    An in-memory only, ephemeral store, usually not used in hxtool's commands. The MEMORY store name exists primarily for internal ‘hx509’ APIs.

EXAMPLES
Generate an RSA key:

    hxtool generate-key --type=rsa --key-bits=4096 PEM-FILE:key.pem

Create a CSR (with an empty name) for some key:

    hxtool request-create --subject= --key=FILE:key.pem csr.der

Generate a key and create a CSR (with an empty name) for it:

    hxtool request-create       \
    	--subject=          \
    	--generate-key=rsa  \
    	--key-bits=4096     \
    	--key=FILE:key.pem  \
    	csr.der

Generate a key and create a CSR with an empty name but also requesting a specific dNSName subject alternative name (SAN) for it:

    hxtool request-create               \
    	--subject=                  \
    	--generate-key=rsa          \
    	--dnsname=foo.test.h5l.se   \
    	--key=FILE:key.pem          \
    	csr.der

Print a CSR:

    hxtool request-print csr.der

which outputs:

    request print
    PKCS#10 CertificationRequest:
      name:
        san: dNSName: foo.test.h5l.se

Issue an end-entity certificate for an HTTPS server given a CSR:

    hxtool issue-certificate                            \
    	--type=https-server                         \
    	--subject=                                  \
    	--hostname=foo.test.h5l.se                  \
    	--ca-certificate=FILE:cacert.pem            \
    	--ca-private-key=FILE:cakey.pem             \
    	--req=PKCS10:csr.der                        \
    	--certificate=PEM-FILE:ee.pem

Add a chain to a PEM file:

    hxtool certificate-copy     \
    	--no-private-keys   \
    	--no-root-certs     \
    	FILE:ca.pem FILE:ee.pem

Create a self-signed end-entity certificate for an HTTPS server:

    hxtool issue-certificate                        \
    	--self-signed                           \
    	--type=https-server                     \
    	--subject=                              \
    	--hostname=foo.test.h5l.se              \
    	--ca-private-key=FILE:key.pem           \
    	--certificate-private-key=FILE:key.pem  \
    	--certificate=PEM-FILE:cert.pem

Create a root certification authority certificate:

    hxtool issue-certificate                            \
    	--issue-ca                                  \
    	--self-signed                               \
    	--subject=CN=SomeRootCA                     \
    	--ca-private-key=FILE:rootkey.pem           \
    	--certificate=PEM-FILE:rootcert.pem

Create an intermediate certification authority certificate from a CSR:

    hxtool issue-certificate                            \
    	--type=https-server                         \
    	--subject=CN=SomeIntermediateCA             \
    	--ca-certificate=FILE:parent-cert.pem       \
    	--ca-private-key=FILE:parent-key.pem        \
    	--req=PKCS10:csr.der                        \
    	--certificate=PEM-FILE:intermediate.pem

SEE ALSO
openssl(1), property(7)