CLI Reference - Certificates

SSH certificates

get-ssh-certificate

Generates SSH certificate.

Please note: mandatory values for this command: -s , --cert-username , -c, --cert-issuer-name

Usage

akeyless get-ssh-certificate --cert-username <Username to sign> \
--cert-issuer-name <he name of the SSH certificate issuer> \
--public-key-file-path <path/to/SSH public key> \
--public-key-data <key file contents>

Parameters

Parameter	Description
`-s, --cert-username`	(Mandatory) The username to sign in the SSH certificate (use a comma-separated list for more than one username)
`-c, --cert-issuer-name`	(Mandatory) The name of the SSH certificate issuer
`-p, --public-key-file-path`	SSH public key
`-o, --outfile`	Output file path with the certificate. If not provided, and public-key-file-path used, the file with the certificate will be created in the same location of the provided public key with the -cert extension
`--public-key-data`	SSH public key file contents. If this option is used, the certificate will be printed to stdout
`-t, --ttl`	Updated certificate lifetime in seconds (must be less than the Certificate Issuer default TTL)
`--legacy-signing-alg-name[=false]`	Set this option to output legacy ('[email protected]') signing algorithm name in the certificate.
`--profile, --token`	Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token
`--uid-token`	The universal identity token, Required only for universal_identity authentication

create-ssh-cert-issuer

Creates a new SSH certificate issuer.

Please note: mandatory values for this command: -n, --name, -s, --signer-key-name , -a, --allowed-users, -t, --ttl

Usage

akeyless create-ssh-cert-issuer --name <SSH certificate issuer name> \
--signer-key-name <A key to sign the certificate with> \
--allowed-users <Users allowed to fetch the certificate, e.g root, ubuntu> \
--ttl <The requested Time To Live for the certificate, in seconds>

Parameters

Parameter	Description
`-n, --name`	(Mandatory) SSH certificate issuer name
`-s, --signer-key-name`	(Mandatory) A key to sign the certificate with
`-a, --allowed-users`	(Mandatory) Users allowed to fetch the certificate, e.g root, ubuntu
`-t, --ttl`	(Mandatory) The requested Time To Live for the certificate, in seconds
`-p, --principals`	Signed certificates with principal, e.g example_role1,example_role2
`-x, --extensions`	Signed certificates with extensions, e.g permit-port-forwarding=""
`-m, --metadata`	A metadata about the issuer
`--secure-access-enable`	Enable/Disable secure remote access, [true/false]
`--secure-access-bastion-api`	Bastion's SSH control API endpoint. E.g. https://my.bastion:9900
`--secure-access-bastion-ssh`	Bastion's SSH server. E.g. my.bastion:22
`--secure-access-ssh-creds-user`	SSH username to connect to target server, must be in 'Allowed Users' list
`--secure-access-host`	Target servers for connections., For multiple values repeat this flag.
`--secure-access-use-internal-bastion`	Use internal SSH Bastion - Relevant only for Secure Remote Access Deployment, mostly when using Dockers. Set the relevant IP address of the SSH Bastion for internal communication between ZT and SSH bastions.
`--delete-protection`	Protection from accidental deletion of this item, [true/false]
`--profile, --token`	Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token
`--uid-token`	The universal identity token, Required only for universal_identity authentication

update-ssh-cert-issuer

Updates a new SSH certificate issuer

Please note: mandatory values for this command: -n, --name, -s, --signer-key-name, -a, --allowed-users, -t, --ttl

Usage

akeyless update-ssh-cert-issuer --name <SSH cert issuer name> \
--signer-key-name <A key to sign the certificate with> \
--allowed-users <Users allowed to fetch the certificate, e.g root,ubuntu>\
--ttl <The requested Time To Live for the certificate, in seconds>

Parameters

Parameter	Description
`-n, --name`	(Mandatory) SSH certificate issuer name
`--new-name`	New item name
`-s, --signer-key-name`	(Mandatory) A key to sign the certificate with
`-a, --allowed-users`	(Mandatory) Users allowed to fetch the certificate, e.g root,ubuntu
`-t, --ttl`	(Mandatory) The requested Time To Live for the certificate, in seconds
`-p, --principals`	Signed certificates with principal, e.g example_role1,example_role2
`-x, --extensions`	Signed certificates with extensions, e.g permit-port-forwarding=""
`-m, --metadata`	A metadata about the issuer
`--add-tag`	List of the new tags that will be attached to this item. To specify multiple tags use argument multiple times: --add-tag Tag1 --add-tag Tag2
`--rm-tag`	List of the existent tags that will be removed from this item. To specify multiple tags use argument multiple times: --rm-tag Tag1 --rm-tag Tag2
`--secure-access-enable`	Enable/Disable secure remote access, [true/false]
`--secure-access-bastion-api`	Bastion's SSH control API endpoint. E.g. https://my.bastion:9900
`--secure-access-bastion-ssh`	Bastion's SSH server. E.g. my.bastion:22
`--secure-access-ssh-creds-user`	SSH username to connect to target server, must be in 'Allowed Users' list
`--secure-access-host`	Target servers for connections., For multiple values repeat this flag
`--secure-access-use-internal-bastion`	Use internal SSH Bastion
`--profile, --token`	Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token
`--uid-token`	The universal identity token, Required only for universal_identity authentication

PKI certificates

get-pki-certificate

Generates PKI certificate

Please note: mandatory values for this command: -c, --cert-issuer-name

Usage

akeyless get-pki-certificate --cert-issuer-name <name of PKI issuer> \
--key-file-path <client Public or Private Key> \
--ttl <Updated certificate lifetime in seconds> 
--alt-names <The Subject Alternative Names to be included in the PKI certificate>

Parameters

Parameter	Description
`-c, --cert-issuer-name`	(Mandatory) The name of the PKI certificate issuer.
`-k, --key-file-path`	The client public or private key file path (in case of a private key, it will be use to extract the public key)
`--key-data-base64`	pki key file contents encoded using Base64. If this option is used, the certificate will be printed to stdout
`--csr-file-path`	Path to Certificate Signing Request file to generate the certificate with
`--csr-data-base64`	Certificate Signing Request contents encoded in base64 to generate the certificate with (if csr-file-path is provided this flag is ignored)
`--common-name`	The common name to be included in the PKI certificate
`--alt-names`	The Subject Alternative Names to be included in the PKI certificate (in a comma-delimited list)
`--uri-sans`	The URI Subject Alternative Names to be included in the PKI certificate (in a comma-delimited list)
`-t, --ttl`	Updated certificate lifetime in seconds (must be less than the Certificate Issuer default TTL)
`-e, --extended-key-usage`	A comma-separated list of extended key usage requests which will be used for certificate issuance. Supported values: 'clientauth', 'serverauth'.
`-o, --outfile`	Output file path with the certificate. If not provided, the file with the certificate will be created in the same location of the provided public key with the -cert extension
`--profile, --token`	Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token
`--uid-token`	The universal identity token, Required only for universal_identity authentication

create-pki-cert-issuer

Creates a new PKI certificate issuer.

Please note: mandatory values for this command: -n, --name, -s, --signer-key-name, -t, --ttl

Usage

akeyless create-pki-cert-issuer --name <PKI issuer name> \
--signer-key-name <A key to sign the certificate with> \
--ttl <The requested Time To Live for the certificate, in seconds> \
--allowed-domains <Allowed domains that clients can request to be included in the certificate> \
--allow-any-name <If set, clients can request certificates for any CN>

Parameters

Parameter	Description
`-n, --name`	(Mandatory) PKI certificate issuer name
`-s, --signer-key-name`	(Mandatory) A key to sign the certificate with
`-t, --ttl`	(Mandatory) The requested Time To Live for the certificate, in seconds
`--ca-target`	The name of an existing CA target to attach this PKI Certificate Issuer to, required in Public CA mode
`--gw-cluster-url`	The GW cluster URL to issue the certificate from, required in Public CA mode
`--allowed-domains`	A list of the allowed domains that clients can request to be included in the certificate (in a comma-delimited list)
`--destination-path`	A path in Akeyless which to save generated certificates
`--allowed-uri-sans`	A list of the allowed URIs that clients can request to be included in the certificate as part of the URI Subject Alternative Names (in a comma-delimited list)
`--allow-subdomains`	If set, clients can request certificates for subdomains and wildcard subdomains of the allowed domains
`--not-enforce-hostnames`	If set, any names are allowed for CN and SANs in the certificate and not only a valid host name
`--allow-any-name`	If set, clients can request certificates for any CN
`--not-require-cn`	If set, clients can request certificates without a CN.
`--server-flag`	If set, certificates will be flagged for server auth use
`--client-flag`	If set, certificates will be flagged for client auth use.
`--code-signing-flag`	If set, certificates will be flagged for code signing use.
`--key-usage[=DigitalSignature,KeyAgreement,KeyEncipherment]`	A comma-separated string or list of key usages
`-e, --expiration-event-in`	How many days before the expiration of the certificate would you like to be notified. To specify multiple events, use argument multiple times: --expiration-event-in 1 --expiration-event-in 5
`--organization-units`	A comma-separated list of organizational units (OU) that will be set in the issued certificate.
`--organizations`	A comma-separated list of organizations (O) that will be set in the issued certificate.
`--country`	A comma-separated list of the country that will be set in the issued certificate.
`--locality`	A comma-separated list of the locality that will be set in the issued certificate.
`--province`	A comma-separated list of the province that will be set in the issued certificate.
`--street-address`	A comma-separated list of the street address that will be set in the issued certificate.
`--postal-code`	A comma-separated list of the postal code that will be set in the issued certificate.
`-m, --metadata`	A metadata about the issuer
`--tag`	List of the tags attached to this key. To specify multiple tags use argument multiple times: --tag Tag1 --tag Tag2
`--delete-protection`	Protection from accidental deletion of this item, [true/false]
`--profile, --token`	Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token
`--uid-token`	The universal identity token, Required only for universal_identity authentication

update-pki-cert-issuer

Updates a new PKI certificate issuer

Please note: mandatory values for this command: -n, --name, -s, --signer-key-name, -t, --ttl

Usage

akeyless update-pki-cert-issuer --name <PKI certificate issuer name> \
--new-name <New item name>
--signer-key-name <A key to sign the certificate with> \
--ttl <The requested Time To Live for the certificate, in seconds> \ 
--allowed-domains <Allowed domains that clients can request to be included in the certificate>

Parameters

Parameter	Description
`-n, --name`	(Mandatory) PKI certificate issuer name
`--new-name`	New item name
`-s, --signer-key-name`	(Mandatory) A key to sign the certificate with
`-t, --ttl`	(Mandatory) The requested Time To Live for the certificate, in seconds
`--gw-cluster-url`	The GW cluster URL to issue the certificate from, required in Public CA mode
`--allowed-uri-sans`	A list of the allowed URIs that clients can request to be included in the certificate as part of the URI Subject Alternative Names (in a comma-delimited list)
`--allow-subdomains`	If set, clients can request certificates for subdomains and wildcard subdomains of the allowed domains
`--not-enforce-hostnames`	If set, any names are allowed for CN and SANs in the certificate and not only a valid host name
`--allow-any-name`	If set, clients can request certificates for any CN
`--not-require-cn`	If set, clients can request certificates without a CN
`--server-flag`	If set, certificates will be flagged for server auth use
`--client-flag`	If set, certificates will be flagged for client auth use
`--code-signing-flag`	If set, certificates will be flagged for code signing use
`--key-usage[=DigitalSignature, KeyAgreement, KeyEncipherment]`	A comma-separated string or list of key usages
`--organization-units`	A comma-separated list of organizational units (OU) that will be set in the issued certificate
`--organizations`	A comma-separated list of organizations (O) that will be set in the issued certificate
`--country`	A comma-separated list of the country that will be set in the issued certificate
`--locality`	A comma-separated list of the locality that will be set in the issued certificate
`--province`	A comma-separated list of the province that will be set in the issued certificate
`--street-address`	A comma-separated list of the street address that will be set in the issued certificate
`--postal-code`	A comma-separated list of the postal code that will be set in the issued certificate
`-m, --metadata`	A metadata about the issuer
`--add-tag`	List of the new tags that will be attached to this item. To specify multiple tags use argument multiple times: --add-tag Tag1 --add-tag Tag2
`--rm-tag`	List of the existent tags that will be removed from this item. To specify multiple tags use argument multiple times: --rm-tag Tag1 --rm-tag Tag2
`--profile, --token`	Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token
`--uid-token`	The universal identity token, Required only for universal_identity authentication

get-kube-exec-creds

Get credentials for authentication with Kubernetes cluster based on a PKI Cert Issuer

Please note: mandatory values for this command: -c, --cert-issuer-name

Usage

akeyless get-kube-exec-creds --cert-issuer-name <PKI cert issuer name> \
--key-file-path <The client public or private key file path> \
--alt-names <The Subject Alternative Names to be included in the PKI certificate> \ 
--ttl <Updated certificate lifetime in seconds>

Parameters

Parameter	Description
`-c, --cert-issuer-name`	(Mandatory) The name of the PKI certificate issuer.
`-k, --key-file-path`	The client public or private key file path (in case of a private key, it will be use to extract the public key)
`--key-data-base64`	pki key file contents encoded using Base64. If this option is used, the certificate will be printed to stdout
`--common-name`	The common name to be included in the PKI certificate.
`--alt-names`	The Subject Alternative Names to be included in the PKI certificate (in a comma-delimited list).
`--uri-sans`	The URI Subject Alternative Names to be included in the PKI certificate (in a comma-delimited list).
`-t, --ttl`	Updated certificate lifetime in seconds (must be less than the Certificate Issuer default TTL)
`-e, --extended-key-usage`	A comma-separated list of extended key usage requests which will be used for certificate issuance. Supported values: 'clientauth', 'serverauth'.
`-o, --outfile`	Output file path with the certificate. If not provided, the file with the certificate will be created in the same location of the provided public key with the -cert extension
`-a, --api-version[=v1]`	The version of the client authentication API
`--profile, --token`	Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token
`--uid-token`	The universal identity token, Required only for universal_identity authentication

Certificate Storage

create-certificate

Creates a new certificate to store.

Usage

akeyless create-certificate -n <certificate-name> -c <path-to-certificate-PEM/CER/CRT/PFX/P12>

Parameters

Parameter	Description
`-n, --name`	Unique Certificate name (mandatory)
`-c, --certificate`	Path to a file that contain the certificate. Supported formats are: pem,cer,crt,pfx,p12.
`--certificate-data`	Content of the certificate PEM/CER/CRT/PFX/P12 in a Base64 format. It is mandatory to add this parameter OR the `--certificate` parameter
`--format[=pem]`	Certificate Format of the certificate and private key, possible values: cer,crt,pem,pfx,p12
`--passphrase`	Passphrase to decrypt pkcs12/pks certificate data
`-p, --private-key`	Path to the file with the certificate's private key. Certificate Format should be the same as provided for the certificate
`--key-data`	Content of the certificate's private key PEM in a Base64 format. If this parameter is defined `--private-key` is disabled.
`-e, --expiration-event-in`	How many days before the expiration of the certificate would you like to be notified. To specify multiple events, use argument multiple times: --expiration-event-in 1 --expiration-event-in 5
`-k, --key`	The name of a key to use to encrypt the certificate's key' (if empty, the account default protectionKey key will be used)
`-m, --metadata`	Metadata about the certificate
`-t, --tag`	List of the tags attached to this certificate. To specify multiple tags use argument multiple times: --tag Tag1 -t Tag2
`--delete-protection`	Protection from accidental deletion of this item, [true/false]
`--profile, --token`	Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token
`--uid-token`	The universal identity token, Required only for universal_identity authentication
`-h, --help`	display help information
`--json[=false]`	Set output format to JSON
`--no-creds-cleanup[=false]`	Do not clean local temporary expired creds

get-certificate-value

This command will return the certificate's PEM, and the private key's PEM if it exists, in a JSON file.

Usage

akeyless get-certificate-value -n <certificate-name>

Parameters


`-n, --name`	Certificate name (Mandatory)
`-d, --display-id`	Certificate display ID
`--version`	Certificate version
`-c, --cert-issuer-name`	The parent PKI Certificate Issuer's name of the certificate, required when used with display-id and token
`--certificate-file-output`	File to write the certificates to
`--private-key-file-output`	File to write the private key to
`--issuance-token`	Token for getting the issued certificate
`--profile, --token`	Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token
`--uid-token`	The universal identity token, Required only for universal_identity authentication
`-h, --help`	display help information
`--json[=false]`	Set output format to JSON
`--no-creds-cleanup[=false]`	Do not clean local temporary expired creds

update-certificate-value

This command will update the data in an existing certificate.

Usage

akeyless update-certificate-value -n <certificate-name> -c <path-to-certificate-PEM/CER/CRT/PFX/P12>

Parameters

Parameter	Description
`-n, --name`	Unique Certificate name (mandatory)
`-c, --certificate`	Path to a file that contain the certificate. Supported formats are: pem,cer,crt,pfx,p12
`--certificate-data`	Content of the certificate PEM in a Base64 format. It is mandatory to add this parameter OR the `--certificate` parameter
`--format[=pem]`	Certificate Format of the certificate and private key, possible values: cer,crt,pem,pfx,p12
`--passphrase`	Passphrase to decrypt pkcs12/pks certificate data
`-p, --private-key`	Path to the file with the certificate's private key. Certificate Format should be the same as provided for the certificate
`--key-data`	Content of the certificate's private key PEM in a Base64 format. If this parameter is defined `--private-key` is disabled.
`-e, --expiration-event-in`	How many days before the expiration of the certificate would you like to be notified. To specify multiple events, use argument multiple times: --expiration-event-in 1 --expiration-event-in 5
`-k, --key`	The name of a key to use to encrypt the certificate's key' (if empty, the account default protectionKey key will be used)
`-m, --metadata`	Metadata about the certificate
`-t, --tag`	List of the tags attached to this certificate. To specify multiple tags use argument multiple times: --tag Tag1 -t Tag2
`--delete-protection`	Protection from accidental deletion of this item, [true/false]
`--profile, --token`	Use a specific profile (located at $HOME/.akeyless/profiles) or a temp access token
`--uid-token`	The universal identity token, Required only for universal_identity authentication
`-h, --help`	display help information
`--json[=false]`	Set output format to JSON
`--no-creds-cleanup[=false]`	Do not clean local temporary expired creds