• Sunday, December 21, 2025

Introduction to SSL/TLS Certificate Management

Ensuring secure communication on the web is paramount, and SSL/TLS certificates play a critical role in achieving this. This document provides a comprehensive guide to managing SSL/TLS certificates efficiently using a dedicated command-line utility. This powerful tool simplifies various certificate management tasks, making it an essential resource for administrators and developers alike.

With this utility, you can perform a range of crucial operations, including:

  • Generating and revoking SSL/TLS certificates, ensuring your web assets remain protected with up-to-date security protocols.
  • Assigning certificates to specific IP addresses, allowing for granular control over how your certificates are deployed across your infrastructure.
  • Modifying various parameters of existing certificates, providing flexibility to adapt to evolving security requirements and operational needs.

Understanding the Command-Line Utility Syntax

The command-line utility adheres to a clear and consistent syntax, enabling users to execute various certificate management functions. The general structure of a command is as follows:

certificate <command> <certificate name> [<domain name>] [
<option_1> [<param>]
<option_2> [<param>]
... [<option_N> [<param>]]
]

Understanding this structure is key to effectively utilizing the utility for all your SSL/TLS certificate needs.

Practical Application: Creating an SSL/TLS Certificate

To illustrate the utility's functionality, let's examine a common scenario: creating a new SSL/TLS certificate. The following example demonstrates how to create an SSL/TLS certificate named "Site Certificate" within a domain's certificate repository for example.com. This process involves specifying the paths to the private key, the certificate file, the CA certificate file, and associating a certificate signing request (CSR) with the newly created certificate on the platform.

certificate -c "Site Certificate" -domain example.com -key-file /usr/local/keyfile.key -cert-file /usr/local/cert/cert.cert -cacert-file /usr/local/cert/cacert.cert -csr-file /usr/local/requests/csreq

This command streamlines the often complex process of certificate generation and deployment, making it straightforward to secure new domains or update existing ones.

Comprehensive Overview of Certificate Management Commands

The table below outlines the primary commands available within the utility, detailing their purpose, required parameters, and illustrative examples. These commands form the core of the certificate management system, allowing for complete lifecycle control over your SSL/TLS certificates.

Command Parameter Description Example
--create or -c <certificate_name> Initiates the creation of an SSL/TLS certificate within a specified certificate repository (either the administrator’s or a specific domain’s repository). This command requires both a private key file and its corresponding certificate file for successful execution. For detailed information on the necessary options, refer to the "Important Considerations for Certificate Creation" section below. To create an SSL/TLS certificate named "Site Certificate" for the domain example.com, utilizing private key file /usr/local/keys/keyfile.key and certificate file /usr/local/cert/certfile.cert:

certificate --create "Site Certificate" -domain example.com -key-file /usr/local/keyfile.key -cert-file /usr/local/cert/certfile.cert

or

certificate -c "Site Certificate" -domain example.com -key-file /usr/local/keyfile.key -cert-file /usr/local/cert/certfile.cert
--update or -u <certificate_name> Facilitates the modification of an existing SSL/TLS certificate’s parameters, such as its name or associated files. This command is crucial for maintaining accurate and current certificate information. To rename an SSL/TLS certificate for the domain example.com from "Site Certificate" to "New Certificate":

certificate --update "Site Certificate" -domain example.com -new-name "New Certificate"

or

certificate -u "Site Certificate" -domain example.com -new-name "New Certificate"
--remove or -r <certificate_name> Permanently deletes an SSL/TLS certificate from either the administrator’s or a specific domain’s repository. Care should be taken when using this command, as it irrevocably removes the certificate. To delete the SSL/TLS certificate named "Site Certificate" from the domain example.com:

certificate --remove "Site Certificate" -domain example.com

or

certificate -r "Site Certificate" -domain example.com
--assign-cert or -ac <certificate_name> Assigns an SSL/TLS certificate for active use with a specified IP address. This action is fundamental for associating a certificate with a network interface. This command requires the -ip option to specify the target IP address. To assign the SSL/TLS certificate named "Site Certificate" (from the administrator’s repository) for use with the IP address 192.0.2.78:

certificate --assign-cert "Site Certificate" -admin -ip 192.0.2.78

or

certificate -ac "Site Certificate" -admin -ip 192.0.2.78
--list or -l <login_name> Displays a comprehensive list of all SSL/TLS certificates currently stored within a designated certificate repository, whether it be the administrator’s or a specific domain’s repository. This command is invaluable for inventorying existing certificates. To view the list of SSL/TLS certificates present in the certificate repository for the domain example.com:

certificate --list -domain example.com

or

certificate -l -domain example.com
--help or -h   Provides on-demand assistance and displays detailed information regarding the proper usage of the certificate utility and its various commands and options. This is a crucial resource for troubleshooting and learning. To access help on using the certificate utility:

certificate --help

or

certificate -h

Important Considerations for Certificate Creation

When employing the --create command, it is imperative to use it in conjunction with one of the following combinations of options to ensure a complete and valid certificate creation process. These combinations specify the necessary files (CSR, private key, certificate, and CA certificate) required to generate a fully functional SSL/TLS certificate:

  • -csr-file <file name> -key-file <file name>
  • -csr-file <file name> -key-file <file name> -cert-file <file name>
  • -csr-file <file name> -key-file <file name> -cert-file <file name> -cacert-file <file name>
  • -key-file <file name> -cert-file <file name> -cacert-file <file name>
  • -key-file <file name> -cert-file <file name>

Selecting the correct combination ensures that all required components are provided for the certificate, facilitating a smooth deployment.

Detailed Explanation of Command Options

Beyond the primary commands, the utility offers a rich set of options that provide granular control over certificate management operations. These options can be combined with various commands to tailor actions to specific needs. The table below details these options, their parameters, and their specific functions, along with practical examples of their use.

Option Parameter Description Example
-domain <domain_name> Specifies a particular domain’s certificate repository as the target location for certificate operations within the system. This option is essential when managing certificates tied to specific domains. To delete the SSL/TLS certificate named "Site Certificate" from the example.com certificate repository:

certificate -r "Site Certificate" -domain example.com
-admin   Designates the administrator’s certificate repository within the system as the location for certificate operations. This is used for managing global or server-wide certificates. To delete the SSL/TLS certificate named "Site Certificate" from the administrator’s certificate repository:

certificate -r "Site Certificate" -admin
-default   Configures an SSL/TLS certificate in the administrator’s certificate repository to be set as the administrator’s default certificate for the system. This is useful for establishing a primary certificate for server-wide services. To set the SSL/TLS certificate named "Site Certificate" in the administrator’s certificate repository as the system’s default certificate:

certificate -u "Site Certificate" -admin -default
-new-name <certificate_name> Enables the renaming of an existing SSL/TLS certificate. This allows for better organization and identification of certificates within the repository. To rename an SSL/TLS certificate in the administrator’s certificate repository from "Site Certificate" to "Old Site Certificate":

certificate -u "Site Certificate" -admin -new-name "Old Site Certificate"
-key-file <path> Defines the absolute path to the private key file required when either creating a new certificate or updating an existing one. This file is fundamental for the cryptographic security of the certificate. To create the SSL/TLS certificate named "Site Certificate" in the example.com certificate repository, using private key file /usr/local/keys/keyfile.key, corresponding certificate file /usr/local/cert/certfile.cert, CA certificate file /usr/local/cert/cacert.cert, and associating the corresponding certificate signing request file /usr/local/requests/csreq.csr:

certificate -c "Site Certificate" -domain example.com -key-file /usr/local/keyfile.key -cert-file /usr/local/cert/certfile.cert -cacert-file /usr/local/cert/cacert.cert -csr-file /usr/local/requests/csreq
-cert-file <path> Specifies the path to the main SSL/TLS certificate file itself when creating or updating a certificate. This file contains the public key and other identity information.  
-cacert-file <path> Indicates the path to the Certificate Authority (CA) certificate file. This file is often needed to establish a complete trust chain for the SSL/TLS certificate, especially for certificates issued by intermediate CAs.  
-csr-file <path> Provides the path to the Certificate Signing Request (CSR) file. This file is used when initiating the certificate issuance process and contains information about the certificate applicant.  
-ip <IP_address> Identifies the specific IP address to which an SSL/TLS certificate is intended to be assigned. This option is crucial for binding certificates to network interfaces. To assign the SSL/TLS certificate named "Site Certificate" from the example.com domain’s repository for use with IP address 192.0.2.78:

certificate --assign-cert "Site Certificate" -domain example.com -ip 192.0.2.78

or

certificate -ac "Site Certificate" -domain example.com -ip 192.0.2.78
Back