Certificate Management using commands - Part 1
There are various command line tool to manage keys, certificates and certificate requests. Below are the commands available for certificate management:
- gskcmd and gskcapicmd ( Version 8 onwards)
- gsk7cmd and gsk7capicmd (version 7)
- gskcmd and gskcapicmd ( Version 8 onwards)
- gsk7cmd and gsk7capicmd (version 7)
Syntax for the gsk cmds :
gskcmd <object>
<action> [options]
where
object includes one
of the following:
- -keydb: Actions taken on the key database (either a CMS key database file, a WebDB key ring file, or SSLight class)
- -cert: Actions taken on a certificate
- -certreq: Actions taken on a certificate request
- -help: Displays help for the gsk7cmd invocations
- -version: Displays version information for gsk7cmd
action represents the specific action to take on
the object.
options represents the options, both required and
optional, specified for the object and action pair
Note: The object and
action keywords are positional and you must specify them in the selected order.
However, options are not positional and you can specify them in any order, as
an option and operand pair.
The following table describes each action possible on a specified object that you can use with the gsk commands . | commands | Object | Action | Description |
| gskcapicmd, gsk7capicmd,gskcmd gsk7cmd | -keydb | -changepw | Change the password for a key database |
| -convert | Convert the format of a key database | ||
| -create | Create a key database | ||
| -delete | Delete a key database | ||
| -expiry | Display password expiry | ||
| -list | Currently supported types of key database | ||
| -stashpw | Stash the password of a key database into a file | ||
| gskcapicmd, gsk7capicmd, gskcmd, gsk7cmd | -cert | -add | Add a CA Certificate |
| -create | Create a self-signed certificate | ||
| -delete | Delete a certificate | ||
| -details | Show the details of a specific certificate | ||
| -export | Export a personal certificate and associated private key into a PKCS12 file or a key database | ||
| -extract | Extract a certificate from a key database | ||
| -getdefault | Show the default personal certificate | ||
| -import | Import a certificate from a key database or a PKCS12 file | ||
| -list | List certificates in a key database | ||
| -listsigners | List signer certificates delivered with ikeyman (not avaliable in gskcapicmd /gsk7capicmd) | ||
| -modify | Modify a certificate (NOTE: the only field that may be modified is the trust field) | ||
| -populate | Populate with included CA Certificates (not avaliable in gskcapicmd /gsk7capicmd) | ||
| -receive | Receive a certificate | ||
| -rename | Rename a certificate | ||
| -setdefault | Set the default personal certificate | ||
| -sign | Sign a certificate | ||
| Available only in gskcmd and gskcapicmd | -validate | Validate a certificate path | |
| gskcapicmd, gsk7capicmd, gskcmd and gsk7cmd | -certreq | -create | Create a certificate request |
| -delete | Delete a certificate request from a certificate request database | ||
| -details | Show the details of a specific certificate request | ||
| -extract | Extract a certificate from a certificate request database | ||
| -list | List all certificate requests in a certificate request database | ||
| -recreate | Recreate a certificate request | ||
| Available only gskcmd and gsk7cmd | -seckey | -create | Create a secret key |
| -delete | Delete a secret key | ||
| -details | Show the details of a specific secret key | ||
| -export | Export secret keys to a file | ||
| -import | Import secret keys from a file | ||
| -list | List all secret keys in a key database | ||
| -rename | Rename a secret key | ||
| gskcapicmd, gsk7capicmd, gskcmd and gsk7cmd | -version | Display iKeyman version information | |
| -help | Display this help text | ||
| avaliable only in gskcapicmd | -secretkey | -add | Add a secret key |
| -extract | Extract a secret key from a key database | ||
| -random | -create | Create a random password |
The following table describes the options that you can use with the gsk commands.
| Option | Description |
| -db | Fully qualified path name of a key database |
| -default_cert | Sets a certificate to use as the default certificate for client authentication (yes or no). Default is no. |
| -dn | X.500 distinguished name. Input as a quoted string of the following format (only CN, O, and C are required): "CN=Reena,O=IBM,OU=WebSphere,L=Bangalore, ST=KA,ZIP=13760,C=country" |
| encryption | Strength of encryption used in certificate export command (strong or weak). Default is strong. |
| -expire | Expiration time of either a certificate or a database password (in days). |
| -file | File name of a certificate or certificate request (depending on specified object). |
| -format | Format of a certificate (either ASCII for Base64_encoded ASCII or binary for Binary DER data). Default is ASCII. |
| -label | Label attached to a certificate or certificate request |
| -new_format | New format of key database |
| -new_pw | New database password |
| -old_format | Old format of key database |
| -pw | Password for the key database or PKCS#12 file |
| -size | Key size (512, 1024, or 2048). Default is 1024. The 2048 key size is available if you are using Global Security Kit (GSKit) Version 7.0.4.14 and later. |
| -stash | Indicator to stash the key database password to a file. If specified, the password will be stashed in a file. |
| -target | Destination file or database |
| -target_pw | Password for the key database if -target specifies a key database. |
| -target_type | Type of database specified by -target operand (see -type) |
| -trust | Trust status of a CA certificate (enable or disable). Default is enable. |
| -type | Type of database. Allowable values are CMS (indicates a CMS key database), webdb (indicates a keyring), sslight (indicates an SSLight .class), or pkcs12 (indicates a PKCS#12 file). |
| -x509version | Version of X.509 certificate to create (1, 2 or 3). Default is 3. |
Procedure
- You can invoke the gsk7cmd from the <ihsinst>/bin/ directory.
- gsk7cmd.bat /gsk7capicmd.bat /gskcmd.bat /gskcapicmd.bat (windows)
- gsk7cmd /gsk7capicmd /gskcmd /gskcapicmd ( unix)
- Perform the certificate management tasks that you want to complete.
Create keystore with expiry for 20 years:
gsk7cmd -keydb -create -db test.kdb -pw password -type kdb -expire 7300
In next post (Certificate Management Using Command - Part 2 Keystore Management) , I will be covering the keystore management using the command with examples
