certctl is a certificate utility tool, it can:
- Generate Root CA certificate
- Generate self-signed certificate
- Sign certificate or Immediate CA with Root CA certificate
- Show certificate or certificate signing request info
- Fetch certificate from an HTTPS URL
- Verify if a certificate matches the private key or CA certificate
curl -LO https://github.com/chenzhiwei/certctl/releases/latest/download/certctl chmod +x certctl ./certctl version sudo mv certctl /usr/local/bin/ certctl genca --subject "C=CN/ST=Beijing/L=Haidian/O=Any Corp/CN=Root CA" \ --key ca.key --cert ca.crt \ --days 36500 --size 2048 # Set Key Usages and Extended Key usages manaully certctl genca --subject "C=CN/ST=Beijing/L=Haidian/O=Any Corp/CN=Root CA" \ --nodefault \ --key ca.key --cert ca.crt \ --san "root.com,*.root.com,localhost,127.0.0.1" \ --ku digitalSignature,keyCertSign --eku serverAuth \ --days 36500 --size 2048 certctl help genca # Generate self-signed certificate certctl generate --subject "C=CN/ST=Beijing/L=Haidian/O=Any Corp/CN=any.com" \ --san "any.com,*.any.com,localhost,127.0.0.1" \ --key any.com.key --cert any.com.crt \ --days 730 --size 2048 # Set Key Usages and Extended Key usages manaully certctl generate --subject "C=CN/ST=Beijing/L=Haidian/O=Any Corp/CN=Root CA" \ --nodefault --ku digitalSignature,keyCertSign --eku serverAuth \ --san "any.com,*.any.com,localhost,127.0.0.1" \ --key any.com.key --cert any.com.crt \ --days 730 --size 2048 certctl help generate # Sign a certificate with CA certificate certctl sign --ca-key ca.key --ca-cert ca.crt \ --subject "CN=anycorp.com" \ --san anycorp.com,www.anycorp.com,localhost,127.0.0.1 \ --key anycorp.com.key --cert anycorp.com.crt \ --usage digitalSignature,keyEncipherment \ --extusage serverAuth,clientAuth \ --days 730 --size 2048 certctl help sign A full list a key usages are:
- digitalSignature
- contentCommitment
- keyEncipherment
- dataEncipherment
- keyAgreement
- keyCertSign
- cRLSign
- encipherOnly
- decipherOnly
A full list of extended key usages are:
- any
- serverAuth
- clientAuth
- codeSigning
- emailProtection
- IPSECEndSystem
- IPSECTunnel
- IPSECUser
- timeStamping
- OCSPSigning
- netscapeServerGatedCrypto
- microsoftServerGatedCrypto
- microsoftCommercialCodeSigning
- microsoftKernelCodeSigning
certctl show cert-filepath.crt certctl show csr-filepath.csr certctl fetch 192.168.122.10:8443 certctl fetch https://pkg.go.dev/io certctl fetch golang.org certctl fetch golang.org --file golang.org.crt --noout certctl verify --cert domain.crt --ca ca.crt certctl verify --cert domain.crt --key domain.key certctl verify --cert domain.crt --key domain.key --ca ca.crt