<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8"/>
<style>
table.head, table.foot { width: 100%; }
td.head-rtitle, td.foot-os { text-align: right; }
td.head-vol { text-align: center; }
table.foot td { width: 50%; }
table.head td { width: 33%; }
div.spacer { margin: 1em 0; }
</style>
<title>
Mono(MakeCert)</title>
</head>
<body>
<div class="mandoc">
<table class="head">
<tbody>
<tr>
<td class="head-ltitle">
Mono(MakeCert)</td>
<td class="head-vol">
</td>
<td class="head-rtitle">
Mono(MakeCert)</td>
</tr>
</tbody>
</table>
<div class="section">
<h1>NAME</h1> MakeCert - Create X.509 certificates for test purposes</div>
<div class="section">
<h1>SYNOPSIS</h1> <b>makecert [options] certificate</b></div>
<div class="section">
<h1>DESCRIPTION</h1> Create an X.509 certificate using the provided informations. This is useful for testing Authenticode signatures, SSL and S/MIME technologies.</div>
<div class="section">
<h1>PARAMETERS</h1><dl>
<dt>
<i>-# num</i></dt>
<dd>
Specify the certificate serial number.</dd>
</dl>
<dl>
<dt>
<i>-n dn</i></dt>
<dd>
Specify the subject Distinguished Name (DN).</dd>
</dl>
<dl>
<dt>
<i>-in dn</i></dt>
<dd>
Specify the issuer Distinguished Name (DN).</dd>
</dl>
<dl>
<dt>
<i>-r</i></dt>
<dd>
Create a self-signed, also called root, certificate.</dd>
</dl>
<dl>
<dt>
<i>-iv pvkfile</i></dt>
<dd>
Specify the private key file (.PVK) for the issuer. The private key in the specified file will be used to sign the new certificate.</dd>
</dl>
<dl>
<dt>
<i>-ic certfile</i></dt>
<dd>
Extract the issuer's name from the specified certificate file - i.e. the subject name of the specified certificate becomes the issuer name of the new certificate.</dd>
</dl>
<dl>
<dt>
<i>-in name</i></dt>
<dd>
Use the issuer's name from the specified parameter.</dd>
</dl>
<dl>
<dt>
<i>-ik container</i></dt>
<dd>
Specify the key container name to be used for the issuer.</dd>
</dl>
<dl>
<dt>
<i>-iky [signature | exchange | #]</i></dt>
<dd>
Specify the key number to be used in the provider (when used with -ik).</dd>
</dl>
<dl>
<dt>
<i>-ip provider</i></dt>
<dd>
Specify the cryptographic provider to be used for the issuer.</dd>
</dl>
<dl>
<dt>
<i>-ir [localmachine | currentuser]</i></dt>
<dd>
Specify the provider will search the user or the machine keys containers for the issuer.</dd>
</dl>
<dl>
<dt>
<i>-iy number</i></dt>
<dd>
Specify the provider type to be used for the issuer.</dd>
</dl>
<dl>
<dt>
<i>-sv pkvfile</i></dt>
<dd>
Specify the private key file (.PVK) for the subject. The public part of the key will be inserted into the created certificate. If non-existant the specified file will be created with a new key pair (default to 1024 bits RSA key pair).</dd>
</dl>
<dl>
<dt>
<i>-sk container</i></dt>
<dd>
Specify the key container name to be used for the subject.</dd>
</dl>
<dl>
<dt>
<i>-sky [signature | exchange | #]</i></dt>
<dd>
Specify the key number to be used in the provider (when used with -sk).</dd>
</dl>
<dl>
<dt>
<i>-sp provider</i></dt>
<dd>
Specify the cryptographic provider to be used for the subject.</dd>
</dl>
<dl>
<dt>
<i>-sr [localmachine | currentuser]</i></dt>
<dd>
Specify the provider will search the user or the machine keys containers for the subject.</dd>
</dl>
<dl>
<dt>
<i>-sy number</i></dt>
<dd>
Specify the provider type to be used for the issuer.</dd>
</dl>
<dl>
<dt>
<i>-a hash</i></dt>
<dd>
Select hash algorithm. Only MD5 and SHA1 algorithms are supported.</dd>
</dl>
<dl>
<dt>
<i>-b date</i></dt>
<dd>
The date since when the certificate is valid (notBefore).</dd>
</dl>
<dl>
<dt>
<i>-e date</i></dt>
<dd>
The date until when the certificate is valid (notAfter).</dd>
</dl>
<dl>
<dt>
<i>-m number</i></dt>
<dd>
Specify the certificate validity period in months. This is added to the notBefore validity date which can be set with -b or will default to the current date/time.</dd>
</dl>
<dl>
<dt>
<i>-cy [authority|end]</i></dt>
<dd>
Basic constraints. Select Authority or End-Entity certificate. Only Authority certificates can be used to sign other certificates (-ic). End-Entity can be used by clients (e.g. Authenticode, S/MIME) or servers (e.g. SSL).</dd>
</dl>
<dl>
<dt>
<i>-h number</i></dt>
<dd>
Add a path length restriction to the certificate chain. This is only applicable for certificates that have BasicConstraint set to Authority (-cy authority). This is used to limit the chain of certificates than can be issued under this authority.</dd>
</dl>
<dl>
<dt>
<i>-alt filename</i></dt>
<dd>
Add a subjectAltName extension to the certificate. Each line from 'filename' will be added as a DNS entry of the extension. This option is useful if you want to create a single SSL certificate to work on several hosts that do not share a common domain name (i.e. CN=*.domain.com would not work).</dd>
</dl>
<dl>
<dt>
<i>-eku oid[,oid]</i></dt>
<dd>
Add some extended key usage OID to the certificate.</dd>
</dl>
<dl>
<dt>
<i>-p12 pkcs12file password</i></dt>
<dd>
Create a new PKCS#12 file containing both the certificates (the subject and possibly the issuer's) and the private key. The PKCS#12 file is protected with the specified password. This option is <b>mono exclusive.</b></dd>
</dl>
<dl>
<dt>
<i>-?</i></dt>
<dd>
Help (display this help message)</dd>
</dl>
<dl>
<dt>
<i>-!</i></dt>
<dd>
Extended help (for advanced options)</dd>
</dl>
</div>
<div class="section">
<h1>EXAMPLES</h1> To create a SSL test (i.e. non trusted) certificate is easy once your know your host's name. The following command will create a test certificate for an SSL server:<br/>
	$ hostname <br/>
	pollux<div class="spacer">
</div>
<br/>
	$ makecert -r -eku 1.3.6.1.5.5.7.3.1 -n &quot;CN=pollux&quot; -sv pollux.pvk pollux.cer<br/>
	Success<br/>
<div class="spacer">
</div>
In particular in the above example, the parameters used to build this test certificate were:<dl>
<dt>
<i>-r</i></dt>
<dd>
Create a self-signed certificate (i.e. without an hierarchy).</dd>
</dl>
<dl>
<dt>
<i>-eku 1.3.6.1.5.5.7.3.1</i></dt>
<dd>
Optional (as sadly most client don't require it). This indicates that your certificate is intended for server-side authentication.</dd>
</dl>
<dl>
<dt>
<i>-n</i></dt>
<dd>
Common Name (CN) = Host name. This is verified the SSL client and must match the connected host (or else you'll get a warning or error or *gasp* nothing).</dd>
</dl>
<dl>
<dt>
<i>-sv private.key</i></dt>
<dd>
The private key file. The key (1024 bits RSA key pair) will be automatically generated if the specified file isn't present.</dd>
</dl>
<dl>
<dt>
<i>pollux.cer</i></dt>
<dd>
The SSL certificate to be created for your host.</dd>
</dl>
</div>
<div class="section">
<h1>KNOWN RESTRICTIONS</h1> Compared to the Windows version some options aren't supported (-$, -d, -l, -nscp, -is, -sc, -ss). Also PVK files with passwords aren't supported.</div>
<div class="section">
<h1>AUTHOR</h1> Written by Sebastien Pouliot</div>
<div class="section">
<h1>COPYRIGHT</h1> Copyright (C) 2003 Motus Technologies. Copyright (C) 2004-2005 Novell. Released under BSD license.</div>
<div class="section">
<h1>MAILING LISTS</h1> Visit http://lists.ximian.com/mailman/listinfo/mono-devel-list for details.</div>
<div class="section">
<h1>WEB SITE</h1> Visit http://www.mono-project.com for details</div>
<div class="section">
<h1>SEE ALSO</h1> <b>signcode(1)</b></div>
<table class="foot">
<tr>
<td class="foot-date">
</td>
<td class="foot-os">
</td>
</tr>
</table>
</div>
</body>
</html>

