HXTOOL(1)

NAME
hxtool - PKIX command-line utility

SYNOPSIS
hxtool [- -version] [- -help] [sub-command]

DESCRIPTION
hxtool is a utility for making certificate sigining requests (CSRs), displaying CSRs, signing certificates, etc. are given, then the value will be parsed and displayed using just the self-describing nature of DER.

All sub-commands have their own help message, shown when invoked with the - -help or -h option.

Supported commands:

help

list-oids

verify

print

validate

certificate-copy, cc

ocsp-fetch

ocsp-verify

ocsp-print

revoke-print

generate-key

request-create

request-print

query

info

random-data

crypto-available

crypto-select

hex

certificate-sign, cert-sign, issue-certificate, ca

crl-sign
Other sub-commands reported by the help sub-command are not stable or fully supported at this time.

CERTIFICATE STORES
Stores of certificates and/or keys have string names that can be used with 's commands. Sub-commands use these certificate store names to refer to files and tokens where keys and/or certificates are to be found or written. For example, ‘FILE:/path/to/some/file’.

Use the certificate-copy command to copy certificates from one store to another. This is useful for, e.g., converting DER files to PEM or vice-versa.

Heimdal supports a variety of certificate and key store types:

PEM-FILE:/path
    If writing, PEM will be written. If reading, PEM will be expected.

DER-FILE:/path
    If writing, DER will be written. If reading, DER will be expected.

FILE:/path
    If writing, PEM will be written. If reading, PEM or DER will be detected.

PKCS12:/path
    Barely supported at this time.

DIR:/path
    OpenSSL-style hashed directory of trust anchors.

MEMORY:name
    An in-memory only store, usually never used in commands.

KEYCHAIN:system-anchors
    On OS X this refers to the system's trust anchors.

KEYCHAIN:FILE:/path
    On OS X this refers to an OS X keychain at the given path.

NULL:
    An empty store.

PKCS11:/path/to/shared/object,slot=NUMBER
    Loads the given PKCS#11 provider object and uses the token at the given slot number.

CERTIFICATES
You can validate a certificate with the validate sub-command, or verify a certificate and its certification path with the verify sub-command.

You can display a certificate using the print sub-command:

print [options] STORE

Options:
[- -content] [- -info] [- -never-fail] [- -pass=password] [- -raw-json]

The - -pass=password option is for PKCS#12 and PKCS#11 stores, and if needed and not given, will be prompted for. Note that it's not secure to pass passwords as command-line arguments on multi-tenant systems.

The - -raw-json option prints the certificate(s) in the given STORE as a JSON dump of their DER using an experimental (i.e., unstable) schema.

KEYS
The generate-key sub-command will generate a key.

CERTIFICATE SIGNING REQUESTS
The request-create sub-command will create a CSR. The request-print sub-command will display a CSR.

CERTIFICATE ISSUANCE / CERTIFICATION AUTHORITY
The certificate-sign sub-command will issue a certificate. See its usage message.

ONLINE CERTIFICATE STATUS PROTOCOL
The ocsp-fetch sub-command will fetch OCSP Responses for the given certificates.

The ocsp-verify sub-command will verify OCSP Responses.

The ocsp-print sub-command will display OCSP Responses.

CERTIFICATE REVOCATION LIST
The crl-sign sub-command will add certificates to a certificate revocation list.

SEE ALSO
openssl(1)