Command Reference

February 25th, 2026

Reference version: 1.5.0

Commands are split into two basic groups: environment commands and CA administration commands. These are defined as follows:

• Environment command allow you to interrogate AC X509 Authority to get information from it at a global or CA level about the overall usage and configuration as well as make global configuration changes like moving the datastore.
• Administration commands allow you to work directly with certificates, to manage them as a fully operational CA.

Environment Commands

list

Outputs a summary of the current Certificate Authorities (if any). Can also take an optional <CA> to restrict the output.

Example

# ac_x509_authority list [<CA> --verbose]

datastore

Moves the datastore to the defined directory (creating it if it does not exist). Existing data will be relocated.

Example

# ac_x509_authority datastore <path> [--verbose]

new

Creates a new Certificate Authority (menu driven).

Example

# ac_x509_authority new

get-report

Builds a CSV (pipe separated) file of certficiates and keys. Can also take an optional <CA> to restrict the output.

Example

# ac_x509_authority get-report [<CA> --verbose]

version

Outputs version info.

Example

# ac_x509_authority version

CA Administration Commands

Management certificates through a CA follows the same basic syntax:

# ac_x509_authority <CA> <option> [<optional> --verbose]

<CA>

Must be the name of an existing Certificate Authority already created on the system or, in the case of 'new', the name of the CA to create.

<option>

destroy

Deletes a Certificate Authority and all the certificates.

Example

# ac_x509_authority <CA> destroy [--verbose]

create

Creates a new CA-signed certificate. A <common_name> is required. If the CA is password protected an additional <CA_password> is required. A final <password> can be supplied to lock the private key. An optional CSV list of valid subjects <SANs> (hostnames or email addresses) can also be appended.

Example

# ac_x509_authority <CA> create <common_name> [<CA_password> <password> <SANs> --verbose]

create-csr

Create a new private key and Certificate Signing Request (CSR). This is less automated than the create command and must be followed by the sign command to convert the CSR into a usable public certificate. But it allows for granular creation of the DN (as long as it still meets the mandatory fields). This is prompt driven.

Example

# ac_x509_authority <CA> create-csr <common_name> [<CA_password> <password> <SANs> --verbose]

sign

Sign the certificate in the <CSR_path> and add it (without key). If the CA is password protected an additional <CA_password> is required.

Example

# ac_x509_authority <CA> sign <CSR_path> [<CA_password> --verbose]

get-info

Returns the certificate validity for <common_name>. If no <common_name> is supplied, the info for the CA cert will be displayed instead.

Example

# ac_x509_authority <CA> get-info <common_name> [--verbose]

revoke

Revokes the certificate for <common_name>. The CRL is not changed. If the CA is password protected an additional <CA_password> is required.

Example

ac_x509_authority <CA> revoke <common_name> [<CA_password> --verbose]

update-crl

Updates the Certificate Revocation List (CRL). If the CA is password protected an additional <CA_password> is required.

Example

# ac_x509_authority <CA> update-crl [<CA_password> --verbose]

delete

Removes a certificate for <common_name> the database. The CRL is not changed.

Example

# ac_x509_authority <CA> delete <common_name> [--verbose]

get-crl-info

Outputs the validity period of the CRL.

Example

# ac_x509_authority <CA> get-crl-info [--verbose]

status

Outputs total number of certificates in the database.

Example

# ac_x509_authority <CA> status [--verbose]

profile

Shows the CA configuration profile.

Example

# ac_x509_authority <CA> profile [--verbose]

edit-profile

Make changes to the profile. (menu-driven)

Example

# ac_x509_authority <CA> edit-profile [--verbose]

password

Change the CA password, or set one if none exists (or even remove the password lock altogether). (menu-driven)

Example

# ac_x509_authority <CA> password [--verbose]

get-pkcs12

Exports a selected certificate (including intermediate and root certificates) to a PKCS#12 keystore. The <common_name> and <alias> (a nickname for certificate) are mandatory. If the private key is locked a <password> must be supplied (this is preserved in the PKCS#12 file) and a final optional <keystore_password> can also be supplied.

Example

# ac_x509_authority <CA> get-pkcs12 <common_name> <alias> [<password> <keystore_password> --verbose]