PKI --SCEP(1)                     strongSwan                     PKI --SCEP(1)

<?><?><?> (NAME)
       pki --scep - <?><?><?> <?> <?><?><?><?><?><?> <?><?><?><?><?> X.509
       <?><?> <?><?> <?><?><?><?><?><?> SCEP

<?><?><?><?><?> <?><?><?><?><?> (SYNOPSIS)
       pki --scep --url url [--in file] [--dn  distinguished-name]
                  [--san subjectAltName] [--profile profile]
                  [--password password] --ca-cert-enc file --ca-cert-sig file
                  [--cacert file] [--cert file --key file] [--cipher cipher]
                  [--digest digest] [--rsa-padding padding] [--interval time]
                  [--maxpolltime time] [--outform encoding] [--debug level]

       pki --scep --options file

       pki --scep -h | --help

<?><?><?><?><?><?><?> (DESCRIPTION)
       <?><?><?> <?><?><?><?><?><?><?><?> <?><?> pki(1) <?><?>
       <?><?><?><?><?><?><?> <?><?><?><?><?> PKCS#10 <?><?> <?><?><?><?>
       <?><?> <?><?><?> <?><?><?><?><?><?><?><?><?><?><?><?> <?>
       <?><?><?><?><?><?><?><?> PKCS#7 <?><?> <?><?><?><?> HTTP <?><?> <?><?>
       <?><?><?><?><?><?> SCEP <?><?> <?><?><?><?><?><?><?> <?><?>
       <?><?><?><?><?><?> <?><?><?> <?><?><?><?><?> <?><?><?><?> (Simple
       Certificate Enrollment Protocol - RFC 8894) <?><?><?><?><?>
       <?><?><?><?><?><?>. <?><?> <?><?> <?><?><?><?><?> <?><?><?><?>
       <?><?><?><?><?><?><?><?><?><?><?><?> <?><?> <?><?> <?><?><?><?>
       <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?><?>
       <?><?><?><?><?><?><?> (polling) <?><?><?><?> <?><?><?><?><?><?>
       <?><?><?><?><?><?><?><?><?><?><?><?><?> <?><?><?><?> <?><?><?><?><?><?>
       SCEP <?><?> <?><?><?><?><?> X.509 <?><?><?><?><?><?><?> <?><?><?><?> CA
       <?><?> <?><?><?><?><?><?><?><?><?><?><?><?>.

       <?><?><?> <?><?> <?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?><?>
       <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?><?><?>
       <?><?><?><?> <?><?><?><?><?> <?><?> <?><?> <?><?><?><?> <?><?><?><?><?>
       RSA <?><?><?><?> <?><?><?><?><?><?><?> <?><?><?> <?><?> <?><?>
       <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?> <?> <?><?><?><?>
       <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?>
       <?><?><?><?><?><?> <?><?> <?><?><?><?><?><?> SCEP <?><?><?><?>
       <?><?><?><?><?><?><?><?>.

<?><?><?><?><?><?><?><?> (OPTIONS)
       -h, --help
              <?><?><?> <?><?><?><?><?><?><?> <?><?><?><?>
              <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?>
              <?><?><?><?><?><?><?><?> <?><?> <?><?><?><?><?><?><?><?><?>
              <?><?><?><?><?>.

       -v, --debug level
              <?><?><?><?><?> <?><?><?> <?><?><?><?><?><?><?><?><?><?><?>
              (debug)<?> <?><?><?><?><?><?><?>: 1.

       -+, --options file
              <?><?><?><?><?><?> <?><?><?><?><?><?><?><?><?> <?><?>
              <?><?><?><?><?> <?><?> file.

       -u, --url url
              <?><?><?><?> URL <?><?><?><?><?><?> SCEP.

       -i, --in file
              <?><?><?><?> <?><?><?><?><?> RSA. <?><?> <?><?><?><?>
              <?><?><?><?> <?><?><?><?><?> <?><?><?><?> <?><?> STDIN
              <?><?><?><?><?><?> <?><?><?><?><?><?>.

       -d, --dn distinguished-name
              <?><?><?> <?><?><?><?><?><?> <?><?><?><?><?> (Subject DN).
              <?><?><?><?><?><?> <?><?><?> <?><?><?> <?><?><?><?><?> --cert
              <?><?><?><?> <?><?><?> <?><?><?><?>.

       -a, --san subjectAltName
              <?><?><?><?><?><?> subjectAltName <?><?><?><?>
              <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?><?><?>.
              <?><?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?>
              <?><?><?><?><?><?><?> <?><?><?>.

       -P, --profile profile
              <?><?><?> <?><?><?><?><?> (profile) <?><?><?><?><?> <?><?><?><?>
              <?><?><?><?><?><?><?> <?><?><?> <?><?> <?><?><?><?><?><?><?>
              <?><?><?><?><?>. <?><?><?><?><?><?><?><?> <?><?> <?><?><?><?><?>
              UTF8 <?><?><?><?>. <?><?><?><?> <?><?><?><?><?> <?><?><?><?>
              <?><?><?><?><?><?> SCEP openxpki <?><?>
              <?><?><?><?><?><?><?><?><?><?> (pc-client<?> tls-server <?>
              <?><?><?><?>) <?><?> <?><?> <?><?><?><?><?><?><?><?>
              <?><?><?><?><?><?> Extended Key Usage (EKU) <?><?>
              <?><?><?><?><?> X.509 <?><?><?><?><?><?><?><?> <?><?><?><?><?>
              <?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?>
              <?><?><?><?><?><?>.

       -p, --password password
              <?><?><?><?><?> challengePassword <?><?><?><?>
              <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?><?><?>
              <?><?><?><?><?>.

       -e, --cacert-enc file
              <?><?><?><?><?> CA <?><?> RA <?><?><?><?>
              <?><?><?><?><?><?><?><?>.

       -s, --cacert-sig file
              <?><?><?><?><?> CA <?><?><?><?> <?><?><?><?><?><?><?><?><?><?>
              <?><?><?><?>.

       -C, --cacert file
              <?><?><?><?><?> CA <?><?><?><?><?> <?><?> <?><?><?><?><?><?>
              <?><?><?><?><?><?> <?><?> <?><?><?><?>
              <?><?><?><?><?><?><?><?><?><?> <?><?><?><?>
              <?><?><?><?><?><?><?> <?><?><?><?><?><?>.
              <?><?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?>
              <?><?><?><?><?><?><?> <?><?><?>.

       -c, --cert file
              <?><?><?><?><?> <?><?><?><?><?><?> <?><?> <?><?><?><?>
              <?><?><?><?><?> <?><?><?>.

       -k, --key file
              <?><?><?><?> <?><?><?><?><?> RSA <?><?><?><?><?><?> <?><?>
              <?><?><?><?> <?><?><?><?><?><?><?> <?><?><?>.

       -E, --cipher cipher
              <?><?><?> <?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?>
              <?><?><?><?><?><?><?><?> <?><?><?><?><?><?>. <?><?><?><?><?>
              <?><?> aes (<?><?><?><?><?><?><?>) <?><?> des3 <?><?><?>.

       -g, --digest digest
              <?><?><?><?><?><?><?><?> (digest) <?><?><?><?>
              <?><?><?><?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?>.
              <?><?><?> <?><?> <?><?><?><?><?><?> sha256
              (<?><?><?><?><?><?><?>)<?> sha384<?> sha512 <?><?> sha1.

       -R, --rsa-padding padding
              <?><?><?><?><?><?><?><?><?><?> (padding) <?><?><?><?>
              <?><?><?><?><?><?><?> <?><?><?><?> <?><?><?><?><?><?><?> RSA.
              <?><?><?><?><?> <?><?> pkcs1 (<?><?><?><?><?><?><?>) <?><?> pss
              <?><?><?>.

       -t, --interval time
              <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?>
              <?><?><?><?><?><?><?> (poll) <?><?> <?><?><?> <?><?><?><?><?><?>
              <?><?><?><?><?><?><?> 60s <?><?><?>.

       -m, --maxpolltime time
              <?><?><?><?><?><?> <?><?><?><?> <?><?><?><?><?>
              <?><?><?><?><?><?><?> (poll) <?><?> <?><?><?> <?><?><?><?><?><?>
              <?><?><?><?><?><?><?> 0 <?><?><?> <?><?> <?><?> <?><?><?><?>
              <?><?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?><?><?><?>
              <?><?><?>.

       -f, --outform encoding
              <?><?><?><?><?><?><?> <?><?><?><?> <?><?><?><?><?>
              <?><?><?><?><?><?><?><?>. <?><?><?> <?><?> <?><?><?><?><?><?>
              der (ASN.1 DER) <?><?> pem (Base64 PEM)<?> <?><?><?><?><?><?><?>
              der <?><?><?>.

<?><?><?><?><?><?><?> (EXAMPLES)
       <?><?><?><?> <?><?><?><?><?><?><?><?><?> <?><?> <?><?><?><?><?>
       <?><?><?><?><?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?> <?><?>
       <?><?> <?><?><?><?> scep.opt <?><?><?><?><?> <?><?><?><?><?><?><?>:

       --url http://pki.strongswan.org:8080/scep
       --cacert-enc myra.crt
       --cacert-sig myca-1.crt
       --cacert myca.crt

       <?><?> <?><?><?><?><?> <?><?><?><?> <?><?> <?><?><?><?><?> X.509
       <?><?><?><?><?><?><?> <?><?><?><?> CA <?><?><?><?><?> <?><?> <?><?>
       <?><?><?><?><?><?> SCEP <?><?><?><?><?><?><?> <?><?><?><?><?><?>:

       pki --options scep.opt --in moonKey.der --san "moon.strongswan.org" \
           --dn "C=CH, O=strongSec GmbH, CN=moon.strongswan.org" > moonCert.der

       transaction ID: 4DFCF31CB18A9B5333CCEC6F99CF230E4524E334
         using certificate "C=CH, O=strongSwan Project, CN=SCEP RA"
         using trusted intermediate ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
         using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
         reached self-signed root ca with a path length of 1
         SCEP request pending, polling indefinitely every 60 seconds
         going to sleep for 60 seconds
       transaction ID: 4DFCF31CB18A9B5333CCEC6F99CF230E4524E334
         ...
         going to sleep for 60 seconds
       Issued certificate "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
         serial: 1e:ff:22:7b:6e:d7:4c:c1:8a:06
         using certificate "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
         using trusted intermediate ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
         using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
         reached self-signed root ca with a path length of 1
       Issued certificate is trusted, valid from Aug 22 18:56:23 2022 until Aug 22 18:56:23 2023 (currently valid)

       <?><?><?><?><?><?><?><?> <?><?> <?><?> <?><?><?><?><?><?>
       <?><?><?><?><?> <?><?><?><?> <?><?><?><?> <?><?> <?><?><?><?><?><?><?>
       <?><?> <?><?><?><?><?> <?><?><?> <?><?><?><?><?> <?><?><?>:

       pki --options scep.opt --in moonNewKey.der --san "moon.strongswan.org" \
           --dn "C=CH, O=strongSec GmbH, CN=moon.strongswan.org" \
           --cert moonCert.der --key moonKey.der > moonNewCert.der

       transaction ID: A9A63D028CC439F68452D125C4DBA025E67DBA95
         using certificate "C=CH, O=strongSwan Project, CN=SCEP RA"
         using trusted intermediate ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
         using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
         reached self-signed root ca with a path length of 1
       Issued certificate "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
         serial: 1f:ff:b2:78:43:a2:9d:85:00:38
         using certificate "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
         using trusted intermediate ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
         using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
         reached self-signed root ca with a path length of 1
       Issued certificate is trusted, valid from Jul 20 15:05:33 2023 until Jul 20 15:05:33 2024 (currently valid)

<?><?><?><?><?><?> <?><?><?><?><?><?> (SEE ALSO)
       pki(1)

6.1.0                             2022-08-22                     PKI --SCEP(1)