pkiaas Command Reference

Manage your PKIaaS certificate authorities and keys. AI agents: start with the agent guide, or run pkiaas help agents.

Commands

Every command with its arguments and flags, apart from the global flags below and --server.

pkiaas
├── ca
│   ├── create                 --csr-only --days=INT --extended-key-usage=STRING --idempotency-key=STRING --key-type=STRING --key-usage=STRING --name=STRING --path-length=INT --set --signature-algorithm=STRING --subject=STRING --yes
│   ├── delete NAME|ID         --dry-run --yes
│   ├── export                 --ca=STRING --chain --cps --csr --force --format=STRING --out=STRING
│   ├── list
│   ├── set NAME|ID
│   ├── show                   --ca=STRING
│   └── update                 --ca=STRING --cep=STRING --cep-password-env=STRING --cep-password-file=STRING --cep-username=STRING --cps-file=STRING --dry-run --policy-oid=STRING --service-key-type=STRING --service-signature-algorithm=STRING
├── cert
│   ├── export SERIAL          --ca=STRING --chain --csr --force --format=STRING --out=STRING
│   ├── list                   --ca=STRING --expires-within=INT --key-type=STRING --limit=INT --match=STRING --order=STRING --reason=STRING --search=STRING --sort=STRING --status=STRING --template=STRING
│   ├── revoke SERIAL          --ca=STRING --reason=STRING --yes
│   ├── show SERIAL            --ca=STRING --text
│   └── unrevoke SERIAL        --ca=STRING
├── csr
│   └── create                 --cn=STRING --force --format=STRING --key=STRING --key-passphrase-env=STRING --key-passphrase-file=STRING --out=STRING --san=STRING --subject=STRING
├── help
├── key
│   ├── create                 --force --format=STRING --no-passphrase --out=STRING --passphrase-env=STRING --passphrase-file=STRING --type=STRING
│   └── types
├── log
│   └── list                   --ca=STRING --level=STRING --limit=INT --order=STRING --search=STRING --since=STRING --sort=STRING --until=STRING
├── login                      --device
├── logout                     --all
├── pkcs12
│   └── create                 --cert=STRING --chain-file=STRING --force --key=STRING --key-passphrase-env=STRING --key-passphrase-file=STRING --legacy --no-passphrase --out=STRING --passphrase-env=STRING --passphrase-file=STRING
├── request
│   ├── approve ID             --ca=STRING --chain --force --format=STRING --not-after=STRING --not-before=STRING --out=STRING --san=STRING --subject=STRING
│   ├── create                 --approve --ca=STRING --chain --csr=STRING --force --format=STRING --idempotency-key=STRING --not-after=STRING --not-before=STRING --out=STRING --san=STRING --subject=STRING --template=STRING
│   ├── decline ID             --ca=STRING --yes
│   ├── list                   --ca=STRING --limit=INT --order=STRING --search=STRING --sort=STRING
│   └── show ID                --ca=STRING
├── template
│   └── list                   --ca=STRING --limit=INT
├── version                    --licenses
└── whoami

Global flags

Environment

Exit codes and error codes are listed in the agent guide.

pkiaas ca

Create certificate authorities, list them, show one, change its settings, export its certificate, CSR or CPS, set the active one, delete one.

pkiaas ca [flags]

Commands:

• pkiaas ca create
• pkiaas ca delete
• pkiaas ca export
• pkiaas ca list
• pkiaas ca set
• pkiaas ca show
• pkiaas ca update

pkiaas ca create

Create a CA, self-signed or (with —csr-only) waiting for another CA to sign it.

pkiaas ca create --name NAME [--subject DN] [--key-type TYPE] [--signature-algorithm sha256|sha384|sha512] [--days N] [--path-length N] [--key-usage USAGE]... [--extended-key-usage USAGE]... [--csr-only] [--set] [--idempotency-key KEY] [--yes] [flags]

Create a certificate authority owned by you, as the website’s “Create a Managed CA” form does. The platform makes the CA’s key, which never leaves it, and self-signs the CA’s certificate, so the new CA is a root CA. It also makes the CA’s OCSP responder certificate and gives it a copy of the “Web Server” template, so it can issue certificates at once. It takes a few seconds (SLH-DSA keys up to about 5). The result is the new CA, as pkiaas ca show describes it; commands take its id (or name) with --ca. It doesn’t become the active CA unless --set is given, which sets it as pkiaas ca set does.

--name is the CA’s name: its certificate’s common name, at most 64 characters. --subject gives the certificate’s other subject fields in RFC 4514 form (“O=Example,OU=IT,C=US”) or OpenSSL’s (“/C=US/O=Example/OU=IT”): only C, ST, L, O and OU, each at most once. --key-type is the CA’s key type: the flag lists those a CA can have, which pkiaas key types describes. --signature-algorithm is ignored for ML-DSA and SLH-DSA keys, which have their own. sha1 is for testing only: SHA-1 is broken for collisions, and OpenSSL 3 (at its default security level) and Windows reject SHA-1 certificate chains. The command prints a warning on standard error and asks for confirmation on the terminal; without one, it needs --yes. Give --yes only when the person asked for SHA-1. --days is how long the certificate is valid (1 to 36500). --path-length limits how many CAs may follow this one in a chain (0 to 4; 0: it can only issue end-entity certificates); without it there is no limit.

--key-usage and --extended-key-usage (repeatable, or comma-separated) add to the certificate’s key usages, which always include digitalSignature, keyCertSign and cRLSign. A CA usually has no extended key usages: those it has limit every certificate it issues, and Windows and some other clients enforce that.

With --csr-only, the CA isn’t signed: it waits for another CA to sign its CSR, which pkiaas ca export --csr exports, and for the signed certificate to be imported on the website. Until then it can’t issue certificates.

Each run is a new CA, unless it has the --idempotency-key of an earlier run (any text, e.g. a UUID) and the same flags: within 24 hours that gives the earlier result instead of a second CA. Without --idempotency-key, the CLI makes a key and reports it (idempotencyKey), and uses it when it retries by itself. A key used for different flags is refused (error idempotency_key_reused).

You can create at most 20 CAs an hour; beyond that the server refuses with http_429 and says when to try again. If a step fails on the server, nothing is kept and the command fails with ca_creation_failed, naming the step. pkiaas ca delete deletes a CA you no longer need.

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas ca create --name "Example Root CA" --subject "O=Example,C=US"
pkiaas ca create --name "Example Root CA" --key-type ec-p384 --signature-algorithm sha384 --days 7300 --set --json
pkiaas ca create --name "Example Issuing CA" --subject "O=Example,OU=IT,C=US" --path-length 0 --csr-only --json
pkiaas ca create --name "Test CA $RUN" --key-type ec-p256 --days 7 --idempotency-key "$KEY" --json
pkiaas ca create --name "SHA-1 test CA" --signature-algorithm sha1 --days 7 --yes

With --json, the result is an object with these fields:

Side effects:

• creates a CA owned by the user’s account on the server; with the --idempotency-key of an earlier run (within 24 hours), nothing new
• the platform makes the CA’s private key and keeps it; it never leaves the platform
• the platform also makes the CA’s OCSP responder certificate and copies the “Web Server” template to the CA
• counts toward the limit of 20 CAs per user an hour
• with --signature-algorithm sha1 (RSA and EC keys), prints a warning on standard error and asks for confirmation on the terminal (--yes skips the question)
• with --set, keeps the new CA as the active one in the CLI’s config.json, for this server

pkiaas ca delete

Delete a CA, with its certificates, requests and templates.

pkiaas ca delete NAME|ID [--dry-run] [--yes] [flags]

Delete a certificate authority, by its name (in any case) or ID from pkiaas ca list. The CA has to be named: it is never the active CA or PKIAAS_CA by default. A name that more than one of your CAs has is refused (error ca_ambiguous): give the ID then. Only the CA’s owner can delete it (error forbidden for a CA shared with you).

Deleting a CA deletes every certificate it issued, its pending requests, templates, ACME policies and log lines. OCSP, the CRL, SCEP, ACME and CEP stop answering for it, so clients can no longer check its certificates, and its public pages are removed. Its ACME accounts stop working, and the other users it is shared with lose it. For a CA whose key is on the user’s HSM, the HSM keeps the key. It can’t be undone.

The command first asks the server what the delete takes with it (a dry run, which changes nothing) and prints that. --dry-run stops there; with --json, the result is the dry run: ca and impact. Otherwise, on a terminal, it asks for the CA’s name to be typed: only the exact name deletes the CA, anything else stops and deletes nothing. Without a terminal, give --yes, which deletes without asking; without it, the command stops with a usage error.

The delete is sent with the version of the CA the dry run saw: if someone changed the CA in between, nothing is deleted and it fails with ca_changed: run the command again to see the impact now. Running it again after it succeeded fails with not_found, as for a CA that never existed; if a retry of the same delete finds the CA gone, the result says it is deleted. If the CA was the active CA on this computer, that setting is cleared: commands then use the CA you last used on the website, else the first by name, as pkiaas ca show says.

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas ca delete "Test CA 1234" --dry-run
pkiaas ca delete "Test CA 1234" --dry-run --json
pkiaas ca delete "Test CA 1234"
pkiaas ca delete "Test CA 1234" --yes --json
pkiaas ca delete a1B2c3D4e5 --yes

With --json, the result is an object with these fields:

Side effects:

• deletes the CA on the server, with every certificate it issued, its pending requests, templates, ACME policies and log lines; nothing with --dry-run
• OCSP, the CRL, SCEP, ACME and CEP stop answering for the CA, its public pages are removed, its ACME accounts stop working, and the users it is shared with lose it
• it can’t be undone; an HSM keeps the key of a CA whose key is on it
• clears the active CA in the CLI’s config.json if it was this CA

pkiaas ca export

Export a CA’s certificate, its chain, the CSR of an unsigned CA, or its CPS.

pkiaas ca export [--chain | --csr | --cps] [--format pem|der] [--out FILE] [--ca NAME|ID] [flags]

Export the certificate of a CA, by default the active CA. The chain (--chain) is the CA’s certificate followed by the certificates that issued it, up to the root; for a root CA that is its certificate alone. It is what a server needs beside a certificate the CA issued, and what pkiaas pkcs12 create --chain-file adds to a PKCS#12 file. The certificate of a root CA is what clients add to their trust store.

A CA waiting for its signed certificate fails with ca_not_signed. With --csr, it exports such a CA’s certificate signing request instead (e.g. of a CA made with pkiaas ca create --csr-only), for another CA to sign; the signed certificate is then imported on the website. A signed CA has no CSR to export (error conflict). An --out file with a CSR is readable by its owner only, as for pkiaas cert export --csr.

With --cps, it exports the CA’s certification practice statement, the text of its public page, as stored: Markdown, or HTML for a CPS written in the website’s old editor (the result’s format says which). Edit it and send it back with pkiaas ca update --cps-file. --format doesn’t apply to it.

Without --out (or with --out -), the output goes to standard output, as OpenSSL writes it, to read or to pipe to another command; there is no result then, so --json needs --out. With --out FILE, it is written to the file, which is only replaced with --force, and the result describes it.

--format is pem (default) or der, as OpenSSL’s -outform. PEM is what servers, OpenSSL and pkiaas pkcs12 create read; DER (.cer, .der) is the binary form Windows and Java also take. DER holds one certificate, so it can’t be used with --chain. Like OpenSSL, it goes to standard output as it is, also to a terminal.

With --chain, the output holds the certificate followed by the certificates that issued it, up to the root: what a server sends (e.g. nginx’s ssl_certificate).

In Windows PowerShell 5.1, > and | re-encode output, so write files with --out (PowerShell 7.4 and later keep the bytes).

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas ca export
pkiaas ca export --out ca.pem
pkiaas ca export --chain --out chain.pem --json
pkiaas ca export --ca a1B2c3D4e5 --format der --out root.cer
pkiaas ca export --csr --ca a1B2c3D4e5 --out ca.csr --json
pkiaas ca export --cps > cps
pkiaas ca export --cps --ca a1B2c3D4e5 --out cps --json

With --json, the result is an object with these fields:

Side effects:

• with --out, writes the file (readable by everyone for certificates and the CPS, which are public; by its owner only for a CSR); otherwise writes to standard output and prints no result

pkiaas ca list

List the CAs you have access to.

pkiaas ca list [flags]

List the certificate authorities your account has access to: your own, and those you were invited to, by name. Commands take a CA’s name, in any case, or its ID; scripts should keep the ID, which never changes and no other CA has. The active CA, which commands work in unless told otherwise, is marked with *.

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas ca list
pkiaas ca list --json

With --json, the result is an array of objects with these fields:

pkiaas ca set

Set the active CA.

pkiaas ca set NAME|ID [flags]

Set the active CA, which commands work in unless told otherwise, by its name (in any case) or ID from pkiaas ca list. A name that more than one of your CAs has is refused (error ca_ambiguous): give the ID then. The ID is kept, so renaming the CA doesn’t change it. It is kept on this computer, for this server, until pkiaas logout; it doesn’t change the CA you work in on the website.

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas ca set "Example Issuing CA"
pkiaas ca set a1B2c3D4e5 --json

With --json, the result is an object with these fields:

Side effects:

• keeps the CA as the active one in the CLI’s config.json, for this server

pkiaas ca show

Show a CA’s details, by default the active CA’s.

pkiaas ca show [--ca NAME|ID] [flags]

Show a CA’s details: its key, certificate (serial, thumbprint, validity), how many certificates it has issued that are still valid, and the URLs of its public services (certificate, chain, CRL, OCSP, time stamping, CPS page and Windows enrollment).

Without --ca or PKIAAS_CA, it shows the active CA: the CA that commands work in unless told otherwise. It is the one set with pkiaas ca set (or at login), on this computer for this server. Until one is set, it is the CA you last worked in on the website. The result’s source says how the CA was chosen. When the account has no CAs, the id, the name and the details are null, and source is none.

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas ca show
pkiaas ca show --json
pkiaas ca show --ca "Example Issuing CA"
pkiaas ca show --ca a1B2c3D4e5 --json

With --json, the result is an object with these fields:

pkiaas ca update

Change a CA’s settings: its CPS, policy identifier, Windows enrollment (CEP) and service certificate key.

pkiaas ca update [--ca NAME|ID] [--cps-file FILE] [--policy-oid OID] [--cep on|off] [--cep-username NAME --cep-password-env NAME | --cep-password-file FILE] [--service-key-type TYPE] [--service-signature-algorithm sha256|sha384|sha512|sha1] [--dry-run] [flags]

Change the settings of a CA, by default the active CA, as the website’s Edit CA page does. Only the settings whose flags are given change; the others stay as they are. The CA’s name, key and certificate can’t be changed. Changing settings needs the modify privilege in the CA (error forbidden without it).

--cps-file is the CA’s new certification practice statement (CPS), the text of its public page, in Markdown (- for standard input). To edit the CPS, export it (pkiaas ca export --cps > cps), change the file, and send it back (pkiaas ca update --cps-file cps). An HTML CPS written in the website’s old editor is replaced by the Markdown you send; convert it on the website to keep its formatting.

--policy-oid is the certificate policy OID (dotted, at most 50 characters) the CA puts in the certificates of templates with policies, next to the address of its CPS page. --policy-oid none removes it: certificates then get neither the policy nor the CPS address.

--cep on|off turns Windows certificate enrollment (CEP/CES) on or off. It needs a user name and password, which Windows clients enroll with: --cep-username with the password from --cep-password-env NAME (an environment variable) or --cep-password-file FILE (its first line; - for standard input), never as an argument. Both replace the stored ones; without them the stored ones are kept. The CA’s CEP URLs are in pkiaas ca show.

--service-key-type is the key of the CA’s OCSP responder and time-stamping certificates, as pkiaas key types names it. --service-signature-algorithm is the hash they are signed with; ML-DSA and SLH-DSA keys have their own, so it doesn’t apply to them. With a new RSA or EC key type and no --service-signature-algorithm, the stored hash is kept (sha256 if there is none). The certificates get the new key when they are next made: when they expire (yearly) or are revoked.

The command reads the CA’s settings, changes those given, and sends them all back with the version it read. If someone changed the CA in between, nothing is saved and it fails with ca_changed: run it again. Running it again after it succeeded changes nothing more. When the CA already has the settings given, nothing is sent and the result is the CA as it is. --dry-run sends nothing and shows what would change, each setting old → new; with --json, the CA as it is now with dryRun true and changes.

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas ca update --cps-file cps
pkiaas ca update --cps-file cps --dry-run
pkiaas ca update --cep on --cep-username enroll --cep-password-env CEP_PASSWORD --json
pkiaas ca update --cep off
pkiaas ca update --ca a1B2c3D4e5 --policy-oid 1.3.6.1.4.1.99999.1 --json
pkiaas ca update --ca "Example CA" --policy-oid none --dry-run
pkiaas ca update --service-key-type ec-p384 --service-signature-algorithm sha384 --dry-run --json

With --json, the result is an object with these fields:

Side effects:

• changes the CA’s settings on the server, only those given; nothing when the CA already has them, or with --dry-run
• with --cep-username, replaces the stored CEP user name and password, which Windows clients enroll with
• OCSP and time-stamping certificates use the new key from their next renewal (yearly, or when revoked)
• an HTML CPS written in the website’s old editor is replaced by the Markdown you send; convert it on the website to keep its formatting
• the CA’s log records the change

pkiaas cert

List the certificates a CA issued, show one, export it, its chain or its CSR, revoke it.

pkiaas cert [flags]

Commands:

• pkiaas cert export
• pkiaas cert list
• pkiaas cert revoke
• pkiaas cert show
• pkiaas cert unrevoke

pkiaas cert export

Export a certificate, with its chain, or the CSR it was issued from, as PEM or DER.

pkiaas cert export SERIAL [--chain | --csr] [--format pem|der] [--out FILE] [--ca NAME|ID] [flags]

Export a certificate that a CA issued, by default the active CA, by its serial number from pkiaas cert list.

With --csr, it exports the certificate signing request the certificate was issued from instead. It is stored for most certificates, but not all (e.g. not for ACME): pkiaas cert show says whether (hasCsr), and a certificate without one fails with csr_not_stored. A CSR sent by SCEP holds the enrollment’s challenge password, so every exported CSR is a secret: an --out file with it is readable by its owner only, and without --out it goes to standard output only when that is a terminal (in a pipe or captured output the command fails with secret_destination); give --out - to pipe it.

Without --out (or with --out -), the output goes to standard output, as OpenSSL writes it, to read or to pipe to another command; there is no result then, so --json needs --out. With --out FILE, it is written to the file, which is only replaced with --force, and the result describes it.

--format is pem (default) or der, as OpenSSL’s -outform. PEM is what servers, OpenSSL and pkiaas pkcs12 create read; DER (.cer, .der) is the binary form Windows and Java also take. DER holds one certificate, so it can’t be used with --chain. Like OpenSSL, it goes to standard output as it is, also to a terminal.

With --chain, the output holds the certificate followed by the certificates that issued it, up to the root: what a server sends (e.g. nginx’s ssl_certificate).

In Windows PowerShell 5.1, > and | re-encode output, so write files with --out (PowerShell 7.4 and later keep the bytes).

This command calls the PKIaaS server and needs a login.

Its output (the CSR, with —csr) is a secret: it goes to --out FILE, to --out -, or to a terminal, never into a pipe without --out - or into a --json result (error secret_destination).

Flags:

Examples:

pkiaas cert export 25ab765c7238b3d28d2bab03271f5fa8f2fccf86
pkiaas cert export 25ab765c7238b3d28d2bab03271f5fa8f2fccf86 | openssl x509 -noout -subject
pkiaas cert export 25ab765c7238b3d28d2bab03271f5fa8f2fccf86 --chain --out fullchain.pem --json
pkiaas cert export 25ab765c7238b3d28d2bab03271f5fa8f2fccf86 --format der --out www.cer
pkiaas cert export 25ab765c7238b3d28d2bab03271f5fa8f2fccf86 --csr --out - | openssl req -noout -text

With --json, the result is an object with these fields:

Side effects:

• with --out FILE, writes the file (readable by everyone for certificates, by its owner only for a CSR); otherwise writes to standard output (a CSR only with --out - or to a terminal) and prints no result

pkiaas cert list

List the certificates a CA issued, the newest first.

pkiaas cert list [--ca NAME|ID] [--search TEXT] [--match FIELD:VALUE]... [--status S] [--expires-within DAYS] [--template NAME|ID] [--key-type T] [--reason R] [--sort FIELD [--order asc|desc]] [--limit N] [flags]

List the certificates a CA issued, by default the active CA’s: every certificate it signed, also expired and revoked ones and the CAs it signed, the newest first. The serial is what commands take to name a certificate.

It lists the first --limit certificates (default 50, at most 1000); total says how many match, so when it is more, narrow the list with the filters or sort it to bring the ones you need first. --sort takes name, revocationReason, template, validFrom, validTo, keyType or keySize, in --order asc (the default with --sort) or desc. Without --sort: validFrom, desc.

The filters are checked on the server, and a certificate is listed when all that are given hold: --search TEXT the text is in the common name, a subject value or a SAN value, in any case; when it is hex (at least 8 digits; colons and spaces between the bytes are ignored), also in the serial or the SHA-1 thumbprint --match FIELD:VALUE one subject attribute or SAN type has this whole value, in any case; * matches any text (dns:*.example.com also matches the wildcard name *.example.com itself). FIELD is a subject attribute by its OpenSSL short or long name (CN, C, ST, L, O, OU, postalCode, street, emailAddress, serialNumber, businessCategory, jurisdictionC, jurisdictionST, jurisdictionL; e.g. organizationName) or a SAN type (DNS, IP, URI, email, RID, dirName, otherName). Repeat it for more, up to 10; all have to match --status S,… valid, expired or revoked --expires-within DAYS expires within this many days (1-3650) and hasn’t expired yet; revoked ones too, so add --status valid for the certificates to renew --template NAME|ID issued with this template (its name or ID from pkiaas template list, enabled or not) --key-type TYPE,… the key’s keyType as the list shows it, e.g. rsaEncryption, id-ecPublicKey, ML-DSA-65 --reason R,… revoked with one of these reasons, e.g. keyCompromise, superseded, certificateHold

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas cert list
pkiaas cert list --search example.com --json
pkiaas cert list --match dns:*.example.com --match o:Contoso --json
pkiaas cert list --status valid --expires-within 30 --sort validTo --json
pkiaas cert list --search 25:ab:76:5c:72:38:b3:d2 --json
pkiaas cert list --status revoked --reason keyCompromise,cACompromise --json
pkiaas cert list --template "Web Server" --key-type rsaEncryption --limit 200 --json
pkiaas cert list --sort name --order desc --ca a1B2c3D4e5 --json

With --json, the result is an object with these fields:

pkiaas cert revoke

Revoke a certificate.

pkiaas cert revoke SERIAL --reason REASON [--ca NAME|ID] [--yes] [flags]

Revoke a certificate that a CA issued, by default the active CA’s, by its serial number from pkiaas cert list. The CA’s next CRL and OCSP responses list it as revoked.

--reason is one of RFC 5280’s reasons: unspecified, keyCompromise, cACompromise, affiliationChanged, superseded, cessationOfOperation or certificateHold. certificateHold suspends the certificate: pkiaas cert unrevoke undoes it, and revoking it again with another reason makes it final, from the time it was put on hold. Every other reason is final: it can’t be undone or changed (error revocation_final).

It asks for confirmation on a terminal; without one, give --yes. Revoking a certificate that is revoked with the same reason changes nothing and succeeds, so the command is safe to run again. Revoking needs a subscription, the user’s or the CA owner’s (error subscription_required).

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas cert revoke 25ab765c7238b3d28d2bab03271f5fa8f2fccf86 --reason keyCompromise
pkiaas cert revoke 25ab765c7238b3d28d2bab03271f5fa8f2fccf86 --reason superseded --yes --json
pkiaas cert revoke 25ab765c7238b3d28d2bab03271f5fa8f2fccf86 --reason certificateHold --ca a1B2c3D4e5 --yes --json

With --json, the result is an object with these fields:

Side effects:

• revokes the certificate on the server, and clears the CA’s cached CRL and the certificate’s OCSP responses; only certificateHold can be undone (cert unrevoke)

pkiaas cert show

Show a certificate’s details.

pkiaas cert show SERIAL [--ca NAME|ID] [--text] [flags]

Show a certificate that a CA issued, by default the active CA, by its serial number from pkiaas cert list: its status (valid, expired or revoked, with the reason and date), template, validity, key, signature algorithm and thumbprint, and whether its CSR is stored. The serial is hex, with or without colons, in any case.

With --text, it adds every field and extension of the certificate as ‘openssl x509 -text’ describes them (its subject alternative names, key usages, policies and so on).

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas cert show 25ab765c7238b3d28d2bab03271f5fa8f2fccf86
pkiaas cert show 25:AB:76:5C:72:38:B3:D2:8D:2B:AB:03:27:1F:5F:A8:F2:FC:CF:86 --json
pkiaas cert show 25ab765c7238b3d28d2bab03271f5fa8f2fccf86 --text --ca a1B2c3D4e5 --json

With --json, the result is an object with these fields:

pkiaas cert unrevoke

Take a certificate off hold (certificateHold).

pkiaas cert unrevoke SERIAL [--ca NAME|ID] [flags]

Take a certificate that is on hold (revoked with reason certificateHold) off hold, so that the CA’s next CRL and OCSP responses show it as valid again. Other reasons are final (error revocation_final).

A certificate that isn’t revoked stays as it is, and the command succeeds, so it is safe to run again. Unrevoking needs a subscription, the user’s or the CA owner’s (error subscription_required).

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas cert unrevoke 25ab765c7238b3d28d2bab03271f5fa8f2fccf86
pkiaas cert unrevoke 25ab765c7238b3d28d2bab03271f5fa8f2fccf86 --ca a1B2c3D4e5 --json

With --json, the result is an object with these fields:

Side effects:

• deletes the certificate’s revocation (certificateHold) on the server, and clears the CA’s cached CRL and the certificate’s OCSP responses

pkiaas csr

Create certificate signing requests on this computer.

pkiaas csr [flags]

Commands:

• pkiaas csr create

pkiaas csr create

Create a certificate signing request (CSR).

pkiaas csr create --key FILE (--cn NAME | --subject DN) [--out FILE] [--format pem|der] [flags]

Create a PKCS#10 certificate signing request signed with your private key.

The subject is either just a common name (--cn) or a full distinguished name (--subject), in RFC 4514 form (“CN=host.example.com,O=Example,C=US”) or OpenSSL’s form (“/C=US/O=Example/CN=host.example.com”). In Git Bash, use the RFC 4514 form: Git Bash rewrites arguments that start with ”/“.

Subject alternative names (--san, repeatable) are dns:NAME, ip:ADDRESS, email:ADDRESS or uri:URI; without a prefix the kind is guessed. If no --san is given and the common name is a DNS name, it is added as one, because browsers and most clients only check SANs. With --san, list the common name too.

--key is a PEM or DER file, or - for standard input. An encrypted key’s passphrase then has to come from --key-passphrase-env or --key-passphrase-file, since it can’t be prompted for.

Without --out (or with --out -), the CSR goes to standard output, as OpenSSL writes it, to read or to pipe to another command; there is no result then, so --json needs --out. --format is pem (default) or der, as OpenSSL’s -outform.

In Windows PowerShell 5.1, > and | re-encode output, so write files with --out (PowerShell 7.4 and later keep the bytes).

Flags:

Examples:

pkiaas csr create --key server.key --cn www.example.com --san www.example.com --san example.com --out server.csr
pkiaas csr create --key server.key --key-passphrase-env KEY_PASSPHRASE --subject "CN=www.example.com,O=Example,C=US" --san ip:192.0.2.10 --out server.csr --json
pkiaas csr create --key server.key --cn www.example.com | openssl req -noout -text

With --json, the result is an object with these fields:

Side effects:

• with --out, writes the file; otherwise writes the CSR to standard output and no result

pkiaas help

Show help for a command, or the guide for AI agents.

pkiaas help [command... | agents] [flags]

Show help for a command. pkiaas help agents shows the guide for AI agents: how to run pkiaas without prompts, keep secrets out of transcripts, log in, and handle each error code.

With --json, the command and those under it are described as JSON: every flag, example, result field, side effect, exit code and error code. pkiaas <command> --help --json does the same.

Examples:

pkiaas help agents
pkiaas help --json
pkiaas help --json key create

pkiaas key

Create private keys on this computer.

pkiaas key [flags]

Commands:

• pkiaas key create
• pkiaas key types

pkiaas key create

Create a private key.

pkiaas key create [--out FILE] [--format pem|der] [flags]

Create a private key in PKCS#8 form, and save it in a file that only you can read.

The key is encrypted with a passphrase (AES-256-CBC, PBKDF2-HMAC-SHA256 with 600,000 iterations) unless --no-passphrase is given. Run pkiaas key types to list the key types.

The key is a secret, so without --out it goes to standard output only when that is a terminal, followed by a notice that it wasn’t saved; in a pipe or captured output the command fails with secret_destination. --out - sends it to standard output anyway, as OpenSSL writes it, to pipe to another command. There is no result then, so --json needs --out FILE. Prefer --out FILE: a key on standard output can end up in logs and transcripts. --format is pem (default) or der, as OpenSSL’s -outform.

In Windows PowerShell 5.1, > and | re-encode output, so write files with --out (PowerShell 7.4 and later keep the bytes).

Its output (the key) is a secret: it goes to --out FILE, to --out -, or to a terminal, never into a pipe without --out - or into a --json result (error secret_destination).

Flags:

Examples:

pkiaas key create --out server.key
pkiaas key create --type ml-dsa-65 --out pq.key --passphrase-env KEY_PASSPHRASE --json
pkiaas key create --type ec-p256 --out ci.key --no-passphrase --json
pkiaas key create --type ec-p256 --no-passphrase --out - | openssl pkey -noout -text

With --json, the result is an object with these fields:

Side effects:

• with --out FILE, writes the file, readable by the owner only; with --out - or to a terminal, writes the key to standard output and no result

pkiaas key types

List the key types.

pkiaas key types [flags]

List the key types pkiaas key create --type accepts: RSA, EC, Ed25519 and Ed448, and the post-quantum ML-DSA and SLH-DSA types. PKIaaS signs CSRs for all of them, but few clients accept the post-quantum types yet.

Examples:

pkiaas key types --json

With --json, the result is an array of objects with these fields:

pkiaas log

List what the platform logged for your CAs, for troubleshooting.

pkiaas log [flags]

Commands:

• pkiaas log list

pkiaas log list

List the latest log lines of your CAs.

pkiaas log list [--ca NAME|ID]... [--level LEVEL] [--since TIME] [--until TIME] [--search TEXT] [--sort time|ca [--order asc|desc]] [--limit N] [flags]

List what the platform logged for your CAs, as the website’s Logs page does: SCEP, CEP/CES and ACME requests, certificate approvals, revocations and the errors they met, by default the latest ones. Use it to find out why something failed, e.g. a device’s enrollment or a signing. It changes nothing.

By default it lists the lines of all the CAs your account has, its own and those it was invited to: unlike the commands that work in one CA, it doesn’t use the active CA or PKIAAS_CA. --ca NAME|ID (any case for a name) keeps the lines of that CA; repeat it for more, up to 20. Lines are deleted after a while (by default 30 days).

--level LEVEL keeps the lines of this level and the more severe ones: emergency, alert, critical, error, warning, notice, info or debug (the least severe), e.g. --level warning for warnings and errors.

--since TIME keeps the lines logged at that time or later, --until TIME those logged before it. TIME is an RFC 3339 time (2026-10-24T08:00:00Z, or with an offset such as -05:00), a date (2026-10-24, midnight in this computer’s time zone), or how long ago: a number with m, h or d (90m, 24h, 7d). The result says which times they stood for.

--search TEXT keeps the lines with that text in the message or the client’s IP address, in any case, e.g. a device’s name, a certificate’s serial or an error.

It lists --limit lines (default 50, at most 1000), the latest ones; total says how many match, so when it is more, narrow the list with --ca, --level, --since, --until or --search. It lists them in time order, as logs are read: the oldest first, the newest last, by the prompt. --sort time --order asc lists the earliest lines instead. --sort ca groups the lines by the CA’s name, in --order asc (the default) or desc, each group in time order; it picks the lines of the first names, the latest of each.

Each line shows, as log tools do: the time (RFC 3339, in this computer’s time zone, which TZ changes, e.g. TZ=UTC), the level, the CA’s name in brackets (a ] or \ in it escaped with ), the IP address of the client whose request it logs (- for the platform’s own work) and the message. Control characters in it show as escapes such as \x1b. --json has the CA’s id and name, the level, the time (UTC), the IP address ("" for none) and the message, unescaped.

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas log list
pkiaas log list --ca "Example Root CA" --level warning
pkiaas log list --since 24h --search "challenge password"
pkiaas log list --since 2026-10-24 --until 2026-10-25 --search 203.0.113.7 --json
pkiaas log list --ca a1B2c3D4e5 --ca f6G7h8I9j0 --level error --json
pkiaas log list --sort ca --json
pkiaas log list --json --limit 200

With --json, the result is an object with these fields:

pkiaas login

Log in to a PKIaaS server.

pkiaas login [flags]

Log in to a PKIaaS server, by default https://pkiaas.io or the server of your last login.

Your browser opens to log in and to allow the CLI. On a computer without a browser (e.g. over SSH), use --device: it shows a code to enter on another device. The token is kept in the system keyring, or where there is none in a file only you can read. PKIAAS_TOKEN, if set, is used instead of a stored token.

Login shows the active CA, which commands work in unless told otherwise: the one set before with pkiaas ca set, else the CA you last worked in on the website. Change it with pkiaas ca set.

A person has to approve the login in their browser. AI agents: ask the user to run it, see pkiaas help agents.

This command calls the PKIaaS server and needs the user to take part.

Flags:

Examples:

pkiaas login
pkiaas login --device
pkiaas login --server https://pki.example.com

With --json, the result is an object with these fields:

Side effects:

• stores the token in the system keyring or an owner-only file
• remembers the server for later commands
• keeps the active CA: the one set before, else the CA last used on the website
• emails the account about the new login, if it has an email address

pkiaas logout

Log out of a PKIaaS server.

pkiaas logout [flags]

Log out: revoke the token on the server and delete it from this computer.

With --all, every CLI login of your account is revoked, on every computer. Use it if a token may have leaked.

This command calls the PKIaaS server.

Flags:

Examples:

pkiaas logout
pkiaas logout --all

With --json, the result is an object with these fields:

Side effects:

• revokes the token on the server (with --all, every CLI login of the account)
• deletes the stored token
• forgets the active CA for the server

pkiaas pkcs12

Create PKCS#12 (.pfx/.p12) files on this computer.

pkiaas pkcs12 [flags]

Commands:

• pkiaas pkcs12 create

pkiaas pkcs12 create

Combine a key and its certificate into a PKCS#12 file.

pkiaas pkcs12 create --key FILE --cert FILE [--chain-file FILE] [--out FILE] [flags]

Combine a private key, its certificate and the CA chain into a PKCS#12 (.pfx/.p12) file.

--key may be PEM or DER; --cert and --chain-file may be PEM, DER or PKCS#7 (.p7b) files. One of them may be - for standard input, e.g. a certificate piped from pkiaas cert export; passphrases then have to come from an environment variable or a file, since they can’t be prompted for. --cert may hold the whole chain (e.g. a fullchain.pem); the certificate whose public key matches the key is used, and the others are added as the chain, followed by any in --chain-file.

The file is protected with AES-256-CBC, PBKDF2-HMAC-SHA256 and an HMAC-SHA256 MAC, which Windows 10 1709 and later, macOS, Java 12 and later, and OpenSSL 1.1.1 and later read. --legacy uses 3DES and a SHA-1 MAC for older systems. --no-passphrase writes the key unencrypted, for programs that load PKCS#12 files without a password; protect such a file like a plain private key.

The PKCS#12 file holds the key, so it is a secret: without --out, it (always DER, as OpenSSL writes it) goes to standard output only when that is a terminal, and in a pipe or captured output the command fails with secret_destination. --out - sends it to standard output anyway, to pipe to another command. There is no result then, so --json needs --out FILE.

In Windows PowerShell 5.1, > and | re-encode output, so write files with --out (PowerShell 7.4 and later keep the bytes).

Its output (the PKCS#12 file) is a secret: it goes to --out FILE, to --out -, or to a terminal, never into a pipe without --out - or into a --json result (error secret_destination).

Flags:

Examples:

pkiaas pkcs12 create --key server.key --cert server.pem --chain-file ca.pem --out server.pfx
pkiaas pkcs12 create --key server.key --key-passphrase-env KEY_PASSPHRASE --cert server.pem --chain-file ca.pem --out server.pfx --passphrase-env PFX_PASSPHRASE --json

With --json, the result is an object with these fields:

Side effects:

• with --out FILE, writes the file, readable by the owner only; with --out - or to a terminal, writes the PKCS#12 file to standard output and no result

pkiaas request

Request certificates from a CA, list the pending requests, approve or decline them.

pkiaas request [flags]

Commands:

• pkiaas request approve
• pkiaas request create
• pkiaas request decline
• pkiaas request list
• pkiaas request show

pkiaas request approve

Approve a request: the CA signs its CSR and issues the certificate.

pkiaas request approve ID [--subject DN] [--san NAME]... [--not-before TIME] [--not-after TIME] [--ca NAME|ID] [--out FILE|- [--chain] [--format pem|der] [--force]] [flags]

Approve a request to a CA, by default the active CA, by its ID from pkiaas request list: the CA signs its CSR as the request’s template says, as the website’s Sign button does without changes, and the command ends once the certificate is issued (on a CA whose key is on an IoT HSM, that can take a few seconds). The result’s serial is the certificate’s: pkiaas cert export SERIAL outputs it. Check the request first with pkiaas request show.

By default the certificate holds what the CSR asks for, as the template allows. --subject, --san, --not-before and --not-after change that, as the website’s “Override requested attributes” and “Override validity time” do, for a request that is readyToBeSigned (statusDetail in pkiaas request show): --subject DN the subject in place of the CSR’s, in RFC 4514 form (“CN=www.example.com,O=Example,C=US”) or OpenSSL’s (“/C=US/O=Example/CN=www.example.com”), as pkiaas csr create takes it; the template’s subject attributes still win --san NAME the subject alternative names in place of the CSR’s (repeatable; list them all): dns:NAME, ip:ADDRESS, email:ADDRESS or uri:URI, or a bare name whose kind is guessed --not-after TIME when the certificate expires, in place of the template’s validity (RFC 3339, e.g. 2027-01-31T00:00:00Z); it is valid from now, or from --not-before TIME Without a subscription, while the CA has a validity limit (validityLimitDays), the validity can’t be changed (subscription_required). Values OpenSSL won’t take are refused (invalid_overrides), and nothing is signed.

Only a request that waits for approval (pendingApproval) and has a CSR can be approved; otherwise the error is request_not_approvable (no CSR, pending email confirmation, pre-approved, or changes to a request that isn’t readyToBeSigned), request_declined, or request_processing while it is being signed. If the CA can’t sign it (e.g. its IoT HSM doesn’t answer), the error is signing_failed: the request waits for approval again, and the CA’s log on the website says why.

Approving a request that is issued already changes nothing and succeeds, so the command is safe to run again, e.g. after a lost connection; the certificate is never signed again, so changes given then aren’t applied.

With --out FILE, it also writes the issued certificate to the file (PEM, or DER with --format der; with --chain, followed by the certificates that issued it, up to the root), which is only replaced with --force; the result names it (file). With --out -, standard output holds only the certificate, for piping, and there is no result (so no --json). The file is checked before anything is approved.

In Windows PowerShell 5.1, > and | re-encode output, so write files with --out (PowerShell 7.4 and later keep the bytes).

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas request approve k3J9xQ2mP7vR1sT8wY4zA6bC0dE5fG
pkiaas request approve k3J9xQ2mP7vR1sT8wY4zA6bC0dE5fG --out - > www.pem
pkiaas request approve k3J9xQ2mP7vR1sT8wY4zA6bC0dE5fG --chain --out fullchain.pem --json
pkiaas request approve k3J9xQ2mP7vR1sT8wY4zA6bC0dE5fG --san www.example.com --san example.com --not-after 2027-01-31T00:00:00Z --json
pkiaas request approve k3J9xQ2mP7vR1sT8wY4zA6bC0dE5fG --subject "CN=www.example.com,O=Example,C=US" --json
pkiaas request approve k3J9xQ2mP7vR1sT8wY4zA6bC0dE5fG --ca a1B2c3D4e5 --json

With --json, the result is an object with these fields:

Side effects:

• the CA signs the request’s CSR and issues the certificate on the server, with the --subject, --san and validity changes if given; for a request issued already, nothing
• with --out FILE, writes the certificate to the file; with --out -, writes it to standard output and prints no result

pkiaas request create

Request a certificate with a CSR; it waits for approval, or is issued with —approve.

pkiaas request create --csr FILE --template NAME|ID [--approve [--subject DN] [--san NAME]... [--not-before TIME] [--not-after TIME] [--out FILE|- [--chain] [--format pem|der] [--force]]] [--ca NAME|ID] [--idempotency-key KEY] [flags]

Send a CSR to a CA, by default the active CA, as the website’s “Request a Certificate” does. The request waits for a member of the CA to approve it (pkiaas request approve, or the website’s Pending Requests page); approving it issues the certificate. No email is sent.

With --approve, the command approves the request too, as pkiaas request approve does, and ends once the certificate is issued: serial is the certificate’s. If approving fails, the request stays, waiting for approval: the error says its ID. To get the certificate in the same command, add --out (see below). --subject, --san, --not-before and --not-after change what it is issued with, as for pkiaas request approve (see its help); they need --approve.

--csr is a PEM or DER file (e.g. from pkiaas csr create), or - for standard input. Only the CSR is sent, never anything else in the file. The server checks its signature (error invalid_csr). --template is the name of one of the CA’s enabled templates, in any case, as the website and pkiaas template list show it, or its ID (error template_not_found); it says what the certificate will hold. A name that more than one enabled template has is refused (error template_ambiguous): give the ID then.

Each run is a new request, unless it has the --idempotency-key of an earlier run (any text, e.g. a UUID) and the same CSR, template and CA: within 24 hours that gives the earlier result instead of a second request. Without --idempotency-key, the CLI makes a key and reports it (idempotencyKey), and uses it when it retries by itself. A key used for a different request is refused (error idempotency_key_reused). With --approve, running the same command again with the reported key approves the same request, which is safe: an issued request stays as it is.

With --approve, --out FILE also writes the issued certificate to the file (PEM, or DER with --format der; with --chain, followed by the certificates that issued it, up to the root), which is only replaced with --force; the result names it (file). With --out -, standard output holds only the certificate, for piping, and there is no result (so no --json). The file is checked before anything is approved.

In Windows PowerShell 5.1, > and | re-encode output, so write files with --out (PowerShell 7.4 and later keep the bytes).

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas request create --csr www.csr --template "Web Server"
pkiaas request create --csr www.csr --template "Web Server" --approve --json
pkiaas request create --csr www.csr --template "Web Server" --approve --out - > www.pem
pkiaas request create --csr www.csr --template "Web Server" --approve --chain --out fullchain.pem --json
pkiaas request create --csr www.csr --template "Web Server" --approve --not-after 2027-01-31T00:00:00Z --json
pkiaas request create --csr - --template "Web Server" --json < www.csr
pkiaas request create --csr www.csr --template f5IK8ghmT0 --ca a1B2c3D4e5 --idempotency-key 8e03978e-40d5-43e8-bc93-6894a57f9324 --json

With --json, the result is an object with these fields:

Side effects:

• creates a certificate request on the server, which waits for approval; with the --idempotency-key of an earlier run (within 24 hours), nothing new
• with --approve, the CA signs the CSR and issues the certificate, with the --subject, --san and validity changes if given
• with --approve --out FILE, writes the certificate to the file; with --out -, writes it to standard output and prints no result

pkiaas request decline

Decline a request for good.

pkiaas request decline ID [--ca NAME|ID] [--yes] [flags]

Decline a request to a CA, by default the active CA, by its ID from pkiaas request list: it will never be issued, and its voucher, email confirmation link and SCEP challenge stop working. This can’t be undone; the requester can make a new request.

It asks for confirmation on a terminal; without one, give --yes. Declining a request that is declined already changes nothing and succeeds, so the command is safe to run again. An issued request can’t be declined (error request_issued): revoke its certificate with pkiaas cert revoke instead. A request being signed can’t be declined (error request_processing) until it has been processing for 10 minutes, when it counts as stuck.

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas request decline k3J9xQ2mP7vR1sT8wY4zA6bC0dE5fG
pkiaas request decline k3J9xQ2mP7vR1sT8wY4zA6bC0dE5fG --yes --json
pkiaas request decline k3J9xQ2mP7vR1sT8wY4zA6bC0dE5fG --ca a1B2c3D4e5 --yes --json

With --json, the result is an object with these fields:

Side effects:

• declines the request on the server for good, and deletes its voucher, email confirmation and SCEP challenge; can’t be undone

pkiaas request list

List the requests that wait for something, the newest first.

pkiaas request list [--ca NAME|ID] [--search TEXT] [--sort FIELD [--order asc|desc]] [--limit N] [flags]

List a CA’s pending requests, by default the active CA’s, as the website’s Pending Requests page does: the requests that wait for approval, for the requester’s email confirmation or for the requester to pick up a pre-approved certificate, and those being signed. Issued and declined requests aren’t listed (pkiaas request show ID shows any request), nor are requests from ACME.

pendingApproval: it waits for a member of the CA to approve it (approve it if hasCsr is true; one without a CSR needs an approved voucher, which only the website sends). pendingEmailVerification: it waits for the requester to confirm their email address. preApproved: it is issued when the requester picks it up with its voucher or SCEP challenge. processing: it is being signed; signing takes seconds, so one processing for more than 10 minutes (processingSince) is stuck. issued: the certificate is signed (serial). declined: it will never be issued.

It lists the first --limit requests (default 50, at most 1000); total says how many match. --search keeps the requests whose name contains the text, in any case. --sort takes requestedAt, name or template, in --order asc (the default with --sort) or desc. Without --sort: requestedAt, desc.

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas request list
pkiaas request list --json
pkiaas request list --search example.com --sort name --json
pkiaas request list --ca a1B2c3D4e5 --limit 200 --json

With --json, the result is an object with these fields:

pkiaas request show

Show a request’s details: its status and what its CSR asks for.

pkiaas request show ID [--ca NAME|ID] [flags]

Show a request to a CA, by default the active CA, by its ID from pkiaas request list or pkiaas request create: its status, template and source, and what its CSR asks for (subject, subject alternative names, key), so it can be checked before it is approved. The template, not the CSR, decides what the certificate holds. Once it is issued, serial is the certificate’s serial number. Requests from ACME aren’t shown.

pendingApproval: it waits for a member of the CA to approve it (approve it if hasCsr is true; one without a CSR needs an approved voucher, which only the website sends). pendingEmailVerification: it waits for the requester to confirm their email address. preApproved: it is issued when the requester picks it up with its voucher or SCEP challenge. processing: it is being signed; signing takes seconds, so one processing for more than 10 minutes (processingSince) is stuck. issued: the certificate is signed (serial). declined: it will never be issued.

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas request show k3J9xQ2mP7vR1sT8wY4zA6bC0dE5fG
pkiaas request show k3J9xQ2mP7vR1sT8wY4zA6bC0dE5fG --ca a1B2c3D4e5 --json

With --json, the result is an object with these fields:

pkiaas template

List a CA’s certificate templates.

pkiaas template [flags]

Commands:

• pkiaas template list

pkiaas template list

List a CA’s templates, by name.

pkiaas template list [--ca NAME|ID] [--limit N] [flags]

List the certificate templates of a CA, by default the active CA’s, by name, enabled or not. A template says what the certificates it issues hold; pkiaas request create --template takes its name or ID, and only enabled templates take requests. Templates are made and changed on the website.

It lists the first --limit templates (default 50, at most 1000); total says how many there are.

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas template list
pkiaas template list --ca a1B2c3D4e5 --json

With --json, the result is an object with these fields:

pkiaas version

Show the CLI’s version.

pkiaas version [flags]

Show the CLI’s version, and the Go version and platform it was built for. With --licenses, show the licences of the third-party code in the CLI instead (as text, even with --json).

Flags:

Examples:

pkiaas version --json
pkiaas version --licenses

With --json, the result is an object with these fields:

pkiaas whoami

Show who you are logged in as.

pkiaas whoami [flags]

Show the server and the account the CLI is logged in to, and where the token comes from. Use it to check for a login: without one, it fails with exit code 3 and the code not_logged_in or invalid_token.

This command calls the PKIaaS server and needs a login.

Flags:

Examples:

pkiaas whoami --json

With --json, the result is an object with these fields: