Note: this was converted from the man page. Do not edit this document directly.

{{{
#!html
<H1>creddy</H1>
creddy - ABAC X.509 identity and attribute certificate manager (for cool kids)
<P>
<A NAME="lbAC">&nbsp;</A>
<H2>SYNOPSIS</H2>

<P>
<B>creddy [ --&lt;mode&gt; ] --help</B>

<P>
<A NAME="lbAD">&nbsp;</A>
<H2>DESCRIPTION</H2>

<P>
creddy is an awesome and wonderful ABAC credential management tool. It
creates, verifies, and otherwise frobnicates X.509 identity and
attribute certificates. The output of the tool is suitable for use with
ABAC. Additionally, the self-signed X.509 identity certs (with
associated private keys) can be used with OpenSSL.
<P>
<A NAME="lbAE">&nbsp;</A>
<H2>OPTIONS</H2>

<P>
<A NAME="lbAF">&nbsp;</A>
<H3>--generate</H3>

Generate an X.509 identity cert and private key pair. The certificate is saved in ${cn}_id.pem and the private key is saved in ${cn}_private.pem.
<P>

Note that private key generation is slow and uses a lot of entropy. You can generate entropy by moving your mouse a lot or running large find commands on your local file systems.
<P>
<DL COMPACT>
<DT><B>--cn</B>

<DD>
common name used on certificate, provided as a convenience and ignored by ABAC
<P>
<DT><B>--validity</B>

<DD>
optional certificate validity in days, default is 1080
<P>
</DL>
<A NAME="lbAG">&nbsp;</A>
<H3>--verify</H3>

verify the signature on a self-signed X.509 identity cert or an X.509 attribute cert
<P>
<DL COMPACT>
<DT><B>--cert</B>

<DD>
self-signed X.509 identity cert
<P>
<DT><B>--attrcert</B>

<DD>
optional X.509 attribute cert. If omitted the self-signature of the ID cert is checked
<P>
</DL>
<A NAME="lbAH">&nbsp;</A>
<H3>--keyid</H3>

extract the subjectKeyIdentifier (SHA1 hash) from an X.509 identity cert
<P>
<DL COMPACT>
<DT><B>--cert</B>

<DD>
X.509 identity cert
<P>
</DL>
<A NAME="lbAI">&nbsp;</A>
<H3>--attribute</H3>

generate an X.509 attribute cert representing an ABAC credential
<P>
<DL COMPACT>
<DT><B>--issuer</B>

<DD>
X.509 identity cert issuing the credential
<P>
<DT><B>--key</B>

<DD>
private key associated with issuer cert
<P>
<DT><B>--role</B>

<DD>
role in issuer's local attribute space.  Must start with a letter and be alphanumeric thereafter.
<P>
<DT><B>--subject-cert</B>

<DD>
X.509 identity cert representing the principal to which the role is being issued. This is mutually exclusive to --subject-id.
<P>
<DT><B>--subject-id</B>

<DD>
public key identifier (SHA1 hash) of the principal to which the role is being issued. This is mutually exclusive to --subject-cert.
<P>
<DT><B>--subject-role</B>

<DD>
optional role in subject's local attribute space. Must start with a letter and be alphanumeric thereafter. If the issuer is A, role is r1, subject is B, and subject-role is r2, the attribute issued will be A.r1 &lt;- B.r2.
<P>
<DT><B>--validity</B>

<DD>
optional certificate validity in days, default is 365
<P>
<DT><B>--out</B>

<DD>
where to save DER-encoded attribute cert. In order to interoperate with the rest of ABAC, this name should end in _attr.der.
<P>
</DL>
<A NAME="lbAJ">&nbsp;</A>
<H3>--roles</H3>

Extract the roles from an X.509 attribute cert
<P>
<DL COMPACT>
<DT><B>--cert</B>

<DD>
X.509 attribute cert containing ABAC roles
<P>
</DL>
<A NAME="lbAK">&nbsp;</A>
<H3>--version</H3>

display ABAC/creddy version
<P>
<A NAME="lbAL">&nbsp;</A>
<H2>EXAMPLES</H2>

<P>
<DL COMPACT>
<DT>Generate ID cert and private key pairs:<DD>
<P>
<B>creddy --generate --cn Alice</B>

<BR>

<B>creddy --generate --cn Bob</B>

<P>
<DT>Issue the credential Alice.friend &lt;- Bob<DD>
<P>
creddy --attribute \
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;--issuer&nbsp;Alice_ID.pem&nbsp;--key&nbsp;Alice_private.pem&nbsp;\
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;--role&nbsp;friend&nbsp;--subject-cert&nbsp;Bob_ID.pem&nbsp;\
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;--out&nbsp;Alice_friend__Bob_attr.der
<P>
</DL>
}}}