diff options
Diffstat (limited to 'src/pki/man/pki---self.1.in')
| -rw-r--r-- | src/pki/man/pki---self.1.in | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/src/pki/man/pki---self.1.in b/src/pki/man/pki---self.1.in index 9461e3eff..aa7e6fabe 100644 --- a/src/pki/man/pki---self.1.in +++ b/src/pki/man/pki---self.1.in @@ -1,4 +1,4 @@ -.TH "PKI \-\-SELF" 1 "2013-07-31" "@PACKAGE_VERSION@" "strongSwan" +.TH "PKI \-\-SELF" 1 "2016-12-13" "@PACKAGE_VERSION@" "strongSwan" . .SH "NAME" . @@ -22,6 +22,7 @@ pki \-\-self \- Create a self-signed certificate .OP \-\-ca .OP \-\-ocsp uri .OP \-\-pathlen len +.OP \-\-addrblock block .OP \-\-nc-permitted name .OP \-\-nc-excluded name .OP \-\-policy\-mapping mapping @@ -65,11 +66,12 @@ Read command line options from \fIfile\fR. Private key input file. If not given the key is read from \fISTDIN\fR. .TP .BI "\-x, \-\-keyid " hex -Key ID of a private key on a smartcard. +Smartcard or TPM private key object handle in hex format with an optional +0x prefix. .TP .BI "\-t, \-\-type " type -Type of the input key. Either \fIpriv\fR, \fIrsa\fR, \fIecdsa\fR or \fIbliss\fR, -defaults to \fIpriv\fR. +Type of the input key. Either \fIpriv\fR, \fIrsa\fR, \fIecdsa\fR, \fIed25519\fR +or \fIbliss\fR, defaults to \fIpriv\fR. .TP .BI "\-d, \-\-dn " distinguished-name Subject and issuer distinguished name (DN). Required. @@ -127,6 +129,14 @@ times. .BI "\-p, \-\-pathlen " len Set path length constraint. .TP +.BI "\-B, \-\-addrblock " block +RFC 3779 address block to include in certificate. \fIblock\fR is either a +CIDR subnet (such as \fI10.0.0.0/8\fR) or an arbitrary address range +(\fI192.168.1.7-192.168.1.13\fR). Can be repeated to include multiple blocks. +Please note that the supplied blocks are included in the certificate as is, +so for standards compliance, multiple blocks must be supplied in correct +order and adjacent blocks must be combined. Refer to RFC 3779 for details. +.TP .BI "\-n, \-\-nc-permitted " name Add permitted NameConstraint extension to certificate. For DNS or email constraints, the identity type is not always detectable by the given name. Use |