# noust cert

Obtain, inspect and retire the SSL certificates of this server.

```bash
noust cert [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`acme`](#noust-cert-acme), [`ca`](#noust-cert-ca), [`create`](#noust-cert-create), [`delete`](#noust-cert-delete), [`info`](#noust-cert-info), [`list`](#noust-cert-list), [`remove-upload`](#noust-cert-remove-upload), [`renew`](#noust-cert-renew), [`revoke`](#noust-cert-revoke), [`source`](#noust-cert-source), [`upload`](#noust-cert-upload), [`uploads`](#noust-cert-uploads), [`use`](#noust-cert-use)

## noust cert acme

Show, or change, which authority certificates are ordered from and as whom.

```bash
noust cert acme [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--ca` | letsencrypt, letsencrypt-staging (try a setup without spending the rate limit), zerossl, google or custom. |  |
| `--email` | The address registered with the authority. |  |
| `--server` | The directory URL of a custom authority. |  |
| `--eab-kid` | The key id of the external account (ZeroSSL, Google). |  |
| `--eab-hmac-key-stdin` | Read the external account's HMAC key from standard input. An argument would be in ps. |  |
| `--register` | Register the account with the authority now. |  |
| `--json` | Print the settings as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert ca

The server's own certificate authority, for names that only resolve inside a network.

```bash
noust cert ca [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`init`](#noust-cert-ca-init), [`issue`](#noust-cert-ca-issue), [`list`](#noust-cert-ca-list), [`remove`](#noust-cert-ca-remove), [`renew`](#noust-cert-ca-renew), [`root`](#noust-cert-ca-root), [`status`](#noust-cert-ca-status), [`trust`](#noust-cert-ca-trust)

## noust cert ca init

Make this server's authority.

```bash
noust cert ca init [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--permit-dns` | Also sign for names under this suffix (corp.example.com). Repeatable. |  |
| `--permit-network` | Also sign for addresses in this private range (10.20.0.0/16). Repeatable. |  |
| `--only` | Sign for exactly what --permit-dns and --permit-network name, not for the defaults (lan, internal, home.arpa, local, localhost, test and the private ranges). |  |
| `--days` | How long the authority is valid. | `3650` |
| `--name` | What the authority is called on a device. |  |
| `--trust-here` | Also trust it on this server (programs here use it). |  |
| `--json` | Print the authority as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert ca issue

Sign a certificate for some names and keep it as internal-LABEL.

```bash
noust cert ca issue [OPTIONS] LABEL HOST...
```

Arguments: `label`, `hosts`

| Option | What it does | Default |
|---|---|---|
| `--days` | How long the certificate is valid. | `90` |
| `--json` | Print the certificate as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert ca list

List the certificates the authority signed that are kept, soonest to expire first.

```bash
noust cert ca list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the certificates as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert ca remove

Delete the authority and its key.

```bash
noust cert ca remove [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--force` | Also when certificates it signed are still kept. |  |
| `-y`, `--yes` | Do not ask. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert ca renew

Sign a certificate again, for the same names and as long, and reload the sites that serve it.

```bash
noust cert ca renew [OPTIONS] [NAME]
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--due` | Renew every certificate that is within its window. |  |
| `--json` | Print what was renewed as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert ca root

Print the authority's certificate: public, what a device installs. The key never leaves.

```bash
noust cert ca root [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--der` | The binary form Windows, Android and Java import. |  |
| `--out` | Write it to this file instead of printing it (needed with --der). |  |
| `--json` | Print the certificate and its fingerprint as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert ca status

Show the authority: what it signs for, when it expires, and whether this server trusts it.

```bash
noust cert ca status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the authority as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert ca trust

Say how to trust the authority on a device (TARGET), or trust it on this server (--here).

```bash
noust cert ca trust [OPTIONS] [debian|rhel|alpine|arch|macos|windows|io
                           s|android|firefox|java|node|curl]
```

Arguments: `target`

| Option | What it does | Default |
|---|---|---|
| `--here` | Trust the authority on this server. |  |
| `--remove` | With --here: stop trusting it on this server. |  |
| `--json` | Print the steps as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert create

Obtain a certificate for one or more domains.

```bash
noust cert create [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-d`, `--domain` | Domain to cover. Repeat it for every extra name on the certificate. |  |
| `-e`, `--email` | Address Let's Encrypt sends expiry warnings to. |  |
| `-w`, `--webroot` | Directory served at the domain, where the challenge files are written. |  |
| `--standalone` | Answer the challenge with certbot's own server. Port 80 must be free. |  |
| `--nginx` | Answer the challenge through the running Nginx. |  |
| `--apache` | Answer the challenge through the running Apache. |  |
| `--expand` | Add these domains to the existing certificate instead of leaving it alone. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert delete

Remove the certificate files for DOMAIN from this machine.

```bash
noust cert delete [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `-f`, `--force` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert info

Show what the certificate for DOMAIN covers and when it expires.

```bash
noust cert info [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the certificate's details as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert list

List the certificates this machine holds, with their expiry dates.

```bash
noust cert list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--open` | Print the panel URL for the certificate list, opening it if a display is available. |  |
| `--json` | Print the certificate list as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert remove-upload

Delete an uploaded certificate. One an application serves cannot be deleted.

```bash
noust cert remove-upload [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `-y`, `--yes` | Do not ask. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert renew

Renew certificates before they expire.

```bash
noust cert renew [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-d`, `--domain` | Renew only this certificate. Default: every certificate that is due. |  |
| `--force` | Renew even when the certificate is not near expiry. Counts against the rate limit. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert revoke

Tell Let's Encrypt that the certificate for DOMAIN must no longer be trusted.

```bash
noust cert revoke [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--delete`, `--keep-files` | Also remove the certificate files afterwards. Default: remove them. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert source

Show where APP's certificate comes from, and what is served.

```bash
noust cert source [OPTIONS] APP
```

Arguments: `app_domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the description as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert upload

Check a certificate and its key, and keep them as NAME.

```bash
noust cert upload [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--cert` | The certificate (PEM); '-' reads stdin. |  |
| `--key` | Its private key (PEM, no passphrase); '-' reads stdin. |  |
| `--chain` | The intermediates (PEM), when they come apart. |  |
| `--json` | Print the record as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert uploads

List the uploaded certificates, what they cover, when they expire and who serves them.

```bash
noust cert uploads [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the uploads as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust cert use

Choose where APP's certificate comes from: ordered (over HTTP, or DNS with --dns), uploaded, or signed by this server's own authority (--internal).

```bash
noust cert use [OPTIONS] APP
```

Arguments: `app_domain`

| Option | What it does | Default |
|---|---|---|
| `--acme` | Have it ordered from the authority. |  |
| `--upload` | Serve this uploaded certificate. |  |
| `--internal` | Sign it with this server's own authority (noust cert ca init), for a private name. |  |
| `--days` | With --internal: how long the certificate is valid (90 days by default). |  |
| `--dns` | Prove control with a DNS record in this account's zone (needed for a wildcard). |  |
| `--no-order` | Only keep the choice; the next order uses it. |  |
| `--json` | Print the certificate as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |