Skip to content
GitHub 6 Install 
curl -fsSL https://noust.dev/install.sh | sh

Language

Esta página solo está en inglés: abre la portada de la documentación.

Theme
Install GitHub 6
Pages in Reference

noust cert

Obtain, inspect and retire the SSL certificates of this server.

Reference Updated View as Markdown
Shell
noust cert [OPTIONS] COMMAND [ARGS]...

Subcommands: acme, ca, create, delete, info, list, remove-upload, renew, revoke, source, upload, uploads, use

noust cert acme

Show, or change, which authority certificates are ordered from and as whom.

Shell
noust cert acme [OPTIONS]
Option What it does Default
--ca letsencrypt, letsencrypt-staging (try a setup without spending the rate limit), zerossl, google or custom.
--email The address registered with the authority.
--server The directory URL of a custom authority.
--eab-kid The key id of the external account (ZeroSSL, Google).
--eab-hmac-key-stdin Read the external account's HMAC key from standard input. An argument would be in ps.
--register Register the account with the authority now.
--json Print the settings as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert ca

The server's own certificate authority, for names that only resolve inside a network.

Shell
noust cert ca [OPTIONS] COMMAND [ARGS]...

Subcommands: init, issue, list, remove, renew, root, status, trust

noust cert ca init

Make this server's authority.

Shell
noust cert ca init [OPTIONS]
Option What it does Default
--permit-dns Also sign for names under this suffix (corp.example.com). Repeatable.
--permit-network Also sign for addresses in this private range (10.20.0.0/16). Repeatable.
--only Sign for exactly what --permit-dns and --permit-network name, not for the defaults (lan, internal, home.arpa, local, localhost, test and the private ranges).
--days How long the authority is valid. 3650
--name What the authority is called on a device.
--trust-here Also trust it on this server (programs here use it).
--json Print the authority as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert ca issue

Sign a certificate for some names and keep it as internal-LABEL.

Shell
noust cert ca issue [OPTIONS] LABEL HOST...

Arguments: label, hosts

Option What it does Default
--days How long the certificate is valid. 90
--json Print the certificate as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert ca list

List the certificates the authority signed that are kept, soonest to expire first.

Shell
noust cert ca list [OPTIONS]
Option What it does Default
--json Print the certificates as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert ca remove

Delete the authority and its key.

Shell
noust cert ca remove [OPTIONS]
Option What it does Default
--force Also when certificates it signed are still kept.
-y, --yes Do not ask.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert ca renew

Sign a certificate again, for the same names and as long, and reload the sites that serve it.

Shell
noust cert ca renew [OPTIONS] [NAME]

Arguments: name

Option What it does Default
--due Renew every certificate that is within its window.
--json Print what was renewed as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert ca root

Print the authority's certificate: public, what a device installs. The key never leaves.

Shell
noust cert ca root [OPTIONS]
Option What it does Default
--der The binary form Windows, Android and Java import.
--out Write it to this file instead of printing it (needed with --der).
--json Print the certificate and its fingerprint as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert ca status

Show the authority: what it signs for, when it expires, and whether this server trusts it.

Shell
noust cert ca status [OPTIONS]
Option What it does Default
--json Print the authority as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert ca trust

Say how to trust the authority on a device (TARGET), or trust it on this server (--here).

Shell
noust cert ca trust [OPTIONS] [debian|rhel|alpine|arch|macos|windows|io
                           s|android|firefox|java|node|curl]

Arguments: target

Option What it does Default
--here Trust the authority on this server.
--remove With --here: stop trusting it on this server.
--json Print the steps as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert create

Obtain a certificate for one or more domains.

Shell
noust cert create [OPTIONS]
Option What it does Default
-d, --domain Domain to cover. Repeat it for every extra name on the certificate.
-e, --email Address Let's Encrypt sends expiry warnings to.
-w, --webroot Directory served at the domain, where the challenge files are written.
--standalone Answer the challenge with certbot's own server. Port 80 must be free.
--nginx Answer the challenge through the running Nginx.
--apache Answer the challenge through the running Apache.
--expand Add these domains to the existing certificate instead of leaving it alone.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert delete

Remove the certificate files for DOMAIN from this machine.

Shell
noust cert delete [OPTIONS] DOMAIN

Arguments: domain

Option What it does Default
-f, --force Do not ask for confirmation.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert info

Show what the certificate for DOMAIN covers and when it expires.

Shell
noust cert info [OPTIONS] DOMAIN

Arguments: domain

Option What it does Default
--json Print the certificate's details as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert list

List the certificates this machine holds, with their expiry dates.

Shell
noust cert list [OPTIONS]
Option What it does Default
--open Print the panel URL for the certificate list, opening it if a display is available.
--json Print the certificate list as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert remove-upload

Delete an uploaded certificate. One an application serves cannot be deleted.

Shell
noust cert remove-upload [OPTIONS] NAME

Arguments: name

Option What it does Default
-y, --yes Do not ask.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert renew

Renew certificates before they expire.

Shell
noust cert renew [OPTIONS]
Option What it does Default
-d, --domain Renew only this certificate. Default: every certificate that is due.
--force Renew even when the certificate is not near expiry. Counts against the rate limit.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert revoke

Tell Let's Encrypt that the certificate for DOMAIN must no longer be trusted.

Shell
noust cert revoke [OPTIONS] DOMAIN

Arguments: domain

Option What it does Default
--delete, --keep-files Also remove the certificate files afterwards. Default: remove them.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert source

Show where APP's certificate comes from, and what is served.

Shell
noust cert source [OPTIONS] APP

Arguments: app_domain

Option What it does Default
--json Print the description as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert upload

Check a certificate and its key, and keep them as NAME.

Shell
noust cert upload [OPTIONS] NAME

Arguments: name

Option What it does Default
--cert The certificate (PEM); '-' reads stdin.
--key Its private key (PEM, no passphrase); '-' reads stdin.
--chain The intermediates (PEM), when they come apart.
--json Print the record as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert uploads

List the uploaded certificates, what they cover, when they expire and who serves them.

Shell
noust cert uploads [OPTIONS]
Option What it does Default
--json Print the uploads as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust cert use

Choose where APP's certificate comes from: ordered (over HTTP, or DNS with --dns), uploaded, or signed by this server's own authority (--internal).

Shell
noust cert use [OPTIONS] APP

Arguments: app_domain

Option What it does Default
--acme Have it ordered from the authority.
--upload Serve this uploaded certificate.
--internal Sign it with this server's own authority (noust cert ca init), for a private name.
--days With --internal: how long the certificate is valid (90 days by default).
--dns Prove control with a DNS record in this account's zone (needed for a wildcard).
--no-order Only keep the choice; the next order uses it.
--json Print the certificate as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

Something on this page is wrong or unclear? Report it on GitHub.

Help, contributing and the project’s policies are under Project.

Search the documentation

Type to search every page.

↑ ↓ to move, Enter to open, Esc to close