@certman/cli

Command-line interface for Certman - create and manage your own Certificate Authority for internal HTTPS.

Installation

Homebrew (macOS/Linux)

brew install certman/tap/certman

npm

npm install -g @certman/cli

Standalone binaries

Download pre-built binaries from the releases page.

Available for:

• Linux (amd64, arm64)
• macOS (amd64, arm64)
• Windows (amd64)

Debian/Ubuntu

# Download the .deb package from releases, then:
sudo dpkg -i certman-linux-amd64.deb

Quick Start

# Authenticate with your API key
certman login

# List your Certificate Authorities
certman ca list

# Issue a certificate
certman cert issue --ca-id <ca-id> --common-name example.local --san-dns example.local

# Write certificate and key to files
certman cert issue --ca-id <ca-id> --san-dns app.local --out-cert cert.pem --out-key key.pem

Commands

Authentication

certman login              # Authenticate with your API key
certman logout             # Remove stored credentials
certman whoami             # Show current user info

Certificate Authorities

certman ca list            # List all CAs
certman ca get <id>        # Get CA details

Certificates

certman cert list          # List all certificates
certman cert issue         # Issue a new certificate
certman cert revoke <id>   # Revoke a certificate
certman cert renew <id>    # Renew a certificate

Issuing Certificates

Managed mode (key generated by Certman)

certman cert issue \
  --ca-id <ca-id> \
  --common-name myapp.local \
  --san-dns myapp.local,api.myapp.local \
  --san-ip 192.168.1.100 \
  --validity-days 365 \
  --out-cert cert.pem \
  --out-key key.pem

CSR mode (bring your own key)

certman cert issue \
  --ca-id <ca-id> \
  --csr request.csr \
  --out-cert cert.pem

Options

| Option | Description | |--------|-------------| | --ca-id | CA to issue from (required) | | --common-name | Certificate common name | | --san-dns | DNS SANs (comma-separated) | | --san-ip | IP SANs (comma-separated) | | --key-algorithm | RSA-2048, RSA-4096, ECDSA-P256, ECDSA-P384 (default: ECDSA-P256) | | --validity-days | Validity period in days (default: 365) | | --csr | Path to CSR file (for CSR mode) | | --ca-passphrase | CA passphrase if required | | --out-cert | Write certificate to file (prints to stdout if not specified) | | --out-key | Write private key to file (prints to stdout if not specified) | | --json | Output as JSON |

Configuration

Credentials are stored in ~/.certman/config.json.

Environment Variables

| Variable | Description | |----------|-------------| | CERTMAN_API_KEY | API key (overrides config file) | | CERTMAN_API_URL | API URL (for self-hosted instances) |

Command-line Options

All commands accept --api-key and --api-url options to override defaults.

License

MIT