skipca(1M)

NAME
skipca - Manage the SKIP Certificate Authorities Database

SYNOPSIS
/usr/sbin/skipca -[a|r|l|i|e|R|U] [action specific arguments]...

DESCRIPTION
The skipca command is the primary tool used in creating and managing the trusted authorities database. When a Certificate Authority (CA)is designated as trusted, any certificate signed by that authority is believed to be legitimate.

OPTIONS

-a -c ca-file
    Places new certificates into the trusted Certificate Authority database. The ca-file is an X509 certificate which is either self-signed or signed by an existing trusted CA in this CA database. -a does not copy over a CA certificate if it already exists in the CA database.

-e [ -s ca-slot]
    Writes the CA certificate in the specified slot-number to the standard output. If the output is redirected to a file, the file is suitable for the skipca -a command.

-i [-qo]
    Prior to use, the CA database must be initialized. The -i subcommand performs this operation. If the CA database exists, the -o option will delete the contents of the database, destroying any existing certificates. The -q option prevents status messages from being printed.

-l [-VvxL] [-s ca-slot]
Lists all the certificates in the CA database by slot number, issuer, and subject. If a slot number is specified, only the CA Certificate for that slot is printed. The -L flag enables printing of the Certificate validity periods. -v enables a verbose display of the entire certificate. If -V is specified, the output is displayed in a machine parseable manner. If -x is specified the manual revocation list for that CA is display.

-R -s ca-slot -S serial-number
    Each CA maintains a list of certificates which have been revoked by the user. This is different from a traditional CRL as it is not distributed by the CA and is manually maintained. This subcommand allows the user to add certificates to the per-CA list of revoked certificates. ca-slot specifies which CA to operate on. The ca-slot may be obtained through the skipca -l command. serial-number is the serial number of the certificate which you wish revoke. Each X509 Certificate produced by a CA is given a unique serial number.

-r [-s ca-slot]
    deletes the CA certificate in the specified slot number.

-U -s ca-slot -S serial-number
    removes hosts from the per CA revocation list (i.e., ``unrevokes'' them. ca-slot and serial-number are the same as the arguments for -r.

SECURITY CONSIDERATIONS

This command has broad security implications. By designating a CA as trusted, you are trusting the identity of ALL certificate signed by that CA. Since root CA certificates are self signed, there is no automated way to verify that the certificate actually comes from that CA. Before adding a CA Certificate, you MUST be absolutely certain that the certificate is valid. Validity may be checked by having the CA publish the hash of it's certificate publically and comparing that hash with the hash obtained from the certificate.

USAGE

You must be root to run this command.

Note, the system must be rebooted or the key manager must be restarted with the skipd_restart command before changes take effect.

RETURN VALUES
skipca will always return 0 on success and non-zero on error. An appropriate error message will be written to standard error.

FILES

/etc/skip/CAs

SEE ALSO
skipdb(1m) skiplocal(1m) skipd(1m)