tor

The Tor anonymity network
git clone https://git.dasho.dev/tor.git
Log | Files | Refs | README | LICENSE

tor-gencert.1.txt (3043B)

      1 // Copyright (c) The Tor Project, Inc.
      2 // See LICENSE for licensing information
      3 // This is an asciidoc file used to generate the manpage/html reference.
      4 // Learn asciidoc on https://www.methods.co.nz/asciidoc/userguide.html
      5 :man source:   Tor
      6 :man manual:   Tor Manual
      7 tor-gencert(1)
      8 ==============
      9 Tor Project, Inc.
     10 
     11 NAME
     12 ----
     13 tor-gencert - Generate certs and keys for Tor directory authorities
     14 
     15 SYNOPSIS
     16 --------
     17 **tor-gencert** [-h|--help] [-v] [-r|--reuse] [--create-identity-key] [-i __id_file__] [-c
     18 __cert_file__] [-m __num__] [-a __address__:__port__]
     19 
     20 DESCRIPTION
     21 -----------
     22 **tor-gencert** generates certificates and private keys for use by Tor
     23 directory authorities running the v3 Tor directory protocol, as used by
     24 Tor 0.2.0 and later. If you are not running a directory authority, you
     25 don't need to use tor-gencert. +
     26 
     27 Every directory authority has a long term authority __identity__ __key__ (which
     28 is distinct from the identity key it uses as a Tor server); this key
     29 should be kept offline in a secure location. It is used to certify
     30 shorter-lived __signing__ __keys__, which are kept online and used by the
     31 directory authority to sign votes and consensus documents. +
     32 
     33 After you use this program to generate a signing key and a certificate,
     34 copy those files to the keys subdirectory of your Tor process, and send
     35 Tor a SIGHUP signal. DO NOT COPY THE IDENTITY KEY.
     36 
     37 OPTIONS
     38 -------
     39 **-v**::
     40    Display verbose output.
     41 
     42 **-h** or **--help**::
     43    Display help text and exit.
     44 
     45 **-r** or **--reuse**::
     46    Generate a new certificate, but not a new signing key. This can be used to
     47    change the address or lifetime associated with a given key.
     48 
     49 **--create-identity-key**::
     50    Generate a new identity key. You should only use this option the first time
     51    you run tor-gencert; in the future, you should use the identity key that's
     52    already there.
     53 
     54 **-i** __FILENAME__::
     55    Read the identity key from the specified file. If the file is not present
     56    and --create-identity-key is provided, create the identity key in the
     57    specified file. Default: "./authority_identity_key"
     58 
     59 **-s** __FILENAME__::
     60    Write the signing key to the specified file. Default:
     61    "./authority_signing_key"
     62 
     63 **-c** __FILENAME__::
     64    Write the certificate to the specified file. Default:
     65    "./authority_certificate"
     66 
     67 **-m** __NUM__::
     68    Number of months that the certificate should be valid. Default: 12.
     69 
     70 **--passphrase-fd** __FILEDES__::
     71    Filedescriptor to read the passphrase from. Ends at the first NUL or
     72    newline. Default: read from the terminal.
     73 
     74 **-a** __address__:__port__::
     75    If provided, advertise the address:port combination as this authority's
     76    preferred directory port in its certificate. If the address is a hostname,
     77    the hostname is resolved to an IP before it's published.
     78 
     79 BUGS
     80 ----
     81 This probably doesn't run on Windows. That's not a big issue, since we don't
     82 really want authorities to be running on Windows anyway.
     83 
     84 SEE ALSO
     85 --------
     86 **tor**(1) +
     87 
     88 See also the "dir-spec.txt" file, distributed with Tor.