CLI

Complete command reference for QPKI.

Command Tree

qpki [--audit-log PATH]
├── ca                        # Certificate Authority → CA.md
│   ├── init                  # Initialize CA (root or subordinate)
│   ├── info                  # Display CA information
│   ├── export                # Export CA certificates
│   ├── list                  # List CAs in directory
│   ├── rotate                # Rotate CA with new keys
│   ├── activate              # Activate pending CA version
│   └── versions              # List CA versions
│
├── cert                      # Certificate operations → CA.md
│   ├── issue                 # Issue certificate from CSR
│   ├── list                  # List issued certificates
│   ├── info                  # Display certificate info
│   ├── revoke                # Revoke a certificate
│   └── verify                # Verify certificate validity
│
├── credential                # Credentials → CREDENTIALS.md
│   ├── enroll                # Create new credential
│   ├── list                  # List credentials
│   ├── info                  # Credential details
│   ├── rotate                # Rotate credential
│   ├── activate              # Activate pending version
│   ├── versions              # List credential versions
│   ├── revoke                # Revoke credential
│   └── export                # Export credential
│
├── key                       # Key management → KEYS.md
│   ├── generate              # Generate key pair (alias: gen)
│   ├── pub                   # Extract public key
│   ├── list                  # List keys
│   ├── info                  # Key information
│   └── convert               # Convert key format
│
├── csr                       # CSR operations → KEYS.md
│   ├── gen                   # Generate CSR
│   ├── info                  # Display CSR info
│   └── verify                # Verify CSR signature
│
├── crl                       # CRL operations → CA.md
│   ├── gen                   # Generate CRL
│   ├── info                  # Display CRL info
│   ├── verify                # Verify CRL signature
│   └── list                  # List CRLs
│
├── profile                   # Certificate profiles → PROFILES.md
│   ├── list                  # List available profiles
│   ├── info                  # Profile details
│   ├── vars                  # Show profile variables
│   ├── show                  # Display YAML content
│   ├── export                # Export profile to file
│   ├── lint                  # Validate profile YAML
│   └── install               # Install default profiles
│
├── tsa                       # Timestamping → TSA.md
│   ├── sign                  # Create timestamp token
│   ├── verify                # Verify timestamp token
│   └── serve                 # Start TSA HTTP server
│
├── cms                       # CMS signatures → CMS.md
│   ├── sign                  # Create CMS signature
│   ├── verify                # Verify CMS signature
│   ├── encrypt               # Encrypt with CMS
│   ├── decrypt               # Decrypt CMS
│   └── info                  # Display CMS info
│
├── ocsp                      # OCSP responder → OCSP.md
│   ├── sign                  # Create OCSP response
│   ├── verify                # Verify OCSP response
│   ├── request               # Create OCSP request
│   ├── info                  # Display OCSP response info
│   └── serve                 # Start OCSP HTTP server
│
├── hsm                       # HSM integration → HSM.md
│   ├── list                  # List HSM slots/tokens
│   ├── test                  # Test HSM connectivity
│   ├── info                  # Display HSM token info
│   └── mechanisms            # List supported PKCS#11 mechanisms
│
├── ssh                       # SSH Certificates → SSH.md
│   ├── ca-init               # Initialize SSH CA
│   ├── ca-info               # Display SSH CA information
│   ├── issue                 # Issue SSH certificate
│   ├── inspect               # Inspect SSH certificate
│   ├── list                  # List issued SSH certificates
│   ├── revoke                # Revoke SSH certificate
│   └── krl                   # Generate Key Revocation List (KRL)
│
├── audit                     # Audit logging → AUDIT.md
│   ├── verify                # Verify audit log integrity
│   └── tail                  # Show recent audit events
│
├── serve                     # REST API Server → api/SERVER.md
│   [--port PORT]             # Port for all services (default: 8443)
│   [--api-port PORT]         # Port for REST API
│   [--ocsp-port PORT]        # Port for OCSP responder
│   [--tsa-port PORT]         # Port for TSA responder
│   [--services LIST]         # Services: api,ocsp,tsa,all
│   [--ca-dir DIR]            # CA directory
│   [--tls-cert FILE]         # TLS certificate
│   [--tls-key FILE]          # TLS private key
│
└── inspect                   # Auto-detect and display file info

Quick Reference

Category	Command	Description	Documentation
Keys	`key generate`	Generate a private key	KEYS
	`key pub`	Extract public key	KEYS
	`key list`	List keys in directory	KEYS
	`key info`	Display key details	KEYS
	`key convert`	Convert key format	KEYS
CA	`ca init`	Initialize a certificate authority	CA
	`ca info`	Display CA information	CA
	`ca export`	Export CA certificates	CA
	`ca list`	List CAs in directory	CA
	`ca rotate`	Rotate CA with new keys	CA
	`ca activate`	Activate a pending version	CA
	`ca versions`	List CA versions	CA
CSR	`csr gen`	Generate a certificate signing request	KEYS
	`csr info`	Display CSR details	KEYS
	`csr verify`	Verify CSR signature	KEYS
Certificates	`cert issue`	Issue certificate from CSR	Certificates
	`cert list`	List certificates in CA	Certificates
	`cert info`	Display certificate details	Certificates
	`cert revoke`	Revoke a certificate	CRL
	`cert verify`	Verify a certificate	Certificates
Credentials	`credential enroll`	Issue key(s) + certificate(s)	Credentials
	`credential list`	List credentials	Credentials
	`credential info`	Credential details	Credentials
	`credential rotate`	Rotate a credential	Credentials
	`credential activate`	Activate pending version	Credentials
	`credential versions`	List credential versions	Credentials
	`credential revoke`	Revoke a credential	Credentials
	`credential export`	Export credential	Credentials
CRL	`crl gen`	Generate a CRL	CRL
	`crl info`	Display CRL details	CRL
	`crl verify`	Verify a CRL	CRL
	`crl list`	List CRLs in CA	CRL
Profiles	`profile list`	List available profiles	Profiles
	`profile info`	Display profile details	Profiles
	`profile vars`	List profile variables	Profiles
	`profile show`	Display profile YAML	Profiles
	`profile export`	Export a profile	Profiles
	`profile lint`	Validate profile YAML	Profiles
	`profile install`	Install default profiles	Profiles
Inspection	`inspect`	Auto-detect and display file info	inspect
CMS	`cms sign`	Create CMS signature	CMS
	`cms verify`	Verify CMS signature	CMS
	`cms encrypt`	Encrypt with CMS	CMS
	`cms decrypt`	Decrypt CMS	CMS
	`cms info`	Display CMS message details	CMS
TSA	`tsa sign`	Timestamp a file	TSA
	`tsa verify`	Verify timestamp token	TSA
	`tsa serve`	Start TSA HTTP server	TSA
OCSP	`ocsp sign`	Create OCSP response	OCSP
	`ocsp verify`	Verify OCSP response	OCSP
	`ocsp request`	Create OCSP request	OCSP
	`ocsp info`	Display OCSP response info	OCSP
	`ocsp serve`	Start OCSP HTTP server	OCSP
HSM	`hsm list`	List HSM slots/tokens	HSM
	`hsm test`	Test HSM connectivity	HSM
	`hsm info`	Display HSM token info	HSM
	`hsm mechanisms`	List supported PKCS#11 mechanisms	HSM
SSH	`ssh ca-init`	Initialize SSH CA	SSH
	`ssh ca-info`	Display SSH CA info	SSH
	`ssh issue`	Issue SSH certificate	SSH
	`ssh inspect`	Inspect SSH certificate	SSH
	`ssh list`	List SSH certificates	SSH
	`ssh revoke`	Revoke SSH certificate	SSH
	`ssh krl`	Generate KRL file	SSH
Audit	`audit verify`	Verify audit log integrity	Audit
	`audit tail`	Show recent audit events	Audit
Server	`serve`	Start REST API server	API Server

Global Flags

Flag	Environment Variable	Description
`--audit-log PATH`	`PKI_AUDIT_LOG`	Enable audit logging to file

Supported Algorithms

Classical:

ecdsa-p256, ecdsa-p384, ecdsa-p521
ed25519
rsa-2048, rsa-4096

Post-Quantum (FIPS 204/205/203):

ml-dsa-44, ml-dsa-65, ml-dsa-87 (signature)
slh-dsa-128s, slh-dsa-192s, slh-dsa-256s (signature, hash-based)
ml-kem-512, ml-kem-768, ml-kem-1024 (key encapsulation)

Hybrid modes:

Catalyst (ITU-T X.509 Section 9.8)
Composite (IETF draft-13)

See Post-Quantum for algorithm details.

Exit Codes

Code	Meaning
0	Success
1	Error (invalid input, operation failed, etc.)

inspect

Auto-detect and display information about PKI files.

qpki inspect <file>

Supported file types:

Type	Extensions	Description
Certificate	.crt, .pem, .cer	X.509 certificates (classical and PQC)
CSR	.csr	Certificate Signing Requests
Private Key	.key, .pem	Private keys (shows algorithm, encryption status)
CRL	.crl	Certificate Revocation Lists
Timestamp Token	.tsr	RFC 3161 timestamp tokens
CMS SignedData	.p7s, .p7m	CMS signatures and encrypted data
SSH Certificate	*-cert.pub	OpenSSH certificates

Examples:

# Inspect a certificate (shows subject, issuer, validity, extensions)
qpki inspect server.crt

# Inspect a CSR (shows subject, signature algorithm, verification)
qpki inspect request.csr

# Inspect a private key (shows algorithm, encryption status)
qpki inspect key.pem

# Inspect a CRL (shows issuer, revoked certificates)
qpki inspect ca.crl

# Inspect a timestamp token
qpki inspect document.tsr

# Inspect CMS SignedData
qpki inspect signature.p7s

Output includes:

For certificates: Version, serial, subject, issuer, validity period, key usage, SANs, hybrid extension info
For CSRs: Subject, signature algorithm, signature verification result
For private keys: Algorithm, key size, encryption status
For CRLs: Issuer, this/next update, revoked certificate list
For timestamp tokens: Time, policy OID, hash algorithm, signer info
For CMS: Content type, signers/recipients, embedded certificates

CLI

CLI