Certificate Creation utility (createcert)

createcert [ -r | -s ]

Option	Prompt name	Description
@data	N/A	Reads in options from the specified environment variable or configuration file. See Configuration files. To protect passwords or other information in the configuration file, use the File Hiding utility (dbfhide) to obfuscate the contents of the configuration file. See File Hiding utility (dbfhide).
-b value	Enter RSA key length (512-16384)	Specifies the RSA key length. The length can between 512 bits and 16384 bits. This option is ignored when the -s option is specified.
-c filename	Enter file path of signer's certificate	Specifies a location and file name for the signer's certificate. If you supply this information, then the generated certificate is a signed certificate. If you do not supply this information, then the generated certificate is a self-signed root certificate. This option is ignored when the -r option is specified.
-ca {0 \| 1}	Certificate authority false (0) or true (1)	Creates a certificate authority certificate that can be used to sign other certificates. By default, certificates are not certificate authorities (0). This option is ignored when the -r option is specified.
-ck filename	Enter file path of signer's private key	A location and file name to save the private key associated with the certificate request. This option prompt only appears if you specify a file name for the -c option.
-co filename	Enter file path to save certificate	Writes the public certificate to the specified file. Specify a location and file name to save the certificate; otherwise, the certificate is not saved. This option is ignored when the -r option is specified.
-cp password	Enter password for signer's private key	Specifies the password that was used to encrypt the signer's private key. Only specify this password if the private key was encrypted. This option is ignored when the -r option is specified.
-io filename	Enter file path to save identity	Specifies a location and file name to save the generated identity. This option is ignored when the -r option is specified.
-ko filename	Enter file path to save private key	Specifies a location and file name to save the private key.
-kp password	Enter password to protect private key	Specifies a password with which to encrypt the private key. If you do not specify a password, the private key is not encrypted. This option only applies if you specify a file name with the -ko option.
-m value	Serial number	Specifies a serial number. The serial number must be a hexadecimal string of 40 digits or less. This number must be unique among all certificates signed by the current signer. If you do not specify a serial number, createcert generates a GUID as the serial number. This option is ignored when the -r option is specified.
-p1	N/A	Uses PKCS #1 to encode unencrypted RSA private keys instead of the default, PKCS #8.
-r	N/A	Generates a PKCS #10 certificate request. When this option is specified, the following options do not apply: -c -ca -ck -co -cp -m -io -u -x -v
-ro filename	File path to save request	Specifies a location and file name with which to save the PKCS #10 certificate request. This option only applies if you specify the -r option.
-s filename	N/A	Specifies the location and file name of the PKCS10 certificate request that is to be signed. The certificate request can be DER or PEM encoded. When this option is specified, the following options do not apply: -b -ec -sc -scn -sl -so -sou -sst -t -x
-sa value	N/A	Specifies which of the following signature algorithms to use: sha1, sha256, sha384, or sha512. The default algorithm is sha256.
-sc value	Subject information	Specifies the subject country code. This option is ignored when the -s option is specified.
-scn value	Subject information	Specifies the subject common name. This option is ignored when the -s option is specified.
-sl value	Subject information	Specifies the subject locality. This option is ignored when the -s option is specified.
-so value	Subject information	Specifies the subject organization. This option is ignored when the -s option is specified.
-sou value	Subject information	Specifies the subject organizational unit. This option is ignored when the -s option is specified.
-sst value	Subject information	Specifies the subject state. This option is ignored when the -s option is specified.
-t type	Choose encryption type	Specifies the encryption type. Specify RSA. This option is ignored when the -s option is specified.
-u value,...	Key usage	Specifies how the certificate will be used. Specify a comma-separated list of numbers that indicate how the certificate's private key can be used. This option is an advanced option; the default should be acceptable for most situations. The default depends on whether the certificate is a certificate authority or not. The default for a certificate with certificate authority is 6,7. The default for a certificate without certificate authority is 3,4,5. This option is ignored when the -r option is specified. Values include: 1. Digital Signature 2. Nonrepudiation 3. Key Encipherment 4. Data Encipherment 5. Key Agreement 6. Certificate Signing 7. CRL Signing 8. Encipher Only 9. Decipher Only
-v years	Certificate will be valid for how many years (1-100)	Specifies the number of years (between 1 and 100) that the certificate is valid. After this period, the certificate expires, along with all certificates it signs. This option is ignored when the -r option is specified.
-x	N/A	Generates a self-signed certificate. This option is ignored when the -r option is specified.
-3des	N/A	Encrypts the private key using 3DES encryption. Use this option to create a server identity file that can be used by older database servers running the Certicom encryption module as well as database servers that use the OpenSSL encryption module. Do not use this option if you are running in FIPS mode.

None.

Users typically go to a third party to purchase certificates. These certificate authorities provide their own tools for creating certificates. The following tools may be especially useful to create certificates for development and testing purposes, and can also be used for production certificates.

To create a signed certificate, you can specify no options and be prompted by createcert for the required values. Or, you can specify the required options for your certificate.

To break up the process into two steps, for example so one person creates a request and another person signs it, the first person can run createcert with -r to create a request and the second person can sign the request by running createcert with -s.

To create an enterprise root certificate (a certificate that signs other certificates), it is recommended that the self-signed root certificate be created with certificate authority and use the default signing. For example, specify y for the -ca option and specify 6,7 for the -u option.

To generate an enterprise root certificate (a certificate that signs other certificates), it is recommended that the self-signed root certificate be created with certificate authority and that the certificate uses the default signing.

For the -3des option, 16.0 versions of the software up to build 1704, 12.0.1 versions up to build 3993, and all versions prior to 12.0.1 included a Certicom encryption module for the strong encryption used in FIPS, TLS, and HTTPS. Private keys encrypted using that module were encrypted using 3DES encryption, instead of AES.

The following example creates a self-signed certificate with the following characteristics:

1024-bit RSA key
Generated serial number
Valid for 5 years
Not a certificate authority
Used for key encipherment, data encipherment, and key agreement
Private key with the password sql

createcert.exe -t rsa -b 1024 -sc CA -sst ON -sl Waterloo -so MyOrganizationalUnit -sou MyCompany -scn test -x -m 0 -v 5 -ca 0 -u 3,4,5 -co root-cert.pem -ko root-key.pem -io root-id.pem -kp sql

The following example creates a certificate signed by ca-key with the following characteristics:

1024-bit RSA key
Generated serial number
Valid for 5 years
Not certificate authority
Used for key encipherment, data encipherment, and key agreement.
Private key with the password sql:

createcert.exe -t rsa -b 1024 -sc CA -sst ON -sl Waterloo -so MyOrganizationalUnit -sou MyCompany -scn test -c ca-cert.pem -ck ca-key.pem -cp cakeypass -m 0 -v 5 -ca 0 -u 3,4,5 -co root-cert.pem -ko root-key.pem -io root-id.pem -kp sql

The following example creates a signed certificate. In the example, because no file name is provided for the signer's certificate, the certificate is a self-signed root certificate.

createcert
SQL Anywhere X.509 Certificate Generator Version 16.0.3330
Choose encryption type ((R)SA or (E)CC): r
Enter RSA key length (512-16384): 1024
Generating key pair...
Country Code: CA
State/Province: Ontario
Locality: Waterloo
Organization: Sybase iAnywhere
Organizational Unit: Engineering
Common Name: Test Certificate
Enter file path of signer's certificate:
Certificate will be a self-signed root
Serial number [generate GUID]:
Generated serial number: bfb89a26fb854955954cabc4d056e177
Certificate valid for how many years (1-100): 10
Certificate Authority (Y/N) [N]: n
1.  Digital Signature
2.  Nonrepudiation
3.  Key Encipherment
4.  Data Encipherment
5.  Key Agreement
6.  Certificate Signing
7.  CRL Signing
8.  Encipher Only
9.  Decipher Only
Key Usage [3,4,5]: 3,4,5
Enter file path to save certificate: cert.pem
Enter file path to save private key: key.pem
Enter password to protect private key: pwd
Enter file path to save identity: id.pem

The following example creates an enterprise root certificate (a certificate that signs other certificates) that is a self-signed root certificate with Certificate Authority that uses the default signing. The response to the Certificate Authority prompt or the -ca option should be y and response to the Key usage prompt or the -u option should be 6,7 (the default).

Certificate Authority (Y/N) [N]: y
1.  Digital Signature
2.  Nonrepudiation
3.  Key Encipherment
4.  Data Encipherment
5.  Key Agreement
6.  Certificate Signing
7.  CRL Signing
8.  Encipher Only
9.  Decipher Only
Key Usage [6,7]: 6,7

Certificate Creation utility (createcert)

Syntax

Privileges

Remarks

Example

See also