skipca(9 May 1996)

NAME
skipca - Manage the SKIP Certificate Authorities Database

SYNOPSYS
skipca [add | rm | list | init | extract | revoked | unrevoke ] ...

DESCRIPTION
The skipca command is the primary tool used in creating and managing the trusted authorities database. When a Certificate Authority (CA)is designated as trusted, any certificate signed by that authority is believed to be legitimate.

OPTIONS

add ca-file
    Use the add option to place new certificates into the trusted Certificate Authority database. The ca-file is an X509 certificate which is either self-signed or signed by an existing trusted CA in this CA database. Note: The add option does not copy over a CA certificate if it already exists in the CA database.

extract [slot-number]
    The extract command writes the CA certificate in the specified slot-number to the standard output. If the output is redirected to a file, the file is suitable for the skipca add command.

init [-qr] Prior to use, the CA database must be initialized. The init option creates the database. The init option does NOT delete any of the CA certificates present when issued for an existing database. Use the init option with the -r operand to forcably reinitialize the database, destroying any existing certificates. The init option with the -q operand tells init to be as quiet as possible about initializaiton.

list [-rVev] [slot-number]
The list option provides a listing of all the certificates in the CA database by slot number, Issuer, and Subject. If a slot number is specified, only the CA Certificate for that slot is printed. The -e flag enables printing of the Certificate validity periods. -v enables a verbose display of the entire certificate. If -V is specified, the output is displayed in a machine parseable manner. If -r is specified the manual revocation list for that CA is display.

revoke -s ca-slot serial-number
    Each CA maintains a list of certificates which have been revoked by the user. This is different from a traditional CRL as it is not distributed by the CA and is manually maintained. The revoke command allows the user to add certificates to the per-CA list of revoked certificates. ca-slot specifies which CA to operate on. The ca-slot may be obtained through the skipca list command. serial-number is the serial number of the certificate which you wish revoke. Each X509 Certificate produced by a CA is numbered uniquely with a serial number.

rm [slot-number]
    The rm option deletes the CA certificate in the specified slot number. Note, "del" is an alias for "rm".

unrevoke -s ca-slot serial-number
    The unrevoke, command removes hosts from the per CA revocation list. ca-slot and serial-number are the same as the arguments for the revoke command.

SECURITY CONSIDERATIONS

This command has broad security implications. By designating a CA as trusted, you are trusting the identity of ALL certificate signed by that CA. Since root CA certificates are self signed, there is no automated way to verify that the certificate actually comes from that CA. Before adding a CA Certificate, you MUST be absolutely certain that the certificate is valid. Validity may be checked by having the CA publish the hash of it's certificate publically and comparing that hash with the hash obtained from the certificate.

USAGE

You must be root to run this command.

Note, the system must be rebooted or the key manager must be restarted with the skipd_restart command before changes take effect.

RETURN VALUES
skipca will always return 0 on success and non-zero on error. An appropriate error message will be written to standard error.

FILES

  Solaris 1.x systems:

/usr/local/etc/skip/CAs

SEE ALSO
skipdb(1m) skiplocal(1m) skipd(1m)