X.509 Certificates

X.509 support is intentionally small: Nokku can create a key and CSR, sign the CSR with an X.509 CA, and write the resulting files for an application to use. It does not configure the application or its trust store.

Use X.509 certificates for applications that use TLS. SSH certificates are a different format and are used by OpenSSH.

Create an X.509 CA

Create an X.509 certificate authority for the workspace. Choose its key policy and lifetime before issuing certificates.

List available authorities

nk cert list

If exactly one active X.509 authority is available, it can be selected automatically. Select a CA explicitly when multiple authorities are available.

Issue a certificate

nk cert issue api-client \
  --usage client \
  --san dns:api.example.com

The CLI generates a key pair and PKCS#10 CSR, sends the CSR to the core, and writes the signed certificate and CA certificate to the output directory.

Usage

Value	Extended key usage
`client`	TLS client authentication
`server`	TLS server authentication
`both`	Client and server authentication

Subject alternative names

The CLI accepts DNS names, IP addresses, email addresses, and URIs:

nk cert issue service \
  --usage client \
  --san dns:service.internal \
  --san ip:10.0.0.5 \
  --san uri:spiffe://example/service

Use the resulting CA certificate in the application’s trust configuration. Nokku does not configure the application or its trust store.

Output

The command writes files named from the requested common name:

service.crt
service.key
service-ca.crt

Files are written to the current directory by default; pass --output (or -o) to choose another directory.

Protect the private key

The .key file is a credential. Keep it in a safe place with restricted permissions and do not commit it to source control.