Skip to content

docs: add --chain-out, --fullchain-out, --format flags (weekly audit) #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
krakenhavoc merged 1 commit into from
May 14, 2026
Merged

docs: add --chain-out, --fullchain-out, --format flags (weekly audit) #11

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 52 additions & 15 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,16 +80,17 @@ krakenkey domain delete <id> Delete a domain
### `krakenkey cert`

```
krakenkey cert issue --domain <domain> Generate key + CSR locally, submit, and optionally wait
krakenkey cert submit --csr <file> Submit an existing CSR PEM file
krakenkey cert list [--status <status>] List certificates (filter: pending|issuing|issued|failed|renewing|revoking|revoked)
krakenkey cert show <id> Show certificate details
krakenkey cert download <id> [--out path] Download certificate PEM
krakenkey cert renew <id> [--wait] Trigger manual renewal
krakenkey cert revoke <id> [--reason N] Revoke a certificate (RFC 5280 reason code 0–10)
krakenkey cert retry <id> [--wait] Retry failed issuance
krakenkey cert update <id> Update certificate settings
krakenkey cert delete <id> Delete a certificate (failed or revoked only)
krakenkey cert issue --domain <domain> Generate key + CSR locally, submit, and optionally wait
krakenkey cert submit --csr <file> Submit an existing CSR PEM file
krakenkey cert list [--status <status>] List certificates (filter: pending|issuing|issued|failed|renewing|revoking|revoked)
krakenkey cert show <id> Show certificate details
krakenkey cert download <id> [--out path] Download certificate PEM
[--format cert|chain|fullchain]
krakenkey cert renew <id> [--wait] Trigger manual renewal
krakenkey cert revoke <id> [--reason N] Revoke a certificate (RFC 5280 reason code 0–10)
krakenkey cert retry <id> [--wait] Retry failed issuance
krakenkey cert update <id> Update certificate settings
krakenkey cert delete <id> Delete a certificate (failed or revoked only)
```

`cert issue` flags:
Expand All @@ -106,7 +107,9 @@ krakenkey cert delete <id> Delete a certificate (failed or revok
| `--country` | | Country code (C, e.g. US) |
| `--key-out` | `./<domain>.key` | Private key output path |
| `--csr-out` | `./<domain>.csr` | CSR output path |
| `--out` | `./<domain>.crt` | Certificate output path |
| `--out` | `./<domain>.crt` | Leaf certificate output path |
| `--chain-out` | `./<domain>.chain.pem` | Intermediate CA chain output path |
| `--fullchain-out` | `./<domain>.fullchain.pem` | Full chain output path (leaf + intermediates) |
| `--auto-renew` | `false` | Enable automatic renewal |
| `--wait` | `false` | Wait for issuance to complete |
| `--poll-interval` | `15s` | How often to poll for status |
Expand All @@ -117,12 +120,21 @@ krakenkey cert delete <id> Delete a certificate (failed or revok
| Flag | Default | Description |
|---|---|---|
| `--csr` | | Path to CSR PEM file — required |
| `--out` | `./<cn>.crt` | Certificate output path |
| `--out` | `./<cn>.crt` | Leaf certificate output path |
| `--chain-out` | `./<cn>.chain.pem` | Intermediate CA chain output path |
| `--fullchain-out` | `./<cn>.fullchain.pem` | Full chain output path (leaf + intermediates) |
| `--auto-renew` | `false` | Enable automatic renewal |
| `--wait` | `false` | Wait for issuance to complete |
| `--poll-interval` | `15s` | How often to poll for status |
| `--poll-timeout` | `10m` | Maximum time to wait |

`cert download` flags:

| Flag | Default | Description |
|---|---|---|
| `--out` | `./<cn>.crt` | Output file path |
| `--format` | `cert` | Certificate format: `cert` (leaf only), `chain` (intermediates only), `fullchain` (leaf + intermediates) |

### `krakenkey endpoint`

```
Expand All @@ -136,7 +148,7 @@ krakenkey endpoint disable <id> Disable an endpoint
krakenkey endpoint delete <id> Delete an endpoint
krakenkey endpoint probe add <id> <probe-id> Assign a connected probe
krakenkey endpoint probe remove <id> <probe-id> Remove a connected probe
krakenkey endpoint region add <id> <region> Add a hosted probe region
krakenkey endpoint region add <id> <region> Add a hosted probe region (Starter+)
krakenkey endpoint region remove <id> <region> Remove a hosted probe region
```

Expand Down Expand Up @@ -185,6 +197,28 @@ output: "text"
| API key | `--api-key` | `KK_API_KEY` |
| Output format | `--output` | `KK_OUTPUT` |

## Certificate chain

`cert issue` and `cert submit` produce three output files alongside the private key:

| File | Flag | Default | Contents |
|------|------|---------|----------|
| Leaf certificate | `--out` | `./<domain>.crt` | End-entity certificate only |
| Intermediate chain | `--chain-out` | `./<domain>.chain.pem` | Intermediate CA certificates |
| Full chain | `--fullchain-out` | `./<domain>.fullchain.pem` | Leaf + intermediates |

Most web servers (nginx, Caddy, HAProxy) expect the full chain. Use `--fullchain-out` in production deployments.

`cert download` accepts `--format` with values `cert` (default), `chain`, and `fullchain` to download a specific format for an already-issued certificate:

```bash
# Download full chain for deployment
krakenkey cert download 42 --format fullchain --out ./fullchain.pem

# Download intermediates only
krakenkey cert download 42 --format chain --out ./chain.pem
```

## Output formats

**Text** (default): colored, human-readable output with aligned tables and spinners.
Expand All @@ -209,7 +243,7 @@ CERT_ID=$(krakenkey cert issue --domain "$DOMAIN" --key-type ecdsa-p256 | jq -r
KK_API_KEY: ${{ secrets.KK_API_KEY }}
KK_OUTPUT: json
with:
args: cert issue --domain example.com --key-out ./example.com.key --out ./example.com.crt
args: cert issue --domain example.com --key-out ./example.com.key --out ./example.com.crt --fullchain-out ./example.com.fullchain.pem
```

**Generic shell**:
Expand All @@ -220,7 +254,10 @@ docker run --rm \
-e KK_OUTPUT=json \
-v "$(pwd)/certs:/out" \
ghcr.io/krakenkey/cli:latest \
cert issue --domain example.com --key-out /out/example.com.key --out /out/example.com.crt
cert issue --domain example.com \
--key-out /out/example.com.key \
--out /out/example.com.crt \
--fullchain-out /out/example.com.fullchain.pem
```

## CSR generation
Expand Down