Registry stack documentation: machine-readable Markdown.
Index of all pages: https://docs.registrystack.org/dev/llms.txt
Full corpus: https://docs.registrystack.org/dev/llms-full.txt

# registry-render keygen command reference

> Generated syntax and options for registry-render keygen.

{/* Generated from crates/registry-cli-docs/catalog.json and the workspace version in Cargo.toml by scripts/generate-cli-reference.mjs. Run npm run generate. */}

Generate a seal key and the certificate request for its seal certificate.

## Contract status

This page is generated from the public Clap command tree for Registry Stack source version `0.46.1` and catalog SHA-256 `61bebbb88fe15e4da92e2b0adbca0cd5b1a47b8eac38f4b91a15095011368a43`. Hidden implementation commands are omitted.

## Description

Generate a seal key and the certificate request for its seal certificate. Writes the private JWK owner-only to --key, the file a `local-jwk` signer's `privateKeyRef` names, and a PKCS #10 request to --csr for the certificate authority. With --from-pem, converts an existing unencrypted PKCS #8 key instead of generating one. With --transit-unix-socket-path, the key is a Transit key a `transit` signer names: it signs the request through the signing proxy, and only --csr is written. No output file may exist, and no key material is printed.

## Usage

```text
registry-render keygen [OPTIONS] --csr <FILE> --common-name <TEXT>
```

## Constraints

| Condition | Requirement |
| --- | --- |
| `--transit-unix-socket-path <PATH>` is present | All of `--transit-mount <ID>`, `--transit-key-name <ID>`, `--transit-key-version <VERSION>` are required. |
| `--transit-mount <ID>` is present | All of `--transit-key-name <ID>`, `--transit-key-version <VERSION>`, `--transit-unix-socket-path <PATH>` are required. |
| `--transit-key-name <ID>` is present | All of `--transit-mount <ID>`, `--transit-key-version <VERSION>`, `--transit-unix-socket-path <PATH>` are required. |
| Command invocation | `--algorithm <ALGORITHM>` and `--transit-unix-socket-path <PATH>` cannot be used together. |
| Command invocation | `--from-pem <FILE>` and `--transit-unix-socket-path <PATH>` cannot be used together. |
| Command invocation | `--key <FILE>` and `--transit-unix-socket-path <PATH>` cannot be used together. |

## Options

| Option | Always required | Default | Values | Environment | Description |
| --- | --- | --- | --- | --- | --- |
| `--key <FILE>` | No | n/a | n/a | n/a | New private JWK file, created with mode 0600 |
| `--csr <FILE>` | Yes | n/a | n/a | n/a | New PEM certificate request file |
| `--common-name <TEXT>` | Yes | n/a | n/a | n/a | The seal's name, the request's commonName |
| `--organization <TEXT>` | No | n/a | n/a | n/a | The institution, the request's organizationName |
| `--country <CODE>` | No | n/a | n/a | n/a | The ISO 3166 two-letter country code, the request's countryName |
| `--algorithm <ALGORITHM>` | No | n/a | `es256`, `es384`, `rs256`, `rs384` | n/a | Seal algorithm. Default: es256 for a generated key; for --from-pem, the one the key's curve fixes, or rs256 for an RSA key |
| `--from-pem <FILE>` | No | n/a | n/a | n/a | Unencrypted PKCS #8 PEM private key to convert. Encrypted PKCS #8, SEC 1, PKCS #1 and PKCS #12 files are refused with the `openssl` command that converts them |
| `--transit-unix-socket-path <PATH>` | No | n/a | n/a | n/a | The Transit signing proxy's Unix socket, as `signer.unixSocketPath` names it: the seal key is a Transit key, which signs the request, and no key file is written. A production seal's key is one |
| `--transit-mount <ID>` | No | n/a | n/a | n/a | The Transit mount, as `signer.mount` names it |
| `--transit-key-name <ID>` | No | n/a | n/a | n/a | The Transit key, an ecdsa-p256 key, as `signer.keyName` names it |
| `--transit-key-version <VERSION>` | No | n/a | n/a | n/a | The Transit key version the certificate is for, as `signer.keyVersion` pins it |
| `-h, --help` | No | n/a | n/a | n/a | Print help (see a summary with '-h') |

## Generation contract

After changing a public command, argument, option, default, environment binding, or help description, run `cargo run --locked -p registry-cli-docs -- --write`, commit `crates/registry-cli-docs/catalog.json`, then run `npm run generate` from `docs/site`.