ksp cert
DocsCLI Reference — Session & Securityksp cert

ksp cert

Generate, inspect, sign, and verify Ed25519 KSP binary certificates and local certificate authorities (CAs).

Session & Security
RFC § 6 — Certificate Format & Trust Anchors

Purpose

Generate, inspect, sign, and verify Ed25519 KSP binary certificates and local certificate authorities (CAs).

Syntax

Command-line specification
bash / powershell
ksp cert <SUBCOMMAND> [OPTIONS]

Arguments

ArgumentDescription
<SUBCOMMAND>Subcommand: `generate`, `generate-ca`, `sign`, `inspect`, or `verify`.

Options & Flags

Option FlagDescription
--subject <NAME>Domain or service identity subject name (e.g., `api.kspprotocol.dev`).
--out-cert <FILE>Output file path for generated binary certificate (`.cert`).
--out-key <FILE>Output file path for Ed25519 private key (`.key`).
--ca-cert <FILE>Path to root CA certificate when signing downstream certificates.

Example Usage

Example command
ksp cert generate --subject "localhost" --out-cert server.cert --out-key server.key

Expected Output

  [+] Generating Ed25519 cryptographic key pair...
  [+] Creating KSP binary certificate format (v1)...
  [+] Subject Identity: localhost
  [+] Expiration:       2027-07-15T00:00:00Z (365 days)

  ✔ Wrote public certificate to: server.cert (184 bytes)
  ✔ Wrote private secret key to: server.key (64 bytes)
Implementation Notes

KSP uses compact binary certificates instead of bulky X.509 ASN.1 encodings to save handshake bandwidth.

Related CommandsView All 50 Commands →

ksp security
ksp doctor
CLI Installation Guide· Quick Start Workflow· GitHub Source Repository
Previousksp benchmarkNextksp security