ksp cert
ksp cert
Command ReferenceGenerate, inspect, sign, and verify Ed25519 KSP binary certificates and local certificate authorities (CAs).
Session & Security
RFC § 6 — Certificate Format & Trust AnchorsPurpose
Generate, inspect, sign, and verify Ed25519 KSP binary certificates and local certificate authorities (CAs).
Syntax
Command-line specificationbash / powershell
ksp cert <SUBCOMMAND> [OPTIONS]
Arguments
| Argument | Description |
|---|---|
| <SUBCOMMAND> | Subcommand: `generate`, `generate-ca`, `sign`, `inspect`, or `verify`. |
Options & Flags
| Option Flag | Description |
|---|---|
| --subject <NAME> | Domain or service identity subject name (e.g., `api.kspprotocol.dev`). |
| --out-cert <FILE> | Output file path for generated binary certificate (`.cert`). |
| --out-key <FILE> | Output file path for Ed25519 private key (`.key`). |
| --ca-cert <FILE> | Path to root CA certificate when signing downstream certificates. |
Example Usage
Example command
ksp cert generate --subject "localhost" --out-cert server.cert --out-key server.key
Expected Output
[+] Generating Ed25519 cryptographic key pair... [+] Creating KSP binary certificate format (v1)... [+] Subject Identity: localhost [+] Expiration: 2027-07-15T00:00:00Z (365 days) ✔ Wrote public certificate to: server.cert (184 bytes) ✔ Wrote private secret key to: server.key (64 bytes)
Implementation Notes
KSP uses compact binary certificates instead of bulky X.509 ASN.1 encodings to save handshake bandwidth.