github.com/anth0d/nomad@v0.0.0-20221214183521-ae3a0a2cad06/website/content/docs/commands/tls/ca-create.mdx (about)

     1  ---
     2  layout: docs
     3  page_title: 'Commands: tls ca create'
     4  description: |
     5    This command creates a Certificate Authority that can be used to create
     6    self signed certificates to be used for Nomad TLS setup.
     7  ---
     8  
     9  # Command: nomad tls ca create
    10  
    11  Create is used to create a self signed Certificate Authority to be used for
    12  Nomad TLS setup.
    13  
    14  ## Usage
    15  
    16  ```plaintext
    17  nomad tls ca create [options]
    18  ```
    19  
    20  ## CA Create Options
    21  
    22  - `-additional-domain=<value>`: Add name constraints for the CA. The server will
    23    reject certificates for DNS names other than those specified in `-domain` and
    24    `-additional-domain`. Can be used multiple times. This option can only used in
    25    combination with `-domain` and `-name-constraint`.
    26  
    27  - `common-name`: Common Name of CA. Defaults to Nomad Agent CA.
    28  
    29  - `-days=<int>`: Provide number of days the CA is valid for from now on,
    30    defaults to 5 years.
    31  
    32  - `-domain=<string>`: Domain of nomad cluster. Only used in combination with
    33    `-name-constraint`. Defaults to `nomad`.
    34  
    35  - `-name-constraint`: Add name constraints for the CA. Results in rejecting
    36    certificates for other DNS than specified. If set to true, "localhost" and
    37    `-domain` will be added to the allowed DNS. Defaults to false.
    38  
    39  ~> **Warning:** If `-name-constraint` is enabled and you intend to serve the
    40    Nomad web UI over HTTPS its DNS must be added with `additional-domain`. It is
    41    not possible to add that after the fact.
    42  
    43  ## Example
    44  
    45  Create CA:
    46  
    47  ```shell-session
    48  $ nomad tls ca create
    49  ==> CA Certificate saved to: nomad-agent-ca.pem
    50  ==> CA Certificate key saved to: nomad-agent-ca-key.pem
    51  ```
    52  
    53  Create a CA with a specified domain:
    54  
    55  ```shell-session
    56  $ nomad tls ca create -name-constraint="true" -domain="foo.com"
    57  ==> CA Certificate saved to: foo.com-agent-ca.pem
    58  ==> CA Certificate key saved to: foo.com-agent-ca-key.pem
    59  ```