COCKROACH-CERT-CREATE-CLIENT(1)

NAME

cockroach-cert-create-client - create client certificate and key

SYNOPSIS

cockroach cert create-client --certs-dir= --ca-key= [flags]

DESCRIPTION

Generate a client certificate "/client..crt" and key "/client..key".

If --overwrite is true, any existing files are overwritten.

Requires a CA cert in "/ca.crt" and matching key in "--ca-key". If "ca.crt" contains more than one certificate, the first is used. Creation fails if the CA expiration time is before the desired certificate expiration.

OPTIONS

--also-generate-pkcs8-key[=false]

Also write the key in pkcs8 format to /client..key.pk8.

--ca-key=""

Path to the CA key.
 Environment variable: COCKROACH_CA_KEY

--cert-principal-map=[]

A comma separated list of : mappings. This
 allows mapping the principal in a cert to a DB principal such as "node" or
 "root" or any SQL user. This is intended for use in situations where the
 certificate management system places restrictions on the Subject.CommonName or
 SubjectAlternateName fields in the certificate (e.g. disallowing a CommonName
 such as "node" or "root"). If multiple mappings are provided for the same
 , the last one specified in the list takes precedence. A
 principal not specified in the map is passed through as-is via the identity
 function. A cert is allowed to authenticate a DB principal if the DB principal
 name is contained in the mapped CommonName or DNS-type SubjectAlternateName
 fields. It is permissible for the string to contain colons.

--certs-dir="/home/builder/.cockroach-certs"

Path to the directory containing SSL certificates and keys.
 Environment variable: COCKROACH_CERTS_DIR

--disable-username-validation[=false]

Do not validate that the provided identity has a valid structure for a SQL
 identifier. If passed, and the identity is not a valid SQL identifier, the
 generated certificate can only be used if an identity map has been configured
 server-side.

-h, --help[=false]
    help for create-client

--key-size=2048

Key size in bits for CA/Node/Client certificates.

--lifetime=43920h0m0s

Certificate lifetime.

--node-cert-distinguished-name=""

A string of comma separated list of distinguished-name
 = mappings in accordance with RFC4514 for
 the node user. This strictly needs to match the DN subject in the client
 certificate provided for node user if this flag is set.

--overwrite[=false]

Certificate and key files are overwritten if they exist.

--root-cert-distinguished-name=""

A string of comma separated list of distinguished-name
 = mappings in accordance with RFC4514 for
 the root user. This strictly needs to match the DN subject in the client
 certificate provided for root user if this flag is set.

--tenant-name-scope=

Assign a tenant scope using tenant names to the certificate. This will
 restrict the certificate to only be valid for the specified tenants. This flag
 is optional. When omitted, the certificate is not scoped; i.e. it can be used
 with all tenants.

OPTIONS INHERITED FROM PARENT COMMANDS

--enterprise-require-fips-ready[=false]
    abort if FIPS readiness checks fail

--log=

Logging configuration, expressed using YAML syntax. For example, you can
 change the default logging directory with: --log='file-defaults: {dir: ...}'.
 See the documentation for more options and details. To preview how the log
 configuration is applied, or preview the default configuration, you can use
 the 'cockroach debug check-log-config' sub-command.

--log-config-file=

File name to read the logging configuration from. This has the same effect as
 passing the content of the file via the --log flag.

--log-config-vars=[]

Environment variables that will be expanded if present in the body of the
 logging configuration.

--log-dir=

--log-dir=XXX is an alias for --log='file-defaults: {dir: XXX}'.

--logtostderr[=UNKNOWN]

--logtostderr=XXX is an alias for --log='sinks: {stderr: {filter: XXX}}'. If
 no value is specified, the default value for the command is inferred: INFO for
 server commands, WARNING for client commands.

--redactable-logs=false

--redactable-logs=XXX is an alias for --log='file-defaults: {redactable:
 XXX}}'.

--vmodule=
    comma-separated list of pattern=N settings for file-filtered logging (significantly hurts performance)

SEE ALSO

cockroach-cert(1)

HISTORY

13-May-2026 Auto generated by spf13/cobra