NAME

       CMCSharedToken - Used to process a user passphrase and create shared token to be stored by
       the CA to allow Shared Secret-based proof of origin  in  cases  such  as  CMC  certificate
       issuance and revocation.

SYNOPSIS

       CMCSharedToken [OPTIONS]

DESCRIPTION

       The   Certificate  Management  over  Cryptographic  Message  Syntax  (CMC)  shared  secret
       generation tool, CMCSharedToken, provides a command-line utility used to  process  a  user
       passphrase to be shared with the CA.

       It  takes  a  passphrase  provided  by  the  user, encrypts it with an issuance protection
       certificate, and outputs the encrypted blob which could be stored on the CA for subsequent
       enrollment or revocation activities by the user.

       This  tool can be run either by the user or by the administrator.  If run by the user, the
       output (encrypted passphrase, i.e. shared token) needs to be sent to the CA  administrator
       to  store  on  the  CA;  if run by the CA administrator, the passphrase itself needs to be
       passed to the intended user.  It is outside of the scope of this  software  to  state  how
       such  communication  takes  place.   It  is up to the site policy to decide which way best
       suits the deployment site.

       For information on how the administrator would store the shared tokens on the CA, see  Red
       Hat Certificate System Administrator's Guide.

OPTIONS

       The following are supported options.

       -d database
           Path of directory to the NSS database. This option is required.

       -h token
           Security token name (default: internal)

       -p password
           Security token password.

       -s passphrase
           CMC enrollment passphrase (shared secret) (put in "" if containing spaces)

       -b issuance-protection-cert
           PEM  issuance protection certificate. Note: only one of the -b or -n options should be
       used.

       -n issuance-protection-cert-nickname
           PEM issuance protection certificate on token. Note: only one of the -b or  -n  options
       should be used.

       -v
           Run in verbose mode.

EXAMPLE

              $ CMCSharedToken -d . -p myNSSPassword \
                  -s "just another good day" -o cmcSharedTok2.b64 -n "subsystemCert cert-pki-tomcat"

SEE ALSO

       CMCRequest(1)

AUTHORS

       Christina Fu <cfu@redhat.com>.

COPYRIGHT

       Copyright  (c)  2018 Red Hat, Inc.  This is licensed under the GNU General Public License,
       version    2    (GPLv2).     A    copy    of    this    license    is     available     at
       http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.