SQ(1)

NAME
sq certify - Certifies a User ID for a Certificate

SYNOPSIS
sq [GLOBAL OPTIONS] certify [OPTIONS] CERTIFIER-KEY CERTIFICATE USERID

DESCRIPTION
Certifies a User ID for a Certificate.

Using a certification a keyholder may vouch for the fact that another certificate legitimately belongs to a user id. In the context of emails this means that the same entity controls the key and the email address. These kind of certifications form the basis for the Web Of Trust.

This command emits the certificate with the new certification. The updated certificate has to be distributed, preferably by sending it to the certificate holder for attestation. See also "sq key attest-certification".

By default a certification expires after 5 years. Using the "--expiry=EXPIRY" argument specific validity periods may be defined. It allows for providing a point in time for validity to end or a validity duration.

"sq certify" respects the reference time set by the top-level "--time" argument. It sets the certification's creation time to the reference time.

OPTIONS

  Global options

--cert-store=PATH
    Specifies the location of the certificate store

-f, --force=FORCE
    Overwrites existing files

--keyring=PATH
    Specifies the location of a keyring to use

--known-notation=NOTATION
    Adds NOTATION to the list of known notations

--no-cert-store=NO_CERT_STORE
    Disables the use of a certificate store

--output-format=FORMAT
    Produces output in FORMAT, if possible

--output-version=VERSION
    Produces output variant VERSION.

--pep-cert-store=PATH
    Specifies the location of a pEp certificate store

--time=TIME
    Sets the reference time as ISO 8601 formatted timestamp

--trust-root=FINGERPRINT|KEYID
    Considers the specified certificate to be a trust root

  Subcommand options

-B, --binary=BINARY
    Emits binary data

-a, --amount=TRUST_AMOUNT
    Sets the amount of trust

--allow-not-alive-certifier=ALLOW_NOT_ALIVE_CERTIFIER
    Don't fail if the certificate making the certification is not alive.

--allow-revoked-certifier=ALLOW_REVOKED_CERTIFIER
    Don't fail if the certificate making the certification is revoked.

-d, --depth=TRUST_DEPTH
    Sets the trust depth

--expiry=EXPIRY
    Defines EXPIRY for the certification as ISO 8601 formatted string or custom duration.

-l, --local=LOCAL
    Makes the certification a local certification

--non-revocable=NON_REVOCABLE
    Marks the certification as being non-revocable

--notation=NAME
    Adds a notation to the certification.

-o, --output=FILE
    Writes to FILE or stdout if omitted

--private-key-store=KEY_STORE
    Provides parameters for private key store

-r, --regex=REGEX
    Adds a regular expression to constrain what a trusted introducer can certify

EXAMPLES

Juliet certifies that Romeo controls romeo.pgp and romeo@example.org

    sq certify juliet.pgp romeo.pgp "<romeo@example.org>"

Certify the User ID "Ada", and set the certification time to July

21, 2013 at midnight UTC:

    sq certify --time 20130721 neal.pgp ada.pgp Ada

SEE ALSO
sq(1).

For the full documentation see <https://docs.sequoia-pgp.org/sq/>.

VERSION
0.31.0 (sequoia-openpgp 1.16.0, using Nettle 3.9 (Cv448: true))