Home › Playgrounds › CLI command builder

CLI command builder

Pick a command, fill in its flags, copy the line. The form is generated from cli-surface.json, the projection of pkinative schema manifest of pkinative-cli 1.0.0, so it offers the 18 commands and 53 invocations of the published CLI and every flag they accept — no more, no fewer. Combinations the CLI refuses with exit 2 (E_USAGE) are flagged as you type, each with the CLI source line that refuses it. Nothing is executed and nothing leaves this tab.

Command

Arguments and flags

This invocation reads a password. There is no field for the password itself, by design — see why.

Global options (every invocation accepts them)

Checks

Command line


      

      
File paths and values are quoted for the shell you pick: single quotes in a POSIX shell, single quotes with '' doubled in PowerShell. A value that begins with a dash is written --flag=value, the explicit form the CLI accepts, so it is never read as a flag.

    


    

      
Why there is no password field

      
The CLI refuses --password, --pass, --passin and --key-password with exit 2 before any command runs: a password on the command line is readable by every process on the machine through the process list, and it lands in shell history. This page follows the same rule. The three sources it offers are the three the CLI reads — --password-file <file> (the first line), --password-stdin (the first line of a pipe) and the PKINATIVE_PASSWORD environment variable — and giving two at once is itself a usage error. The environment source prints no value: set the variable from your secret store before you run the line.


      
What this page does not do

      
It does not run the CLI. pkinative-cli is a Node.js process with a filesystem, exit codes and a JSON envelope on stderr; a browser tab is none of those, and pretending otherwise would teach the wrong contract. The checks above cover every refusal the CLI can decide from the command line alone. The refusals that depend on your files — an RSA key without --rsa-scheme, an encrypted key without a password, an output file that already exists — are named as notes, and only the real run can decide them. pkinative <command> --help stays the authority.

      
To see the engine itself run in your browser, use the PKI toolkit or the certificate inspector.


      
Further reading