> For the complete documentation index, see [llms.txt](https://yubico.gitbook.io/yubikey5/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yubico.gitbook.io/yubikey5/piv-1/commands/certificates/generate.md).

# generate

Generate a self-signed X.509 certificate. A self-signed certificate is generated and written to one of the slots on the YubiKey. A private key must already be present in the corresponding key slot.

## <mark style="color:red;">ykman piv</mark> certificates generate <mark style="color:red;">OPTIONS</mark> SLOT PUBLIC-KEY

<table><thead><tr><th width="284">Options</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:red;">-h, --help</mark></td><td>Show this message and exit.</td></tr><tr><td><mark style="color:red;">-a, --hash-algorithm [SHA1|SHA256|SHA384|SHA512]</mark></td><td>Hash algorithm. <br>[default: <mark style="color:red;"><code>SHA256</code></mark>]</td></tr><tr><td><mark style="color:red;">-d, --valid-days INTEGER</mark></td><td>Number of days until the certificateexpires. <br>[default: <mark style="color:red;">365</mark>]</td></tr><tr><td><mark style="color:red;">-m, --management-key TEXT</mark></td><td>The management key.</td></tr><tr><td><mark style="color:red;">-P, --pin TEXT</mark></td><td>PIN code.</td></tr><tr><td><mark style="color:red;">-s, --subject TEXT</mark></td><td>Subject for the certificate, as an RFC 4514 string. [required].</td></tr></tbody></table>

<table><thead><tr><th width="285">Arguments</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:red;">SLOT</mark></td><td>PIV slot of the certificate.</td></tr><tr><td><mark style="color:red;">PUBLIC-KEY</mark></td><td>File containing the public key. <br>Use <mark style="color:red;"><code>'-'</code></mark> to use <mark style="color:red;"><code>stdin</code></mark>.</td></tr></tbody></table>

### <mark style="color:blue;">HELP</mark>

{% tabs %}
{% tab title="Help Command" %}

```properties
Usage: ykman.exe piv certificates generate [OPTIONS] SLOT PUBLIC-KEY

  Generate a self-signed X.509 certificate.

  A self-signed certificate is generated and written to one of the slots on the YubiKey. A private key must already be present in the
  corresponding key slot.

  SLOT            PIV slot of the certificate.
  PUBLIC-KEY      File containing a public key. Use '-' to use stdin.

Options:
  -m, --management-key TEXT       The management key.
  -P, --pin TEXT                  PIN code.
  -s, --subject TEXT              Subject for the certificate, as an RFC 4514 string.  [required]
  -d, --valid-days INTEGER        Number of days until the certificate expires.  [default: 365]
  -a, --hash-algorithm [SHA1|SHA256|SHA384|SHA512]
                                  Hash algorithm.  [default: SHA256]
  -h, --help                      Show this message and exit.
```

{% endtab %}
{% endtabs %}

### <mark style="color:blue;">EXAMPLE</mark>

{% tabs %}
{% tab title="example 1" %}

```
```

{% endtab %}
{% endtabs %}