Page MenuHomeVyOS Platform
Create Task
Maniphest T8165

Add ability to show certificate full chain in pem format
In progress, NormalPublicFEATURE REQUEST
Actions

Description

Summary

Add op-mode command having ability to show certificate full chain in pem format as part of PKI configuration.

Use case

Currently, we have the following to render certificate in PEM format.

  • show pki ca <NAME> pem
  • show pki certificate <NAME> pem
  • show pki certificate <NAME> private pem

But there isn’t a way to render the full chain including the intermediate CA (and the certificate perivate key if requested) for the certificate in PEM format.

We need to allow users to easily export a certificate along with its CA hierarchy for use in external applications that require the full chain to be provided in a single file.

So, for completeness we should have:

  • For ca:

    - show pki ca NAME pem
    - show pki ca NAME pem full-chain

  • For certificate:

    - show pki certificate NAME pem
    - show pki certificate NAME pem full-chain
    - show pki certificate NAME private pem
    - show pki certificate NAME private pem full-chain

Additional information

The security concern for exposing private key is orthogonal to the implementation.
Necessary restrictions to the operator commands can be applied via command-policy
like set system login operator-group NAME command-policy.

Details

Version
-
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Feature (new functionality)

Related Objects
Search...

StatusSubtypeAssignedTask
 In progressFEATURE REQUESTindrajitrT8165 Add ability to show certificate full chain in pem format
 ResolvedFEATURE REQUESTindrajitrT8877 pki: Add ability to show private key in pem format

Event Timeline

a.pidnebesny created this task.Jan 9 2026, 10:00 AM
a.pidnebesny renamed this task from Add operation commands for display PKI private key in PEM foramt to Add operational commands to display PKI private keys and certificate bundles in PEM format.
pasik subscribed.Jan 9 2026, 10:11 AM
Viacheslav subscribed.EditedJan 9 2026, 4:03 PM

Technically, this will be a security issue.
Only users with admin/root rights should be able to view and check all certificates/private keys, etc.

c-po subscribed.Jan 15 2026, 4:50 PM

We already show the full private key in our configuration as we only have admin mode.

Limiting this to admin users with the new op-mode permission is definately a must, but adding this formatter now does not make the system any less secure.

Viacheslav added a comment.Jan 19 2026, 12:11 PM

We will get rid of this in the near future if we implement it now.
If we are focusing on the Common Criteria Profile for Network Devices, it is not accepted.
Needs to figure out in which form we can/should implement it if we want.

dmbaturin triaged this task as Normal priority.Mar 16 2026, 2:24 PM
a.pidnebesny added a subtask: T8877: pki: Add ability to show private key in pem format.May 27 2026, 7:27 AM
Viacheslav changed the task status from Open to In progress.May 28 2026, 4:29 PM
Viacheslav assigned this task to indrajitr.

PR https://github.com/vyos/vyos-1x/pull/5225

c-po renamed this task from Add operational commands to display PKI private keys and certificate bundles in PEM format to Add ability to show certificate full chain in pem format.Jun 5 2026, 4:06 PM
c-po updated the task description. (Show Details)