actk command-line reference

actk is the toolkit on the command line: the same tools as the desktop app, for scripts, scheduled scans and servers without a desktop. Download actk-windows-amd64.exe from the overview and save it as actk.exe in a folder on your PATH.

actk <command> [options]
actk <command> --help
actk --version

Passwords are prompted for. For unattended use, every password has a --...-env VAR flag that reads it from an environment variable instead. No password is ever accepted as a command-line argument, where it would end up in the shell history and the process list.

Exit codes: 0 success; 1 the command ran but the result is negative (a CSR a CA would reject, a signature that failed, a security scan that could not complete, a declined deletion); 2 an error, such as a missing file or a bad argument.

Output is coloured when it goes to a terminal; set NO_COLOR to turn colour off.

actk csrCopy Anchor Link

actk csr --cn <name> [options]

Writes <name>.csr and <name>.key into --out-dir, named after the common name (www.example.com becomes www_example_com). The command line always writes the key as a file; keys in the Windows key store are created with the desktop app's Create CSR.

# Server CSR with SANs and an IP, key encrypted
actk csr --cn www.example.com --san example.com --ip 10.0.0.15 --org "Example GmbH" `
  --locality München --state Bayern --country DE --key rsa2048 --encrypt-key

# User certificate (S/MIME + client authentication)
actk csr --profile user --cn "Erika Mustermann" --email [email protected] --upn [email protected]

# Self-signed code signing certificate for testing, with a PFX
actk csr --profile codesign --cn "Example GmbH" --org "Example GmbH" --country DE --key rsa3072 `
  --self-signed --days 365 --pfx

actk decodeCopy Anchor Link

actk decode <file>

Shows subject, SANs, key, requested usage, the proof-of-possession signature and every finding. PEM or DER. Exits 1 when a finding is an error - so a script can stop before it submits a request a CA would reject. See Check CSR.

actk pfxCopy Anchor Link

actk pfx --cert <file> --key <file> --out <file> [options]

The key is checked against the certificate before anything is written.

actk pfx --cert issued.pem --chain intermediate.pem --key www_example_com.key --out www.pfx

actk exportCopy Anchor Link

actk export --cert <file> | --pfx <file> [outputs] [options]

actk export --cert issued.pem --chain intermediate.pem --cer www.cer --fullchain fullchain.pem
actk export --pfx from-iis.pfx --crt www.crt --chain-out chain.pem --key-out www.key

actk signCopy Anchor Link

actk sign <files...> --thumbprint <sha1> | --pfx <file> [options]

Every file is verified after signing, with the same exit code as actk verify. Windows-only.

actk sign Setup.exe deploy.ps1 package.msi --thumbprint 0123ABCD...
actk sign tool.exe --pfx codesign.pfx --timestamp http://timestamp.sectigo.com

actk verifyCopy Anchor Link

actk verify <files...>

Shows the Authenticode signature status, signer and timestamp of each file. Exits 1 if a file is not signed, was modified after signing, or Windows reports an error; a valid signature whose root this computer does not trust is shown, but does not fail. Windows-only.

actk certsCopy Anchor Link

actk certs

Lists the certificates Windows can sign code with - Code Signing purpose and a private key, in the user's and the computer's store, including USB tokens and HSMs - with their thumbprints for actk sign. Windows-only.

actk storeCopy Anchor Link

actk store list [--machine]
actk store import <file> [--key <file>] [options] [--machine]
actk store export <thumbprint> [outputs] [options] [--machine]
actk store delete <thumbprint> [--yes] [--machine]

The personal store of the current user (CurrentUser\My), or with --machine the computer's (LocalMachine\My). Changing the computer's store needs an elevated prompt. Windows-only.

import - an issued certificate (.cer, .crt, .pem, .p7b) with the key from actk csr, or a .pfx/.p12. Intermediates go to Intermediate Certification Authorities; a root is never installed.

export - a certificate by thumbprint, with its chain, and its key for --pfx and --key-out.

delete - removes the certificate and its private key. Asks for confirmation unless --yes is given.

actk store list
actk store import issued.p7b --key www_example_com.key
actk store export 0123ABCD... --pfx www.pfx --fullchain fullchain.pem
actk store delete 0123ABCD...

actk scanCopy Anchor Link

actk scan <targets...> [options]

Targets are hosts, CIDR networks (up to /16) and ranges: 10.0.0.0/24, 10.0.0.10-50, srv01.corp.local. At most 65,536 addresses and 262,144 probes per scan.

actk scan 10.0.0.0/24 10.0.1.10-50 srv01.corp.local -p 443,636,3389,8443 `
  --csv inventory.csv --json inventory.json

See Certificate scanner.

actk securityCopy Anchor Link

actk security <target> [options]

The target is host, host:port or https://host:port/path.

actk security intranet.corp.local:8443 --json report.json
actk security 10.0.0.25:25           # SMTP STARTTLS, detected from the port

Exits 1 when the scan could not complete. See Security scan.