Deploy X.509 Certificates with Reis (Flag Mode)

Create and manage X.509 certificates directly from the command line using Reis flag-mode commands.

Create an X.509 certificate

reis x509_cert:create \
  --name "Signing Certificate" \
  --handle signing-cert \
  --cert_file ./certs/signing.crt

Only one PEM file is required (the certificate itself). The handle must be DNS-1123 compliant (lowercase alphanumeric and hyphens, max 63 characters).

List X.509 certificates

reis x509_cert:list

Shows a table with handle, name, subject, expiry, and algorithm for each certificate, plus its current version (for example v2 of 3) and when it was last rotated (Never until the first rotation).

Show details

reis x509_cert:show <cert-id>

Displays the full metadata including fingerprint, issuer, and expiry date.

Rotate certificate material

reis x509_cert:rotate <cert-id> \
  --cert_file ./certs/new-signing.crt

Creates a new version and marks it current. The previous version is retained for rollback.

List versions

reis x509_cert:versions <cert-id>

Activate a previous version (rollback)

reis x509_cert:activate_version <cert-id> <version-number>

Delete an X.509 certificate

reis x509_cert:delete <cert-id>

Add --force to skip the confirmation prompt. Deleting removes all versions, project attachments, and container wiring.

Attach to a project

reis project:attach <project-id> x509_certs signing-cert

Singular alias x509_cert is also accepted. The project-id is the UUID Reis returns from project:list or project:show.

Detach from a project

reis project:detach <project-id> x509_certs signing-cert

If a running container still mounts the cert, detach is rejected with a 409 naming the blocking container — tear it down (or remove its x509_certs block) and retry.

See also

• X.509 Certificates with Terraform
• X.509 Certificates with Reis (YAML Mode)