## NAME
`tlsproxy certgen <filename>` - Generates a self-signed X.509 certificate.
* It can be used for Server Authentication if the TLS proxy behaves as a TLS server.
* It is not recommended to use self-signed certificates on public servers.
* The `certgen` command generates three files: `filename.pfx`, `filename.crt` and `filename.key`.
* The `filename.pfx` file contains a PKCS #12 certificate with an associated private key.
* The `filename.crt` file is a public certificate.
* The `filename.key` file is a private key.

## OPTIONS
* `-p, --password <password>`
  * Password for the created `.pfx` file. Default: empty password.
* `-t, --type <RSA | ECDSA-NistP | ECDSA-Brainpool | Ed25519 | ML-DSA>`
  * Key algorithm. Default: RSA.
  * Shortcuts: ECDSA for ECDSA-NistP. EDDSA for Ed25519. MLDSA for ML-DSA.
* `-b, --bits <bits>`
  * Number of bits in the key to create. Default: 4096 for RSA, 256 for ECDSA, 256 for Ed25519, 44 for ML-DSA.
* `-h, --hash <MD-5 | SHA-1 | SHA-256 | SHA-384 | SHA-512>`
  * Signature hash algorithm. Default: SHA-256 for RSA, curve-specific for ECC certificates.
* `-s, --subject <distinguished_name>`
  * Subject of the certificate. Default: CN=localhost.
* `-m, --months <number>`
  * Length of validity in months. Default: 12.
* `-a, --alt-hosts <names>`
  * Comma-separated Subject Alternative Names (SAN). Default: Common Name (CN from Subject).
  * To omit SAN, use empty string (`--alt-hosts ""`).
* `-k, --key-format <PKCS8 | PKCS8-b64 | PuTTY-PPKv2 | PuTTY-PPKv3 | OpenSSH | OpenSSH-b64>`
  * Output format of the generated private key file. Default: PKCS8-b64.
* `-o, --overwrite <false | true>`
  * Determines whether to overwrite target file if it already exists. Default: false.

## EXAMPLES
* `tlsproxy certgen localproxy`
  * Generates an X.509 certificate with a 4096-bit RSA key and SHA-256 signature hash, issued for `localhost`, valid for the next year, and saves it to `localproxy.pfx` and `localproxy.crt` files.

* `tlsproxy certgen -t ecdsa -b 384 -s "CN=my-domain.com" -m 120 -a "my-domain.com, www.my-domain.com" my-domain`
  * Generates an X.509 certificate with an ECDSA NIST P-384 key and SHA-384 signature hash, issued for `my-domain.com`, valid for the next 10 years, and saves it to `my-domain.pfx` and `my-domain.crt` files.
