CLI reference
Two command-line programs ship with every release:
| Program | Release artifacts | Purpose |
|---|---|---|
edgepki-node | edgepki-node-linux-amd64, edgepki-node-windows-amd64.exe | The Mesh Node service itself, plus offline validation modes |
sectigo-edge | sectigo-edge-linux-amd64, sectigo-edge-windows-amd64.exe | Operator CLI: health, integration status, signed discovery, verified trust events, ACME credentials, ADCS recovery and a read-only MCP server |
Both use Go-style single-dash flags (-flag value or -flag=value). Run either with -h to print its flags.
edgepki-node
edgepki-node [-config PATH] [-validate-bootstrap | -validate-config]
| Flag | Default | Description |
|---|---|---|
-config | config.json | Path to the node configuration. The installed services pass /etc/edgepki/config.json (Linux), C:\ProgramData\Sectigo\Edge\config.json (Windows) or /etc/edgepki/config.json (Kubernetes). |
-validate-bootstrap | false | Validate a not-yet-enrolled installation without creating an identity or using the network: the one-time token file must exist, be a regular file, match the token format and (on Linux) not be readable by group or others; the trust files must be bound to tenant_id; the local TLS key pair, workload bundle, ACME credential store and outbound TLS settings must load. The installers run this before starting the service. |
-validate-config | false | The same checks without requiring the enrollment token — use it for an enrolled node after editing config.json. The upgrade installers run this with the new binary before replacing the old one. |
Only one validation flag may be given (choose only one validation mode). Without a validation flag, the program runs the node: it opens the hardware key, enrolls if needed, verifies the stored policy and serves until it receives SIGTERM/Ctrl+C.
Output and exit codes
| Result | Output | Exit code |
|---|---|---|
| Validation succeeded | Sectigo Edge bootstrap configuration and trust files validated. | 0 |
| Configuration or validation error | A structured log line on standard error | 1 |
| Runtime failure (identity, enrollment, policy, service) | A structured log line on standard error | 1 |
sudo -u edgepki /usr/local/bin/edgepki-node -validate-config -config /etc/edgepki/config.json
Sectigo Edge bootstrap configuration and trust files validated.
sudo -u edgepki /usr/local/bin/edgepki-node -validate-config -config /tmp/bad-config.json
2026/10/01 14:20:07 ERROR configuration failed error="nginx_rollback_window_seconds must be between 60 and 86400"
echo $?
1
Common runtime log messages include configuration failed, bootstrap validation failed, node identity initialization failed, node enrollment failed, policy trust initialization failed, registration trust bundle is not bound to the configured tenant, stored policy verification failed and service initialization failed. Each includes an error= field with the reason.
Run validation as the service user (edgepki on Linux) so file permission problems surface exactly as they would for the service.
sectigo-edge
sectigo-edge [flags] <status|integrations|discover|events|acme-eab-create|adcs-recover|mcp|version>
Exactly one command is required, and all flags must come before the command. The CLI talks to the node's local TLS 1.3 API; it does not contact Sectigo Edge. Errors are printed as sectigo-edge: <message> with exit code 1.
Connection flags
| Flag | Environment variable | Default | Description |
|---|---|---|---|
-url | SECTIGO_EDGE_NODE_URL | https://127.0.0.1:9443 | Local Mesh Node URL. |
-ca | SECTIGO_EDGE_CA_FILE | — | PEM bundle that verifies the node's local API certificate. Without it the system roots are used. |
-cert | SECTIGO_EDGE_CERT_FILE | — | Workload X.509-SVID certificate chain for mTLS. |
-key | SECTIGO_EDGE_KEY_FILE | — | Private key for -cert. -cert and -key must be given together. |
-timeout | — | 5s | Request timeout, greater than zero and at most 1m. |
The CLI ignores HTTP_PROXY/HTTPS_PROXY and always connects directly.
Commands
| Command | Calls | Needs a client certificate | Output |
|---|---|---|---|
status | GET /healthz | No | Indented JSON health document |
integrations | GET /v1/integrations/status | Yes (workload SVID) | Indented JSON adapter status |
discover | GET /.well-known/sharppki | No | The signed discovery envelope (not verified by this command) |
events | Signed discovery, then GET /v1/events | Yes (subscriber identity) | Verified trust-event batch, or one event per line with -watch |
acme-eab-create | — (local file only) | No | The new credential, displayed once |
adcs-recover | POST /v1/integrations/microsoft-adcs/recover | Yes (recovery identity) | Indented JSON result |
mcp | — | As for the tools used | Read-only MCP server over stdio |
version | — | No | CLI version, for example 0.1.26 |
status
sectigo-edge -ca /etc/edgepki/local-api-ca.pem status
{
"audit_head": "q3V9kM2f0bX8w1n4Ezr7cT5yHjL0pA6sDgUe2RiWoNc",
"audit_sequence": 2381,
"dependency_discovery": {
"configured_probes": 0,
"enabled": false,
"failed": 0,
"queued": 0,
"successful": 0
},
"integrations": [
{
"kind": "nginx",
"installed": true,
"health": "healthy",
"manifest": {
"generation": 42,
"active": "slot-000042",
"previous": "slot-000041",
"promoted_at": "2026-09-30T22:14:05Z",
"rollback_until": "2026-09-30T23:14:05Z"
}
},
{
"assigned": true,
"enabled": true,
"health": "healthy",
"installed": true,
"kind": "acme",
"profile_id": "prod-service",
"revision": 4
},
{
"assigned": false,
"enabled": false,
"health": "disabled",
"installed": false,
"kind": "est",
"revision": 0
}
],
"node_id": "node_7c1e4b2a-93d5-4f61-8a0e-2b6d9f3c5e17",
"policy_last_synced_at": "2026-10-01T14:21:30Z",
"policy_sha256": "Jd8rT2qWm5Xz1vB7nK4eYc0hLpA9sF3uGiR6oE2wNtM",
"policy_version": 7,
"status": "ok"
}
All values are examples. status is ok or degraded; it becomes degraded when the OTLP audit exporter is degraded or, with dependency discovery enabled, a probe is failing or observations are queued. Each configured adapter appears in integrations with its own health and, when degraded, an error_code.
integrations
Requires a workload SVID that chains to the node's workload trust bundle and falls inside allowed_spiffe_prefixes:
sectigo-edge -ca local-api-ca.pem \
-cert workload-svid.pem -key workload-svid-key.pem integrations
{
"integrations": [
{
"kind": "hashicorp_vault",
"installed": true,
"health": "degraded",
"error_code": "vault_unavailable",
"manifest": {
"protocol": "sectigo-edge.vault-kv-pointer.v1",
"generation": 3,
"active": "slot-000003",
"active_sha256": "b5Zq0kVf3sR8yW1nT6uE2hJ9cL4xA7mD0pG5iK3oB1Q",
"updated_at": "2026-09-28T09:12:44Z",
"pointer_version": 3
}
}
],
"node_id": "node_7c1e4b2a-93d5-4f61-8a0e-2b6d9f3c5e17"
}
Without a client certificate the node answers 401 and the CLI prints sectigo-edge: Mesh Client returned 401 Unauthorized.
discover
Prints the node's signed discovery envelope: protocol sharppki.v1, tenant and node IDs, local and cloud API URLs, the node's capabilities (for example dual-slot, hardware-identity, nginx-atomic-rotation, signed-trust-events), signing algorithm, key protection and public-key fingerprint. Each document is valid for two minutes.
events
Reads the node's signed, low-authority trust-event feed and verifies every signature against a node public key you pin:
| Flag | Environment variable | Default | Description |
|---|---|---|---|
-tenant | SECTIGO_EDGE_TENANT | — | Expected tenant ID (required). |
-node-spki | SECTIGO_EDGE_NODE_SPKI_FILE | — | Pinned node public key (one PUBLIC KEY PEM block or DER) (required). |
-node-spki-sha256 | SECTIGO_EDGE_NODE_SPKI_SHA256 | — | base64url SHA-256 of that key (required). |
-event-cursor-file | SECTIGO_EDGE_EVENT_CURSOR_FILE | <user config dir>/sectigo-edge/event-cursors.json | Durable cursor so the next run resumes after the last verified event. On Linux the file must not be readable by group or others. |
-event-topics | — | all | Comma-separated topics: capability.observed, capability.expired, dependency.observed, service.claimed, identity.rotated, trust_bundle.updated, policy.version.available, certificate.staged, certificate.promoted, incident.issuance_paused. |
-event-wait | — | 20s | Long-poll duration, whole seconds from 0s to 25s. |
-event-limit | — | 100 | Events per batch, 1–256. |
-watch | — | false | Keep following and print one verified envelope per line (requires -event-wait of at least 1s). |
-development-requester | — | — | Development nodes only. |
The node must advertise signed-trust-events (it does when trust_event_subscriber_spiffe_prefixes is set) and your client certificate must fall inside one of those prefixes.
sectigo-edge -url https://127.0.0.1:9443 -ca /etc/sectigo-edge/ca.pem \
-cert /run/spire/svid.pem -key /run/spire/svid-key.pem \
-tenant "$SECTIGO_EDGE_TENANT" -node-spki /etc/sectigo-edge/node-public.pem \
-node-spki-sha256 "$SECTIGO_EDGE_NODE_SPKI_SHA256" \
-event-topics certificate.promoted,policy.version.available -watch events
{"protocol":"sharppki.v1","key_id":"node_7c1e4b2a-93d5-4f61-8a0e-2b6d9f3c5e17","algorithm":"ECDSA-P256-SHA256","payload":{"protocol":"sharppki.trust-event.v1","event_id":"tevt_Rk2...","tenant_id":"acme-corp","source":"mesh_node","source_id":"node_7c1e4b2a-93d5-4f61-8a0e-2b6d9f3c5e17","sequence":2382,"topic":"certificate.promoted","type":"certificate.rotation_promoted","occurred_at":"2026-10-01T14:25:02.118Z","data":{"active":"slot-000043","generation":43,"integration":"nginx","previous":"slot-000042"},"source_event_sha256":"Rk2...","previous_source_sha256":"q3V..."},"payload_sha256":"...","signature":"..."}
Example values abbreviated. Verification failures (wrong pin, tenant mismatch, stale discovery, bad signature, out-of-order sequence) stop the command with an error rather than printing unverified data.
acme-eab-create
Creates one short-lived ACME External Account Binding credential bound to one node and one workload, writes it atomically to the node's credential store and prints the client secret once. It works on the local file only and does not contact the node.
| Flag | Environment variable | Default | Description |
|---|---|---|---|
-acme-eab-file | SECTIGO_EDGE_ACME_EAB_FILE | — | Absolute path of the credential store. Its directory must already exist. |
-acme-eab-node-id | SECTIGO_EDGE_ACME_EAB_NODE_ID | — | Enrolled node ID allowed to accept the credential. |
-acme-eab-workload | — | — | Exact workload SPIFFE ID allowed to create one account. |
-acme-eab-validity | — | 15m | Between 5m and 23h. |
install -d -m 0700 ./edgepki-eab
sectigo-edge \
-acme-eab-file "$PWD/edgepki-eab/eab-credentials.json" \
-acme-eab-node-id node_7c1e4b2a-93d5-4f61-8a0e-2b6d9f3c5e17 \
-acme-eab-workload spiffe://acme-corp.example/ns/prod/sa/web \
-acme-eab-validity 15m \
acme-eab-create > ./edgepki-eab/client-credential.json
chmod 0600 ./edgepki-eab/client-credential.json
cat ./edgepki-eab/client-credential.json
{
"displayed_once": true,
"expires_at": "2026-10-01T14:45:00.000000000Z",
"hmac_key_base64url": "<43-character secret>",
"key_id": "eab_Vt3hQm9xL2pK7rN4sW8yZ1cB",
"node_id": "node_7c1e4b2a-93d5-4f61-8a0e-2b6d9f3c5e17",
"not_before": "2026-10-01T14:29:00.000000000Z",
"workload_spiffe_id": "spiffe://acme-corp.example/ns/prod/sa/web"
}
Each run also removes expired entries from the store. See ACME for delivering the files.
adcs-recover
Binds an existing Microsoft ADCS Request ID to a transaction that stopped in recovery_required. Requires -transaction (the tx_… transaction ID) and a positive -adcs-request-id, and a client certificate whose SPIFFE ID is listed exactly in microsoft_adcs_recovery_spiffe_ids.
.\sectigo-edge-windows-amd64.exe -ca .\local-api-ca.pem `
-cert .\pki-admin-svid.pem -key .\pki-admin-svid-key.pem `
-transaction tx_adcs_01 -adcs-request-id 1842 adcs-recover
See Microsoft ADCS.
mcp
Runs a read-only Model Context Protocol server on standard input/output (protocol version 2025-06-18) for AI assistants and agents. It exposes three tools with no arguments:
| Tool | Equivalent command |
|---|---|
edge.status | status |
edge.integrations | integrations |
edge.discover | discover |
No tool can issue, approve, rotate or revoke anything. Configure your MCP client to launch sectigo-edge with the connection flags it needs followed by mcp.
version
sectigo-edge version
0.1.26