Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Create a client certificate

See Addresses for how your wallet address is your mail identity. This page covers the sithbit mailbox create-cert command.

sithbit mailbox create-cert \
  [--keypair <path>] \
  [--out <prefix>]

create-cert mints the TLS client certificate a stock mail app (Thunderbird, Outlook, …) presents to log in over SASL EXTERNAL: a self-signed Ed25519 leaf whose public key is your wallet’s signing key, so the SMTP/IMAP/POP servers read the wallet address straight off the certificate during the TLS handshake — no password typed, nothing stored on either side. The server must have client_cert_auth turned on for the listener (see the configuration reference); your wallet address stays the username. (Thunderbird itself currently cannot import the bundle — see the known issue in its walk-through; the files stay valid for other clients.)

The command is fully offline: it contacts no RPC endpoint and writes nothing on-chain. Everything is derived purely from the local wallet keypair, so you can regenerate the same files any time, anywhere — and because the certificate is self-signed, there is no certificate authority and no renewal to manage.

Arguments

  • --keypair <path> (optional, -k) — the wallet keypair file the certificate is derived from. Defaults to the keypair in your Solana CLI config when omitted.
  • --out <prefix> (optional, -o) — output path prefix; the three files below are written as <prefix>.crt / <prefix>.key / <prefix>.p12 (an extension already on the prefix is replaced, not appended). When omitted, the certificate and key PEM blocks are printed to stdout instead, and no .p12 is written.

What it writes

With --out <prefix>, three files:

  • <prefix>.crt — the certificate, as PEM.
  • <prefix>.key — the private key, as PKCS#8 PEM.
  • <prefix>.p12 — both combined in a password-less PKCS#12 bundle, the one file meant for a mail app’s certificate-import dialog (Thunderbird currently refuses it — see the known issue).

The .p12 carries no MAC and no password, so its bytes are deterministic per wallet: re-running the command for the same keypair reproduces the identical file. The .key and .p12 files embed your wallet secret — guard them like the wallet itself.

On unix, .key and .p12 are written owner-only (0o600) from the moment they’re created, and an existing file at either path is tightened to that mode before the new bytes land. .crt is public and keeps the process’s normal (umask-default) permissions. Non-unix targets set no mode bits; guarding the files yourself still applies there.

Installing the certificate

Importing the files into a mail app — including leaving the .p12 import’s password prompt blank — is covered step by step in the client walk-throughs: Thunderbird and Outlook. Both pages also show how their extension mints the identical files without the CLI.

Examples

Print the certificate and key PEM to stdout:

sithbit mailbox create-cert

Write ./mywallet.crt, ./mywallet.key, and ./mywallet.p12:

sithbit mailbox create-cert --out ./mywallet
  • Mailbox keys — the other optional key: a delegated X25519 encryption key for signing-only wallets. Unrelated to login — the client certificate authenticates you to mail servers, the delegated key changes what senders seal mail to.
  • Create a mailbox — the certificate logs you in to a server account; the mailbox is what receives your on-chain mail.
  • Looking up a mailbox — inspect a mailbox’s settings.