certtool: allow specifying RSA-PSS parameters for key generation

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

1 files changed, 10 insertions, 1 deletions

diff --git a/src/certtool-args.def b/src/certtool-args.def
index 2d045d1123..fcb895e829 100644
--- a/src/certtool-args.def
+++ b/src/certtool-args.def
@@ -181,7 +181,9 @@ flag = {
     name      = generate-privkey;
     value     = p;
     descrip   = "Generate a private key";
-    doc = "";
+    doc = "When generating RSA-PSS private keys, the --hash option will
+restrict the allowed hash for the key; in the same keys the --salt-size
+option is also acceptable.";
 };
 
 flag = {
@@ -564,6 +566,13 @@ flag = {
 };
 
 flag = {
+    name      = salt-size;
+    arg-type  = number;
+    descrip   = "Specify the RSA-PSS key default salt size";
+    doc = "Typical keys shouldn't set or restrict this option.";
+};
+
+flag = {
     name      = inder;
     descrip   = "Use DER format for input certificates, private keys, and DH parameters ";
     disabled;