beame-insta-ssl/help-messages/no-command.txt

Quick TLS (SSL) security for you server by Beame.io

Usage information and examples:

	beame-insta-ssl creds getCreds --regToken BIG_TOKEN_FROM_EMAIL

		Creates 'SOMETHING.beameio.net' certificate.

	beame-insta-ssl creds list

		Lists certificates


    beame-insta-ssl tunnelClient make --dst DESTINATION_PORT --fqdn CLIENT_SIDE_CERT --src DESTINATION_HOST:DESTINATION_PORT

        Client side of the TCP tunnel (see below). DESTINATION_PORT points to local Client application (e.g. 3389 for RDP client)
        This implementation requires valid certificate for connection (CLIENT_SIDE_CERT - fqdn of a credential existing
        on local machine)

	beame-insta-ssl tunnel make --dst DESTINATION_PORT --proto tcp [--fqdn MY_FQDN] [--highestFqdn PARENT_FQDN] [--trustDepth LEVEL]

		Creates tunnel from https://MY_FQDN.beameio.net to the
		DESTINATION_PORT. Client access allowed with client certificate that satisfies conditions:
		* Is not "lower" than "trustDepth LEVEL" beneath MY_FQDN credential
		* Has in its certificate chain one credential that can be found under(including) "highestFqdn PARENT_FQDN"
		These parameters (highestFqdn & trustDepth) can be skipped, then any credential that was created under MY_FQDN
		will be allowed

    Using beame-insta-ssl for RDP / VNC / SSH etc
        Set DESTINATION_PROTO to "tcp", this will create a native tcp tunnel with termination on your machine and option to
        control access by setting "highestFqdn" (to allow search up my trust tree) and "trustDepth" (to define how levels below
        are valid to connect). If no auth required, "--noAuth" true shall be set. This type of tunnel requires "beame-insta-ssl client" to be used on the other side of the tunnel
        with client-certificate that satisfies the trust criteria (unless --noAuth is set on server side)

    Example RDP:
        Server side (host Windows machine):
            beame-insta-ssl tunnel make --dst 3389 --proto tcp --fqdn rdpFqdn.v1.p.beameio.net --highestFqdn oneOfMyParents.v1.p.beameio.net --trustDepth 1

        Client side (connecting client machine):
            beame-insta-ssl tunnelClient make --dst 3389 --fqdn myclientcert.oneOfMyParents.v1.d.beameio.net --src rdpFqdn.v1.p.beameio.net:443

         Now run RDP client on client machine (point it to 127.0.0.1 and pre-configure username/password)


	beame-insta-ssl tunnel make --dst [DESTINATION_HOST:]DESTINATION_PORT --proto DESTINATION_PROTO [--hostname <HOSTNAME>] [--fqdn FQDN]

        Creates tunnel from https://SOMETHING.beameio.net to the
      	specified destination.

        If DESTINATION_PROTO is "http", the tunnel will terminate TLS
        traffic and transform the requests to HTTP. This way you can
        run existing HTTP server unmodified.

        Examples:
        	beame-insta-ssl tunnel make --dst 8080 --proto http
        	beame-insta-ssl tunnel make --dst 192.168.0.200:8443 --proto https --hostname web200.localdomain

        DESTINATION_HOST   - your end of the tunnel, defaults to localhost
        DESTINATION_PORT   - your end of the tunnel
        DESTINATION_PROTO  - protocol to use on your end of the tunnel ("http" or "https")
        HOSTNAME           - The "Host:" header to set in incoming requests (terminating tunnel only)
        FQDN               - The FQDN to use for the remote end of the tunnel. If you only have one,
        		             which should be the usual case, you don't need to specify the FQDN.


	beame-insta-ssl creds exportCred --fqdn <FQDN> --dir <DESTINATION_FOLDER>

		Example:
			beame-insta-ssl creds exportCred --fqdn lvqba57mf13sitz7.xxxxxxxxxxxxxxxx.v1.d.beameio.net --dir my_cert_dir

		FQDN               - the FQDN of the certificate to export
		DESTINATION_FOLDER - the folder to export the certificate to. The folder must exist.
		                     The export operation will place 'FQDN.*' files in the folder.
		                     No files will be overwritten. Please make sure you have restrictive
		                     permissions for that folder. Current version of beame-insta-ssl
		                     does not handle resulting files' permissions.

	beame-insta-ssl creds renewCert --fqdn fqdn

		Renew certificate_

	beame-insta-ssl creds revokeCert --signerFqdn <SIGNER_FQDN> --fqdn <FQDN>

		Revoke certificate. If revoking your own certificate, for which you
		have a private key, SIGNER_FQDN should be same as FQDN.