Enrolment has two halves: you generate a key and a request, and an administrator — or an invitation you already hold — turns it into a certificate. Your private key never leaves your machine. This server does not generate it, receive it, or store it.

1. Generate a key and a request

openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
    -keyout authbox.key -out authbox.csr \
    -subj "/C=US/O=your-org/CN=your-name"

Order matters, and openssl reverses it. A name written CN=alice,O=acme,C=US is given to -subj as /C=US/O=acme/CN=alice — most general first. Typing it the other way round produces a different name that looks the same in a listing, and enrolment will be refused for a subject that does not match.

Keep authbox.key. Without it the certificate you get back is useless, and nobody can issue you another one that matches it.

2. Submit it

curl --data-binary @authbox.csr \
     https://enroll.piv.authbox.us/enroll

Or paste the contents of authbox.csr here:

This server enrols by invitation. Pasting a request here without one will be refused — open this page through the invitation link you were given, and the token travels with the form automatically.

Or run one script

A single file that does all of the above and prints how to install the result. Read it before you run it — it is short, and the key it generates never leaves your machine.

curl -O https://enroll.piv.authbox.us/enroll/../enrol.sh    # or enrol.ps1 on Windows
sh enrol.sh your-name

Or use the command-line tool

authboxctl enroll does all of the above in one step, including an offline mode that writes the request to a file when this server is not reachable from where you are.

3. What happens next

If your invitation permits it, the certificate is returned immediately. Otherwise an administrator reviews the request first.