Skip to main content

TCP reference for pomerium-cli

This TCP reference covers pomerium-cli commands you can use to manage TCP connections in Pomerium.

Usage

pomerium-cli tcp [destination] [flags]

Flags

FlagsDescriptionType
#--alternate-ca-pathPath to CA certificate to use for HTTP requests.string
#--browser-cmdCustom browser command to run when opening a URL.string
#--ca-certPath to CA certificate to use for HTTP requests.string
#--client-cert(optional) PEM-encoded client certificate.string
# --client-key(optional) PEM-encoded client certificate key.string
# --client-cert-from-store(optional) If provided, pomerium-cli will attempt to use a client certificate from the system trust store (macOS and Windows only), searching for a certificate based on the trusted CA names advertised by Pomerium in the TLS handshake.none
# --client-cert-issuer(optional) When used in combination with --client-cert-from-store, restricts the client certificate search based on a particular attribute of the certificate's Issuer name.string
# --client-cert-subject(optional) When used in combination with --client-cert-from-store, restricts the client certificate search based on a particular attribute of the certificate's Subject name.string
#--disable-tls-verificationDisables TLS verification.none
#-h, --helpHelp for tcp.none
#--listenLocal address to start a listener on (default "127.0.0.1:0").string
#--pomerium-urlThe URL of the Pomerium server to connect to.string
#-v, --versionVersion for pomerium-cli.none

Certificate name filters

The certificate name filter syntax is attribute=value. A name filter can accept only one name attribute. The value must be an exact match (not a substring match). Make sure to quote name filters as appropriate for your shell.

For example, --client-cert-issuer "CN=My Trusted CA" would filter for a certificate directly issued by a CA with the Common Name "My Trusted CA".

Or, --client-cert-subject "OU=My Department" would filter for a certificate whose Subject name contains the Organizational Unit Name "My Department".

The supported name attributes are:

  • commonName (CN)
  • countryName (C)
  • localityName (L)
  • organizationName (O)
  • organizationalUnitName (OU)
  • postalCode
  • serialNumber
  • stateOrProvinceName (ST)
  • streetAddress (STREET)

Either the long or abbreviated attribute name may be used (for example, localityName=New York or L=New York).

Values are case sensitive: L=new york will not match the Locality Name "New York".