certutil cert: Errors when using - as a first character for --pass and probably --ca-pass

[e42sh]

Elasticsearch Version

8.4.3

Installed Plugins

No response

Java Version

bundled

OS Version

uname -a
Linux ip-10-143-255-136.eu-central-1.compute.internal 4.14.305-227.531.amzn2.x86_64 #1 SMP Tue Feb 14 09:55:28 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

Problem Description

During the startup sequence I use the pregenerated password for transport.

transport_pass="$(elasticsearch-keystore show xpack.security.transport.ssl.keystore.secure_password)"
elasticsearch-certutil cert --silent --ca ca.p12 --days 90 --dns es.local --ip 127.0.0.1 --name transport --pass "$transport_pass" --ca-pass "" --out transport.p12

if transport_pass is starting with a - the certutil fails.

Example:

bin/elasticsearch-certutil cert --silent --ca ca.p12 --days 90 --dns es.local --ip 127.0.0.1 --name transport --pass '-ftest' --ca-pass "" --out transport.p12

This command results in

Simplifies certificate creation for use with the Elastic Stack

Non-option arguments:
command

Option             Description
------             -----------
-E <KeyValuePair>  Configure a setting
-h, --help         Show help
-s, --silent       Show minimal output
-v, --verbose      Show verbose output
ERROR: f is not a recognized option

Steps to Reproduce

bin/elasticsearch-certutil cert --silent --ca ca.p12 --days 90 --dns es.local --ip 127.0.0.1 --name transport --pass '-ftest' --ca-pass "" --out transport.p12

Logs (if relevant)

No response

[elasticsearchmachine]

Pinging @elastic/es-security (Team:Security)

[ywangd]

You can use the alternative form for specifying values with special characters, i.e. instead of --pass '-ftest', use --pass=-ftest.