CERTMONGER(1)

💖 getcert — CERTMONGER(1) 💖

okay bestie, so this is a page from the certmonger Manual, and it's all about the getcert add-scep-ca command. it's giving "certificate authority setup but make it SCEP" and honestly? we love her.

---

✨ NAME ✨

getcert — well, specifically the add-scep-ca subcommand, which is the whole vibe of this page 🌸

---

🦋 SYNOPSIS 🦋

getcert add-scep-ca [options]

that's it. that's the whole entrance. short, iconic, no notes 💅

---

🎀 DESCRIPTION 🎀

okay so what this does: add-scep-ca adds a CA configuration to certmonger, and you can totally use that config later to enroll certificates. main character behavior fr fr.

the configuration it sets up uses the bundled scep-submit helper. and honestly? the add-scep-ca command is basically a little wrapper around the add-ca command. like, add-ca but with a SCEP glow-up ✨

---

🌈 OPTIONS 🌈

heads up bestie: all the certificate files you provide have to be in PEM format. no exceptions, no cap.

• -c NAME, --ca=NAME — the nickname you're giving this CA configuration. you can pass this same value later into getcert's request, resubmit, and start-tracking commands using the -c flag. it's like a contact name for your CA 💖
• -u URL, --url=URL — where the SCEP server's enrollment interface lives. this option must be specified. non-negotiable, sorry babe 😭
• -R FILE, --ca-cert=FILE — the location of a PEM-formatted copy of the CA's certificate, used to verify the TLS connection to the SCEP server.

this option must be specified if the URL is an https location. so like, if you're doing https, you need this. periodt.

• -N FILE, --signingca=FILE — the location of a PEM-formatted copy of the SCEP server's CA certificate. normally the certmonger daemon just supplies a discovered value for this, but you can specify one yourself if you're troubleshooting 👀
• -r FILE, --ra-cert=FILE — the location of a PEM-formatted copy of the SCEP server's RA's certificate. again, a discovered value is normally supplied by the certmonger daemon, but you can hand-specify one for troubleshooting purposes.
• -I FILE, --other-certs=FILE — the location of a file holding other PEM-formatted certificates that might be needed to properly verify signed responses the SCEP server sends back to the client. a discovered set is normally supplied by the certmonger daemon, but you can specify one for troubleshooting.
• -i ID, --id=ID — a CA identifier value that gets passed to the server when the scep-submit helper is used to go grab copies of the server's certificates.
• -n, --non-renewal — okay so the SCEP Renewal feature lets a client with a previously-issued certificate use that cert plus the associated private key to request a new certificate for a different key pair. it can also support certmonger's rekeying feature if the SCEP server advertises support for it. this option forces the scep-submit helper to issue requests without using this feature. so like, renewal feature: off 🚫
• -v, --verbose — be verbose about errors. normally the details of an error from the daemon get suppressed if the client can come up with a diagnostic suggestion, but with this? you get the tea ☕

---

💀 BUGS 💀

found a bug? bestie please file tickets at:

https://fedorahosted.org/certmonger/

---

👑 SEE ALSO 👑

the whole friend group, go say hi:

• certmonger(8)
• getcert(1)
• getcert-add-ca(1)
• getcert-list-cas(1)
• getcert-list(1)
• getcert-modify-ca(1)
• getcert-refresh-ca(1)
• getcert-refresh(1)
• getcert-rekey(1)
• getcert-remove-ca(1)
• getcert-request(1)
• getcert-resubmit(1)
• getcert-status(1)
• getcert-stop-tracking(1)
• certmonger-certmaster-submit(8)
• certmonger-dogtag-ipa-renew-agent-submit(8)
• certmonger-dogtag-submit(8)
• certmonger-ipa-submit(8)
• certmonger-local-submit(8)
• certmonger-scep-submit(8)
• certmonger_selinux(8)

---

and that's the whole page, bestie!! this one's from the certmonger Manual, dated February 24, 2015, and it's giving CERTMONGER(1) energy from start to finish. go set up that SCEP CA, you absolute icon 💅✨🦋