CERTMONGER(1)

📦 version 0.79.21, in alpine 3.24, centos-stream 10, centos-stream 9, debian bookworm, debian trixie, fedora 43, fedora 44, opensuse-leap 16.0, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ CERTMONGER ✨

okay bestie, sit down, hydrate, because we're reading CERTMONGER(1) together and it's a whole journey. This is part one of the manual, so no, we're not done yet, don't touch that scroll wheel. 💅

🎀 NAME 🎀

getcert

that's it. that's the name. short, iconic, does exactly what it says on the tin. 👑

🌸 SYNOPSIS 🌸

getcert list [options]

💖 DESCRIPTION 💖

so basically certmonger is out here keeping an eye on your certificates, right? and getcert list is the move where you go "hey bestie, what are you monitoring, what are you trying to get" and it just tells you. it queries certmonger for a list of the certificates it's monitoring, or the ones it's actively trying to obtain. that's the whole vibe. no cap. 🦋

🎀 ENROLLMENT OPTIONS 🎀

these are the options that filter by who's issuing the thing.

  • -c NAME, --ca=NAME — only show you the entries that use the CA you named. and heads up: the name you put here should be one that getcert list-cas actually lists, so if you're out here making up CA names, that's on you. 🙈

💅 LISTING OPTIONS 💅

now the fun part, the filters. pick your fighter.

  • -r, --requests-only — only lists the entries that are currently being enrolled or refreshed. the busy ones. the main characters. 🔥
  • -t, --tracking-only — the opposite vibe: only lists entries that are not currently being enrolled or refreshed. the chill ones, just vibing, being watched. 😌
  • -u, --utc — timestamps in UTC instead of local time. for when you want your times in the universal language. ✨
  • -d DIR, --dbdir=DIR — only lists entries using an NSS database in the directory you specify, for storing the certificate. tell it where the db lives and it'll narrow it down. 🗂️
  • -n NAME, --nickname=NAME — only lists tracking requests that use an NSS database and the nickname you give, for storing the certificate. two conditions, one flag. slay. 🎀
  • -f FILE, --certfile=FILE — only lists tracking requests that say the certificate should be stored in the file you name. 📄
  • -i NAME, --id=NAME — only lists tracking requests that use this request nickname. this one's the request's own little name tag. 🏷️

🌈 STATES 🌈

okay this is the big one. certmonger is a whole pipeline girlie and every request moves through states. here's every single one, in order, no skips, because we don't do skipping. 💯

  • NEED_KEY_PAIR — the service is about to generate a brand new key pair. getting ready to cook. 🔑
  • GENERATING_KEY_PAIR — the service is currently generating that new key pair. it's happening. right now. 🔥
  • NEED_KEY_GEN_PERMS — the service hit a filesystem permission error while trying to save the freshly generated key pair. rude. 😭
  • NEED_KEY_GEN_PIN — the service is missing the PIN it needs to get into an NSS database so it can save the new key pair, or the PIN it has for a database is wrong. 😬
  • NEED_KEY_GEN_TOKEN — the service couldn't find a suitable token to use for generating the new key pair. the token is missing. gone. not here. 🫠
  • HAVE_KEY_PAIR — key pair generated successfully. we ate. ✅
  • NEED_KEYINFO — the service needs to read info about the key pair. 📖
  • READING_KEYINFO — the service is currently reading that key pair info. 👀
  • NEED_KEYINFO_READ_PIN — the service is missing the PIN it needs to access an NSS database to read info about the newly generated key pair, or the PIN it has for a database is wrong, or it has the wrong password for accessing a key stored in encrypted PEM format. three ways to be locked out, pick your poison. 🔐
  • NEED_KEYINFO_READ_TOKEN — the service couldn't find the token where the key pair is supposed to be stored. where did it go. nobody knows. 💀
  • HAVE_KEYINFO — key pair info successfully read. we know things now. 🧠
  • NEED_CSR — the service is about to generate a new signing request. 📝
  • GENERATING_CSR — the service is generating a signing request. as we speak. ✍️
  • NEED_CSR_GEN_PIN — the service is missing the PIN it needs to access an NSS database in order to use the key pair, or the PIN it has for a database is wrong, or it has the wrong password for reading a key stored in encrypted PEM format. again. 🔐
  • NEED_CSR_GEN_TOKEN — the service couldn't find the token where the key pair is supposed to be stored. token, where art thou. 🫥
  • HAVE_CSR — signing request generated successfully. periodt. ✅
  • NEED_SCEP_DATA — the service is about to generate the data specifically needed for connecting to a CA using SCEP. 🛰️
  • GENERATING_SCEP_DATA — the service is generating that SCEP-connection data. it's in the lab. 🧪
  • NEED_SCEP_GEN_PIN — the service is missing the PIN it needs to access an NSS database in order to use the key pair, or the PIN it has for a database is wrong, or it has the wrong password for reading a key stored in encrypted PEM format. (this PIN situation is giving recurring villain honestly) 🔐
  • NEED_SCEP_GEN_TOKEN — the service couldn't find the token where the key pair is supposed to be stored. yes, again. 🫥
  • NEED_SCEP_ENCRYPTION_CERT — the service is waiting until it can retrieve a copy of the CA's certificate before it can generate the data it needs to connect to the CA using SCEP. it's just waiting. patiently. mostly. ⏳
  • NEED_SCEP_RSA_CLIENT_KEY — so the CA should be contacted using SCEP, but SCEP requires the client key pair to be an RSA key pair, and this one is not. mismatch moment. 😵
  • HAVE_SCEP_DATA — SCEP data generated successfully. we move. ✅
  • NEED_TO_SUBMIT — the service is about to submit a signing request to a CA for signing. fingers crossed. 🤞
  • SUBMITTING — the service is currently submitting that signing request to a CA for signing. 📤
  • NEED_CA — the service can't submit a request to a CA because it doesn't know which CA to use. bestie, pick a CA. 🙈
  • CA_UNREACHABLE — the service couldn't contact the CA, but it will try again later. it's not giving up, it's just on a little break. 🔁
  • CA_UNCONFIGURED — the service is missing configuration it'll need to actually contact the CA successfully. something's missing from the setup. 🧩
  • CA_REJECTED — the CA rejected the signing request. 💔
  • CA_WORKING — the CA hasn't approved or rejected the request yet. the service will check on the status later. it's pending, your honor. ⌛
  • NEED_TO_SAVE_CERT — the CA approved the signing request, and the service is about to save the issued certificate to the location it's been told to save it to. 💾
  • PRE_SAVE_CERT — the service is running a configured pre-saving command before it saves the newly issued certificate to the location it's been told to save it to. warm-up act. 🎬
  • START_SAVING_CERT — the service is starting to save the issued certificate to the location it's been told to save it to. 🏁
  • SAVING_CERT — the service is attempting to save the issued certificate to the location it's been told to save it to. ✍️
  • NEED_CERTSAVE_PERMS — the service hit a filesystem permission error while trying to save the newly issued certificate to the location it's been told to save it to. 😤
  • NEED_CERTSAVE_TOKEN — the service can't find the token where the newly issued certificate is supposed to be stored. 🔍
  • NEED_CERTSAVE_PIN — the service is missing the PIN required to access an NSS database so it can save the newly issued certificate to the location it's been told to save it to. 🔐
  • NEED_TO_SAVE_CA_CERTS — the service is about to save the issuing CA's certificate to the locations it's been told to save them to. (note the plural, there are locations, be ready) 📚
  • START_SAVING_CA_CERTS — the service is starting to save the issuing CA's certificate to the locations it's been told to save them to. 🏁
  • SAVING_CA_CERTS — the service is saving the issuing CA's certificate to the locations it's been told to save them to. 💾
  • NEED_TO_SAVE_ONLY_CA_CERTS — the service is about to save the issuing CA's certificate to the locations it's been told to save them to. yes, it reads a lot like the one above. yes, it's a separate state. we don't question the pipeline. 🤷
  • START_SAVING_ONLY_CA_CERTS — the service is starting to save the issuing CA's certificate to the locations it's been told to save them to. 🏁
  • SAVING_ONLY_CA_CERTS — the service is saving the issuing CA's certificate to the locations it's been told to save them to. 💾
  • NEED_CA_CERT_SAVE_PERMS, NEED_ONLY_CA_CERT_SAVE_PERMS — the service hit a filesystem permission error while trying to save the issuing CA's certificate to the locations it's been told to save them to. (in the source these two are squished together on one line and honestly? we respect the chaos 💅) 😤
  • NEED_TO_READ_CERT — the service is about to read the issued certificate from the location it's been told to save it to. 📖
  • READING_CERT — the service is reading the issued certificate from the location it's been told to save it to. 👀
  • SAVED_CERT — the service has finished saving the issued certificate and the issuer's certificate to the locations it's been told to save them to. complete. done. gorgeous. ✅
  • POST_SAVED_CERT — the service is running a configured post-saving command after saving the newly issued certificate to the location it's been told to save them to. encore performance. 🎤
  • MONITORING — the service is monitoring the certificate and waiting for its not-valid-after date to get close. and btw, this is expected to be the status you see most often. it's the default vibe. this is the state that's just out here living its life. 😌✨
  • NEED_TO_NOTIFY_VALIDITY — the service is about to notify the system administrator that the certificate's not-valid-after date is approaching. 📣
  • NOTIFYING_VALIDITY — the service is notifying the system administrator that the certificate's not-valid-after date is approaching. 🔔
  • NEED_TO_NOTIFY_REJECTION — the service is about to notify the system administrator that the CA rejected the signing request. 📣
  • NOTIFYING_REJECTION — the service is notifying the system administrator that the CA rejected the signing request. 🔔
  • NEED_TO_NOTIFY_ISSUED_SAVE_FAILED — the service needs to notify the system administrator that the CA issued a certificate, but there was a problem saving that certificate to the location the service was told to save it to. 📣
  • NOTIFYING_ISSUED_SAVE_FAILED — the service is notifying the system administrator that the CA issued a certificate, but there was a problem saving that certificate to the location the service was told to save it to. 🔔
  • NEED_TO_NOTIFY_ISSUED_CA_SAVE_FAILED — the service needs to notify the system administrator that the CA issued a certificate, and the issued certificate was saved to the location the service has been told to save it to, but there was a problem saving the CA's certificate to the locations the service was told to save it to. so close. 📣
  • NOTIFYING_ISSUED_CA_SAVE_FAILED — the service is notifying the system administrator that the CA issued a certificate, and the issued certificate was saved to the location the service has been told to save it to, but there was a problem saving the CA's certificate to the locations the service was told to save it to. 🔔
  • NEED_TO_NOTIFY_ISSUED_SAVED — the service needs to notify the system administrator that the CA issued a certificate and it has been saved to the location the service has been told to save it to. good news state!! we love to see it. 🎉💖

NOTIFYING_ISSUED_SAVED 💖

okay so bestie, the service is letting the sysadmin know that the CA issued a certificate AND it got saved to the location the service was told to save it. mission accomplished, we're so back. ✨

NEED_TO_NOTIFY_ONLY_CA_SAVE_FAILED 😭

the service needs to tell the system administrator that there was a problem saving the CA's certificates to the specified location. like, it's got bad news and it hasn't delivered it yet.

NOTIFYING_ONLY_CA_SAVE_FAILED 💀

the service is notifying the system administrator that there was a problem saving the CA's certificates to the specified location. bad news = delivered.

NEED_GUIDANCE 🙈

an unhandled error happened while it was trying to contact the CA. OR — and this is the second possibility, fr — the service has just been told to monitor a certificate which doesn't exist, and it has no location specified for storing a key pair that could be used to generate a signing request to go get one. either way: it's stuck, it needs a human. 🫶

NEWLY_ADDED 🎀

the service has just been told to track a certificate, or to generate a signing request to obtain one. fresh start energy.

NEWLY_ADDED_START_READING_KEYINFO 🔥

same deal — just told to track a certificate, or generate a signing request for one — and it's about to check if there's already a key pair hanging around.

NEWLY_ADDED_READING_KEYINFO 🌸

just told to track a certificate or generate a signing request, and it is checking if there's already a key pair present. currently investigating, no conclusions yet.

NEWLY_ADDED_NEED_KEYINFO_READ_PIN 💅

just told to track a certificate or generate a signing request, and it could not check whether a key pair was present, because it's missing the PIN required to access an NSS database — or because it has an incorrect PIN for a database. so either way, that database said "no 💜" and here we are.

NEWLY_ADDED_NEED_KEYINFO_READ_TOKEN 🦋

just told to track a certificate or generate a signing request, and it couldn't check for a key pair because the token that should be used for storing the key pair is not present. no token, no check, no cap.

NEWLY_ADDED_START_READING_CERT 🌈

just told to track a certificate or generate a signing request, and it's about to check whether a certificate is already present in the specified location.

NEWLY_ADDED_READING_CERT ⭐

just told to track a certificate or generate a signing request, and it's checking whether a certificate is already sitting in the specified location. peak detective behavior.

NEWLY_ADDED_DECIDING 👑

just told to track a certificate or generate a signing request, and it's figuring out its next course of action. the deliberation era. main character decision moment.

🐛 BUGS 🐛

found one? please file tickets for any that you find at

https://fedorahosted.org/certmonger/

we appreciate you, fr fr 💖

👀 SEE ALSO 👀

and that's a wrap on the whole page, bestie 🎀 this lil number is from the certmonger Manual, dated June 28, 2016, and it lives under CERTMONGER(1). slay, go manage some certificates, you've got this 💅✨

📦 where this page comes from