CERTMONGER(1)

💖 NAME 💖

getcert — yeah bestie, that's the whole name, that's her. The rekey-flavored one. 🎀

🦋 SYNOPSIS 🦋

getcert rekey [options]

✨ DESCRIPTION ✨

Okay so getcert rekey is the glow-up command. It tells certmonger to generate a whole new key pair, build a signing request for the public key, and yeet that signing request over to a CA so they can sign it — all so that both a certificate and its private key get replaced. Both halves, no crumbs, periodt. 💅

🎀 SPECIFYING REQUESTS BY NICKNAME 🎀

• -i NAME, --id=NAME — The new key pair gets generated and the new certificate gets obtained for the tracking request that has this nickname. If you don't pass this option, and a tracking entry already exists that matches the key and certificate storage options you specified, that entry is the one that gets used. And if you don't specify it at all, you gotta say where the certificate lives — either with a combo of the -d and -n options, or with the -f option. 🫶

🌸 SPECIFYING REQUESTS BY CERTIFICATE LOCATION 🌸

• -d DIR, --dbdir=DIR — The certificate is chillin' in the NSS database in the directory you named. 💖
• -n NAME, --nickname=NAME — The certificate in the NSS database named with -d has this nickname. Only valid with -d.
• -t TOKEN, --token=TOKEN — If the NSS database has more than one token available, the certificate is stored in this token. Ngl you will rarely ever need to specify this. Only valid with -d.
• -f FILE, --certfile=FILE — The certificate is stored in the file you named. 🍓

🔥 KEY GENERATION OPTIONS 🔥

• -G TYPE, --key-type=TYPE — In case a new key pair needs to be generated, this says what type of keys to make. If you don't specify it, the current key type gets used. 👑
• -g BITS, --key-size=BITS — This one sets the size of the new key being generated. If you don't specify it, you get a key the same size as the existing one. 🦋

💜 ENROLLMENT OPTIONS 💜

• -c NAME, --ca=NAME — Submit the new signing request to the CA you name, instead of the one that was previously associated with this certificate. The CA name should match one that getcert list-cas shows you. ✨
• -T NAME, --profile=NAME — Ask for a certificate using the named profile, template, or certtype, from the CA you specified.
• --ms-template-spec SPEC — Include a V2 Certificate Template extension in the signing request. This datum has an Object Identifier, a major version number (positive integer), and an optional minor version number. The format is: <oid>:<majorVersion>[:<minorVersion>]. 💀
• -X NAME, --issuer=NAME — Ask for a certificate using the named issuer from the CA you specified.
• -I NAME, --new-id=NAME — Give this task the nickname you named, replacing the previous nickname. Iconic little rename moment. 🎀

🌈 SIGNING REQUEST OPTIONS 🌈

• -N NAME, --subject-name=NAME — Change the subject name that goes into the signing request.
• -u keyUsage, --key-usage=keyUsage — Add an extensionRequest for the keyUsage you specified to the signing request. The keyUsage value is expected to be one of these names:
  • digitalSignature
  • nonRepudiation
  • keyEncipherment
  • dataEncipherment
  • keyAgreement
  • keyCertSign
  • cRLSign
  • encipherOnly
  • decipherOnly
• -U EKU, --extended-key-usage=EKU — Change the extendedKeyUsage value specified in an extendedKeyUsage extension part of the extensionRequest attribute in the signing request. The EKU value is expected to be an object identifier (OID). 🧚
• -K NAME, --ca=NAME — Change the Kerberos principal name specified as part of a subjectAltName extension part of the extensionRequest attribute in the signing request.
• -E EMAIL, --email=EMAIL — Change the email address specified as part of a subjectAltName extension part of the extensionRequest attribute in the signing request.
• -D DNSNAME, --dns=DNSNAME — Change the DNS name specified as part of a subjectAltName extension part of the extensionRequest attribute in the signing request.
• -A ADDRESS, --ip-address=ADDRESS — Change the IP address specified as part of a subjectAltName extension part of the extensionRequest attribute in the signing request.
• -l FILE, --challenge-password-file=NAME — Add an optional ChallengePassword value, read out of the file, to the signing request. A ChallengePassword is often required when the CA is accessed using SCEP. 💅
• -L PIN, --challenge-password=PIN — Add the argument value to the signing request as a ChallengePassword attribute. A ChallengePassword is often required when the CA is accessed using SCEP. 💅

⭐ OTHER OPTIONS ⭐

• -B COMMAND, --before-command=COMMAND — Whenever the certificate or the CA's certificates are saved to the specified locations, run this command as the client user before saving the certificates.
• -C COMMAND, --after-command=COMMAND — Whenever the certificate or the CA's certificates are saved to the specified locations, run this command as the client user after saving the certificates.
• -a DIR, --ca-dbdir=DIR — Whenever the certificate is saved to the specified location, if root certificates for the CA are available, save them to the specified NSS database.
• -F FILE, --ca-file=FILE — Whenever the certificate is saved to the specified location, if root certificates for the CA are available, and when the local copies of the CA's root certificates get updated, save them to the file you named.
• --for-ca — Ask for a CA certificate.
• --not-for-ca — Ask for a non-CA certificate (this is the default, bestie).
• --ca-path-length=LENGTH — Path length for CA certificate. Only valid with --for-ca.
• -w, --wait — Wait for the new certificate to be issued and saved, or for the attempt to obtain one using the new key to fail. 🙈
• --wait-timeout=TIMEOUT — Maximum time to wait for the certificate to be issued.
• -v --verbose — Be verbose about errors. Normally the details of an error received from the daemon get suppressed if the client can make a diagnostic suggestion.

💀 BUGS 💀

Found one? Please file tickets at https://fedorahosted.org/certmonger/ — the maintainers will love you for it fr fr. 🫶

👑 SEE ALSO 👑

certmonger(8) getcert(1) getcert-add-ca(1) getcert-add-scep-ca(1) getcert-list-cas(1) getcert-list(1) getcert-modify-ca(1) getcert-refresh-ca(1) getcert-refresh(1) getcert-remove-ca(1) getcert-request(1) getcert-start-tracking(1) getcert-status(1) getcert-stop-tracking(1) certmonger-certmaster-submit(8) certmonger-dogtag-ipa-renew-agent-submit(8) certmonger-dogtag-submit(8) certmonger-ipa-submit(8) certmonger-local-submit(8) certmonger-scep-submit(8) certmonger_selinux(8)

That's the whole page, bestie — this one's from the certmonger Manual, dated July 31, 2015, and it's filed under CERTMONGER(1). Go rekey something. Slay. 💖✨