CERTMONGER(1)

💖 CERTMONGER(1) 💖

okay so bestie, welcome to the certmonger manual page, the General Commands Manual era, and we're talking about the one and only getcert 💅 this is the glow-up guide, no cap.

---

✨ NAME ✨

getcert — yeah that's the main character right there 👑

---

🌸 SYNOPSIS 🌸

getcert start-tracking [options]

---

🦋 DESCRIPTION 🦋

So basically, start-tracking tells certmonger to monitor a certificate that's already been issued — like, it's already out there living its life, and we're just gonna keep an eye on it 👀.

And optionally? When that cert gets close to its expiration date, certmonger can use an existing key pair (or generate a whole new one if it can't find one in the location you specified 🫶), build a signing request with that key pair, and submit the whole thing to a CA for signing. Periodt.

---

💜 SPECIFYING EXISTING REQUESTS 💜

• -i NAME, --id=NAME — bestie, this one lets you modify the request that already has this nickname ✨. And if you don't specify it, but there's already a tracking entry that matches the key and cert storage options you gave? That entry gets modified instead. Otherwise? Brand new tracking entry, we're adding it to the roster 💅.

---

🎀 KEY AND CERTIFICATE STORAGE OPTIONS 🎀

• -d DIR, --dbdir=DIR — use an NSS database in this directory to read the certificate, and if it's possible, the matching key too 🔑.
• -n NAME, --nickname=NAME — grab the certificate with this nickname, and if there's a private key with the same nickname (or one that corresponds to the cert), use that too 🫶. Heads up: only valid with -d.
• -t TOKEN, --token=TOKEN — if the NSS database has more than one token available, use the one with this name to access the cert and key. Ngl, this argument only rarely needs to be specified. Only valid with -d.
• -f FILE, --certfile=FILE — read the certificate from this file 📄. And for safety's sake, do not use the same file you specified with the -k option, okay? Don't do it.
• -k FILE, --keyfile=FILE — use the key stored in this file to generate a signing request for refreshing the cert 🔄. If no such file is found when it's needed, certmonger generates a new key pair and stores them in the file. Only valid with -f.

---

🔐 KEY ENCRYPTION OPTIONS 🔐

• -p FILE, --pinfile=FILE — the private key files or databases are encrypted using the PIN stored in this named file as the passphrase 🔒.
• -P PIN, --pin=PIN — the private key files or databases are encrypted using this specified PIN as the passphrase. But listen: because command-line arguments to running processes are trivially discoverable 💀, using this option is not recommended except for testing. Like, fr fr, don't.

---

⭐ TRACKING OPTIONS ⭐

• -I NAME, --new-id=NAME — assign this nickname to the task 🏷️. If you don't specify it, a name gets assigned automatically, no worries.
• -r, --renew — attempt to get a new certificate from the CA when the expiration date of a cert gets near ⏰. This is the default setting, bestie.
• -R, --no-renew — do not attempt to get a new cert from the CA when expiration nears. If you specify this, an expired certificate will simply stay expired 😭.

---

💫 ENROLLMENT OPTIONS 💫

• -c NAME, --ca=NAME — enroll with the specified CA instead of a possible default. The name of the CA should correspond to one listed by getcert list-cas 📋. Only useful in combination with -r.
• -T NAME, --profile=NAME — request a certificate using the named profile, template, or certtype, from the specified CA 🎯.
• --ms-template-spec SPEC — include a V2 Certificate Template extension in the signing request. This datum includes an Object Identifier, a major version number (positive integer), and an optional minor version number. The format is: <oid>:<majorVersion>[:<minorVersion>] 📝.
• -X NAME, --issuer=NAME — request a certificate using the named issuer from the specified CA 👑.

---

🌈 SIGNING REQUEST OPTIONS 🌈

If and when certmonger attempts to obtain a new certificate to replace the one being monitored, the values added to the signing request get taken from the current certificate — unless preferred values are set using one or more of -uU, -K, -E, and -D. iykyk.

• -u keyUsage, --key-usage=keyUsage — add an extensionRequest for the specified keyUsage to the signing request. The keyUsage value is expected to be one of these names:
  • digitalSignature
  • nonRepudiation
  • keyEncipherment
  • dataEncipherment
  • keyAgreement
  • keyCertSign
  • cRLSign
  • encipherOnly
  • decipherOnly
• -U EKU, --extended-key-usage=EKU — add an extensionRequest for the specified extendedKeyUsage to the signing request. The EKU value is expected to be an object identifier (OID) 🔍.
• -K NAME, --principal=NAME — add an extensionRequest for a subjectAltName, with the specified Kerberos principal name as its value, to the signing request 🎭.
• -E EMAIL, --email=EMAIL — add an extensionRequest for a subjectAltName, with the specified email address as its value, to the signing request 📧.
• -D DNSNAME, --dns=DNSNAME — add an extensionRequest for a subjectAltName, with the specified DNS name as its value, to the signing request 🌐.
• -A ADDRESS, --ip-address=ADDRESS — add an extensionRequest for a subjectAltName, with the specified IP address as its value, to the signing request 📍.
• -l FILE, --challenge-password-file=FILE — add an optional ChallengePassword value, read from the file, to the signing request. A ChallengePassword is often required when the CA is accessed using SCEP 🔑.
• -L PASSWORD, --challenge-password=PASSWORD — add the argument value to the signing request as a ChallengePassword attribute. A ChallengePassword is often required when the CA is accessed using SCEP 🔑.

---

🫶 OTHER OPTIONS 🫶

• -B COMMAND, --before-command=COMMAND — whenever the certificate or the CA's certificates are saved to the specified locations, run this command as the client user before saving the certificates 🏃‍♀️.
• -C COMMAND, --after-command=COMMAND — whenever the certificate or the CA's certificates are saved to the specified locations, run this command as the client user after saving the certificates 🏁.
• -a DIR, --ca-dbdir=DIR — whenever the certificate is saved to the specified location, if root certificates for the CA are available, save them to the specified NSS database 🗄️.
• -F FILE, --ca-file=FILE — whenever the certificate is saved to the specified location, if root certificates for the CA are available, and when the local copies of the CA's root certificates are updated, save them to the specified file 📁.
• -w, --wait — wait for the certificate to become valid or to be reissued and saved, or for the attempt to obtain a new one to fail ⏳.
• --wait-timeout=TIMEOUT — maximum time to wait for the certificate to be issued ⌛.
• -v, --verbose — be verbose about errors 🗣️. Normally, the details of an error received from the daemon get suppressed if the client can make a diagnostic suggestion.
• -o OWNER, --key-owner=OWNER — after generation, set the owner on the private key file or database to OWNER 👤.
• -m MODE, --key-perms=MODE — after generation, set the file permissions on the private key file or database to MODE 🔧.
• -O OWNER, --cert-owner=OWNER — after generation, set the owner on the certificate file or database to OWNER 👤.
• -M MODE, --cert-perms=MODE — after generation, set the file permissions on the certificate file or database to MODE 🔧.

---

🚌 BUS OPTIONS 🚌

• -s, --session — connect to certmonger on the session bus rather than the system bus 🚏.
• -S, --system — connect to certmonger on the system bus rather than the session bus. This is the default 🚏.

---

📝 NOTES 📝

Locations specified for key and certificate storage need to be accessible to the certmonger daemon process 👀. When run as a system daemon on a system that uses a mandatory access control mechanism such as SELinux, the system policy must ensure the daemon is allowed to access the locations where certificates and keys it will manage get stored (these locations are typically labeled as cert_t or an equivalent) 🔐.

More SELinux-specific info can be found in the selinux.txt documentation file for this package 📖.

---

💀 BUGS 💀

Please file tickets for any that you find at https://fedorahosted.org/certmonger/ 🎫 — not me being dramatic, just file them okay?

---

👑 SEE ALSO 👑

certmonger(8) getcert(1) getcert-add-ca(1) getcert-add-scep-ca(1) getcert-list-cas(1) getcert-list(1) getcert-modify-ca(1) getcert-refresh-ca(1) getcert-refresh(1) getcert-rekey(1) getcert-remove-ca(1) getcert-request(1) getcert-resubmit(1) getcert-status(1) getcert-stop-tracking(1) certmonger-certmaster-submit(8) certmonger-dogtag-ipa-renew-agent-submit(8) certmonger-dogtag-submit(8) certmonger-ipa-submit(8) certmonger-local-submit(8) certmonger-scep-submit(8) certmonger_selinux(8)

---

later bestie 💅 this was the certmonger Manual crew serving you the CERTMONGER(1) page, dated February 9, 2015, and honestly? iconic behavior. mwah 🎀✨