pki-cert(1)

✨ NAME ✨

Okay bestie, welcome to pki-cert(1) — the PKI Certificate Management Commands manual page. The star of the show is pki-ca-cert, aka the command-line interface for managing certificates on PKI CA. 💅

🔥 SYNOPSIS 🔥

pki [CLI-options] ca-cert
pki [CLI-options] ca-cert-find [command-options]
pki [CLI-options] ca-cert-show cert-ID [command-options]
pki [CLI-options] ca-cert-revoke cert-ID [command-options]
pki [CLI-options] ca-cert-hold cert-ID [command-options]
pki [CLI-options] ca-cert-release-hold cert-ID [command-options]
pki [CLI-options] ca-cert-request-profile-find [command-options]
pki [CLI-options] ca-cert-request-profile-show profile-ID
[command-options]
pki [CLI-options] ca-cert-request-submit [command-options]
pki [CLI-options] ca-cert-request-review request-ID [command-options]

🌸 DESCRIPTION 🌸

The pki-cert commands are literally your command-line interfaces for managing certificates on the CA. No cap.

Here’s the whole cast, bestie:

• pki [CLI-options] ca-cert — lists the available certificate commands. It’s giving menu energy.
• pki [CLI-options] ca-cert-find [command-options] — lists certificates in the CA.
• pki [CLI-options] ca-cert-show cert-ID [command-options] — views a certificate’s details.
• pki [CLI-options] ca-cert-revoke cert-ID — revokes a certificate.
• pki [CLI-options] ca-cert-hold cert-ID — places a certificate on hold temporarily.
• pki [CLI-options] ca-cert-release-hold cert-ID — releases a certificate that has been placed on hold.
• pki [CLI-options] ca-cert-request-profile-find [command-options] — lists the available certificate request templates.
• pki [CLI-options] ca-cert-request-profile-show profile-ID [command-options] — views a certificate request template.
• pki [CLI-options] ca-cert-request-submit [command-options] — submits a certificate request.
• pki [CLI-options] ca-cert-request-review request-ID [command-options] — reviews a certificate request.

💅 OPTIONS 💅

The command-options are described in pki(1). That’s the whole options section, bestie — short and iconic. 🎀

🎀 OPERATIONS 🎀

To view the available certificate commands, type pki ca-cert. To view each command’s usage, type pki ca-cert-lt;commandgt; --help.

---

👀 Viewing Certificates 👀

Certificates can be viewed anonymously. Love that for us.

To list all certificates in the CA:

$ pki ca-cert-find

It is also possible to search for and list specific certificates by adding a search filter. Use pki ca-cert-find --help to see options. For example, to search based on issuance date:

$ pki ca-cert-find --issuedOnFrom 2012-06-15

To list certificates with search constraints defined in a file:

$ pki ca-cert-find --input <filename>

where the file is in the following format:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<CertSearchRequest>

    <serialNumberRangeInUse>true</serialNumberRangeInUse>
    <serialFrom></serialFrom>
    <serialTo></serialTo>

    <subjectInUse>false</subjectInUse>
    <eMail></eMail>
    <commonName></commonName>
    <userID></userID>
    <orgUnit></orgUnit>
    <org></org>
    <locality></locality>
    <state></state>
    <country></country>

    <matchExactly>false</matchExactly>

    <status></status>

    <revokedByInUse>false</revokedByInUse>
    <revokedBy></revokedBy>

    <revokedOnFrom>false</revokedOnFrom>
    <revokedOnTo></revokedOnTo>

    <revocationReasonInUse>false</revocationReasonInUse>
    <revocationReason></revocationReason>

    <issuedByInUse>false</issuedByInUse>
    <issuedBy></issuedBy>

    <issuedOnInUse>false</issuedOnInUse>
    <issuedOnFrom></issuedOnFrom>
    <issuedOnTo></issuedOnTo>

    <validNotBeforeInUse>false</validNotBeforeInUse>
    <validNotBeforeFrom></validNotBeforeFrom>
    <validNotBeforeTo></validNotBeforeTo>

    <validNotAfterInUse>false</validNotAfterInUse>
    <validNotAfterFrom></validNotAfterFrom>
    <validNotAfterTo></validNotAfterTo>

    <validityLengthInUse>false</validityLengthInUse>
    <validityOperation></validityOperation>
    <validityCount></validityCount>
    <validityUnit></validityUnit>

    <certTypeInUse>false</certTypeInUse>
    <certTypeSubEmailCA></certTypeSubEmailCA>
    <certTypeSubSSLCA></certTypeSubSSLCA>
    <certTypeSecureEmail></certTypeSecureEmail>

</CertSearchRequest>

To view a particular certificate:

$ pki ca-cert-show <certificate ID>

---

🚫 Revoking Certificates 🚫

Revoking, holding, or releasing a certificate must be executed as an agent user. Important bestie behavior. 💀

To revoke a certificate:

$ pki <agent authentication> ca-cert-revoke <certificate ID>

To place a certificate on hold temporarily:

$ pki <agent authentication> ca-cert-hold <certificate ID>

To release a certificate that has been placed on hold:

$ pki <agent authentication> ca-cert-release-hold <certificate ID>

---

🧚 Certificate Requests 🧚

To request a certificate, first generate a certificate signing request (CSR), then submit it with a certificate profile. The list of available profiles can be viewed using the following command:

$ pki ca-cert-request-profile-find

To generate a CSR, use the certutil, PKCS10Client, or CRMFPopClient, and store it into a file.

Basic requests can be submitted using the following command:

$ pki ca-cert-request-submit \
    --profile <profile ID> --request-type <type> --csr-file <CSR file> --subject <subject DN>

To submit more advanced requests, download a template of the request file for a particular profile using the following command:

$ pki ca-cert-request-profile-show <profile ID> --output <request file>

Then, edit the request file, fill in the input attributes required by the profile, and submit the request using the following command:

$ pki ca-cert-request-submit <request file>

Depending on the profile, the command may require authentication (see the profile configuration file). The CLI currently supports client certificate authentication and directory-based authentication.

For a certificate renewal request, run this command:

$ pki ca-cert-request-submit --profile <Renewal Profile> --serial <Certificate ID> --renewal

Also depending on the profile, an agent may need to review and approve the request by running the following command:

$ pki <agent authentication> ca-cert-request-review <request ID> \
    --file <file to store the certificate request>

⚠️ The --file and --action options are mutually exclusive (i.e. only one or the other may be specified during command invocation). Do not try to make them both happen, bestie.

If the --file option is specified, the certificate request, as well as the defaults and constraints of the enrollment profile, will be retrieved and stored in the output file provided by the --file option. The agent can examine the file and override any values if necessary. To process the request, enter the appropriate action when prompted:

Action (approve/reject/cancel/update/validate/assign/unassign):

The request in the file will be read in, and the specified action will be applied against it.

Alternatively, when no changes to the request are necessary, the agent can process the request in a single step using the --action option with the following command:

$ pki <agent authentication> ca-cert-request-review <request ID> --action <action>

🫶 AUTHORS 🫶

Shoutout to Ade Lee (lt;alee@redhat.comgt;), Endi S. Dewata (lt;edewata@redhat.comgt;), and Matthew Harmsen (lt;mharmsen@redhat.comgt;). Absolute icons. 👑

📜 COPYRIGHT 📜

Copyright (c) 2014 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.

---

That’s the whole vibe, bestie: pki-cert(1) from PKI, dated May 5, 2014. Periodt. 💖✨