CERTMONGER(8)

💅 NAME 💅

local-submit — bestie, this is the little helper gremlin that makes the local signer happen ✨

🎀 SYNOPSIS 🎀

local-submit [-d state-directory] [-v] [csrfile]

🦋 DESCRIPTION 🦋

okay so. local-submit is the helper that certmonger calls in to make its local signer work. it's not normally run interactively — like, it's a behind-the-scenes girlie — but you can run it by hand if you're troubleshooting. no judgment 💖

the signing request you wanna submit goes in one of two places: either in a file whose name you pass as an argument, or piped straight into local-submit via stdin. pick your fighter.

the local signer is currently hard-coded to generate and use a 2048-bit RSA key, plus a name and initial serial number based on a UUID. and then — the way that it just replaces that key and certificate at roughly the midpoint of their useful lifetime? iconic behavior, honestly.

certmonger also supports retrieving the list of current and previously-used local CA certificates. wanna know where those certificates should be stored? go read getcert-request(1) and getcert-resubmit(1), they got you 🫶

✨ OPTIONS ✨

• -d DIR, --ca-data-directory=DIR — points at the directory holding the local signer's private key, its certificates, and all the other data the local signer needs. it's giving her room, her stuff lives here 💅
• -v, --verbose — turns the volume up on the tool's diagnostic logging. more yapping, more info 🔥

💀 EXIT STATUS 💀

• 0 — if the certificate was issued 🎉 the new certificate will be printed out for you.
• 3 — if the helper needs to be called again. an error message may be printed.
• 4 — if critical configuration information is missing 😭 an error message may be printed.

🌸 FILES 🌸

• creds — is currently a PKCS#12 bundle containing the local signer's current signing key, plus current and previously-used signer certificates. > bestie do NOT touch this — it should not be modified except by the local signer itself. a new key is currently generated whenever a new signer certificate is needed.
• serial — currently contains the serial number that will be used for the next issued certificate. > same rule, no cap: it should not be modified except by the local signer.

🙈 BUGS 🙈

found one? please file tickets for any that you find at https://fedorahosted.org/certmonger/ 🫶

🌈 SEE ALSO 🌈

certmonger(8) getcert(1) getcert-add-ca(1) getcert-add-scep-ca(1) getcert-list-cas(1) getcert-list(1) getcert-modify-ca(1) getcert-refresh-ca(1) getcert-refresh(1) getcert-rekey(1) getcert-remove-ca(1) getcert-resubmit(1) getcert-start-tracking(1) getcert-status(1) getcert-stop-tracking(1) certmonger-certmaster-submit(8) certmonger-dogtag-ipa-renew-agent-submit(8) certmonger-dogtag-submit(8) certmonger-ipa-submit(8) certmonger-scep-submit(8) certmonger_selinux(8)

k that's the whole page, bestie 💜 this is the certmonger Manual, dated June 7, 2014, and it lives in section 8 of the manual. go forth and slay 🎀✨👑