CERTMONGER(8)

💅 NAME 💅

okay bestie, say hi to scep-submit — the little helper sidekick that does the SCEP thing 👑

✨ SYNOPSIS ✨

scep-submit -u SERVER-URL [-r ra-cert-file] [-R ca-cert-file] [-I
other-certs-file] [-N ca-cert-file] [-i ca-identifier] [-v] [-n]
[-c|-C|-g|-p] [pkimessage-filename]

🦋 DESCRIPTION 🦋

so like. scep-submit is the helper that certmonger uses to beam certificate enrollment and renewal requests over to servers that speak SCEP 🌈. It's not really a hang-out-and-chat interactively kind of program, but you can run it by hand if you're doing troubleshooting, and honestly, slay, do what you want.

the request you're submitting needs to be a PEM-encoded SCEP pkiMessage. You can hand it over two ways: drop it in a file and pass the filename as an argument, or just pipe it straight into scep-submit via stdin. either way, we ball 💖

🎀 MODES 🎀

pick your fighter, bestie. these are mutually exclusive vibes:

• -c, --retrieve-ca-capabilities — scep-submit fires off a GetCACaps request at the server and prints whatever comes back. it's giving "tell me what you're capable of" 💅
• -C, --retrieve-ca-certificates — scep-submit sends a GetCACert request, parses the response, and then prints, in order: the RA certificate, the CA certificate, and any extra certificates hanging around. a lil lineup, if you will ✨
• -p, --pki-message — scep-submit issues a PKIOperation request to the server, using the message you passed in as the message content. It parses the server's response, verifies the signature, and if the response includes an issued certificate, it outputs the pkcsPKIEnvelope in PEM format 🎀. If the response indicates an error, it prints the error. no cap.
• -g, --get-initial-cert — scep-submit issues a PKIOperation request to the server, using the passed-in message as the message content. It parses the server's response, verifies the signature, and if the response includes an issued certificate, it outputs the pkcsPKIEnvelope in PEM format 🌸. If the response indicates an error, it prints the error.

💖 OPTIONS 💖

• -u URL, --url=URL — where the CA's SCEP interface lives. typically this is http://SERVER/cgi-bin/PKICLIENT.EXE or http://SERVER/certsrv/mscep/mscep.dll. this one is always required, like, non-negotiable bestie 🫶
• -R FILE, --cacert=FILE — where the CA certificate that was used to issue the SCEP web server's certificate lives, in PEM form. if the URL you gave with -u is an https URL, then this option is required. periodt.
• -N FILE, --signingca=FILE — where a PEM-formatted copy of the SCEP server's CA certificate is. normally the certmonger daemon discovers and supplies this value for you, but you can hand-specify one for troubleshooting purposes 🧚
• -r FILE, --racert=FILE — where the SCEP server's RA certificate is. this is the one expected to be used for signing responses the SCEP server sends back to the client. this option is required when you're using either the -g flag or the -p flag.
• -I FILE, --other-certs=FILE — where a file full of other PEM-formatted certificates is, the ones you might need to properly verify signed responses the SCEP server sends back to you. this option may be necessary when you're using either the -g flag or the -p flag.
• -i NAME, --ca-identifier=NAME — when you call it with the -c or -C flag, this option lets you specify the CA identifier that gets passed to the server as part of the client's request. the default is "0". iconic.
• -n, --non-renewal — okay so the SCEP Renewal feature lets a client with a previously-issued certificate use that certificate plus the associated private key to request a new certificate for a different key pair, and it can support certmonger's rekeying feature if the SCEP server advertises that it supports it. this option forces the scep-submit helper to prefer issuing requests that don't use that feature. sometimes you just wanna keep it simple 💅
• -v, --verbose — cranks the logging level up. use it twice for even more logging. mainly a troubleshooting thing, but honestly, who doesn't love more information 🔥

💀 EXIT STATUS 💀

• 0 — the certificate was issued 🎉. The pkcsPKIEnvelope will be printed in PEM-encoded form.
• 1 — the CA is still thinking 🤔. A cookie (state) value will be printed.
• 2 — the CA rejected the request 😭. An error message may be printed.
• 3 — the CA was unreachable 💀. An error message may be printed.
• 4 — critical configuration information is missing 🙈. An error message may be printed.
• 5 — the CA is still thinking. A suggested poll delay (specified in seconds) and a cookie (state) value will be printed.
• 16 — the helper needs an SCEP pkiMessage, but couldn't read one. not the vibe.
• 17 — the CA indicates that the client needs to attempt enrollment using a new key pair 🔑.

🐛 BUGS 🐛

found one? pls file tickets for any that you find at https://fedorahosted.org/certmonger/ — we appreciate you 🫶

🌈 SEE ALSO 🌈

certmonger(8) getcert(1) getcert-add-ca(1) getcert-add-scep-ca(1) getcert-list-cas(1) getcert-list(1) getcert-modify-ca(1) getcert-refresh-ca(1) getcert-refresh(1) getcert-rekey(1) getcert-remove-ca(1) getcert-resubmit(1) getcert-start-tracking(1) getcert-status(1) getcert-stop-tracking(1) certmonger-certmaster-submit(8) certmonger-dogtag-ipa-renew-agent-submit(8) certmonger-dogtag-submit(8) certmonger-ipa-submit(8) certmonger-local-submit(8) certmonger_selinux(8)

and that's the whole thing bestie 💖 this lil manual page is brought to you by the certmonger Manual, dated June 20, 2015. go forth and submit those SCEPs, you absolute main character 👑✨