CERTMONGER(8)

💖 certmonger(8) — System Manager's Manual 💖

okay bestie, gather round, because this is the certmonger page from the System Manager's Manual and she is lowkey the main character of your whole certificate situation. ✨

---

🌸 NAME 🌸

certmonger — the daemon herself. no cap.

---

🎀 SYNOPSIS 🎀

certmonger [-s|-S] [-L|-l] [-P PATH] [-b TIMEOUT|-B] [-n|-f] [-d LEVEL]
[-p FILE] [-F] [-c command] [-v]

---

🦋 DESCRIPTION 🦋

so basically the certmonger daemon keeps an eye on your certificates for impending expiration — like, it always knows when things are about to go bad 👀 — and if you want it to, it can optionally refresh those soon-to-be-expired certificates with the help of a CA.

and if you tell it to, it can drive the entire enrollment process from key generation all the way through enrollment and refresh. the whole glow-up pipeline, start to finish. periodt. 💅

the daemon provides a control interface via the org.fedorahosted.certmonger service, and that's the interface client tools like getcert(1) use to talk to it. iykyk. 🫶

---

✨ OPTIONS ✨

• -s, --session — listen on the session bus instead of the system bus.
• -S, --system — listen on the system bus instead of the session bus. this is the default, so if you don't say anything she's already on it. 💅
• -l, --listening-socket — also listen on a private socket for connections from clients running under the same UID. both. at once. she contains multitudes.
• -L, --only-listening-socket — listen only on a private socket for connections from clients running under the same UID, and skip connecting to a bus entirely. no bus, no problem. 🚫🚌
• -P PATH, --listening-socket-path=PATH — pick a location for the private listening socket. if the location begins with a '/' character, it gets prefixed with 'unix:path=', otherwise it gets prefixed with 'unix:'. if you never specify this option, then the listening socket — if one even gets created — will be placed in the abstract namespace. mysterious. ethereal. abstract. 🧚
• -b TIMEOUT, --bus-activation-timeout=TIMEOUT — behave as a bus-activated service: if there are no certificates to be monitored or obtained, and no requests come in within TIMEOUT seconds, she exits. she's not gonna wait around forever bestie. ⏰

⚠️ not compatible with the -c option. pick a lane.

• -B, --no-bus-activation-timeout — don't behave as a bus-activated service. this is the default, so the "she might just leave" energy is off unless you turn it on.
• -n, --nofork — don't fork, and log messages to stderr rather than syslog. she stays right here with you. 🥺
• -f, --fork — do fork, and log messages to syslog rather than stderr. this is the default.
• -d LEVEL, --debug-level=LEVEL — set the debugging level. higher values produce more debugging output. also implies -n, so enjoy the stderr show. 🔥
• -p FILE, pidfile=FILE — store the daemon's process ID in the named file. yes, exactly like the synopsis spells it: pidfile=FILE. copy it as-is, don't get creative. 💀
• -F, --fips — force NSS to be initialized in FIPS mode. the default behavior is to heed the setting stored in /proc/sys/crypto/fips_enabled. so by default she just reads the room. 🧐
• -c COMMAND, --command=COMMAND — after the service has initialized, run the specified command, then shut down the service after the command exits. if the -l or -L option was also specified, the command will be run with the CERTMONGER_PVT_ADDRESS environment variable set to the listening socket's location. very "one last errand then i'm out" of her. 🏃‍♀️

⚠️ not compatible with the -b option. do not do both, bestie, it's not that kind of page.

• -v, --version — print version information and exit. the "who even am i" option. 💅

---

📂 FILES 📂

the set of certificates being monitored or signed is tracked using files stored under /var/lib/certmonger/requests, or in a directory named by the CERTMONGER_REQUESTS_DIR environment variable.

the set of known CAs is tracked using files stored under /var/lib/certmonger/cas, or in a directory named by the CERTMONGER_CAS_DIR environment variable.

temporary files will be stored in "/run/certmonger", or in the directory named by the CERTMONGER_TMPDIR environment variable if that value was not given at compile time. 🗂️✨

---

💀 BUGS 💀

please file tickets for any that you find at https://fedorahosted.org/certmonger/ — she wants to know, fr fr. 🫶

---

👑 SEE ALSO 👑

• getcert(1)
• getcert-add-ca(1)
• getcert-add-scep-ca(1)
• getcert-list-cas(1)
• getcert-list(1)
• getcert-modify-ca(1)
• getcert-refresh-ca(1)
• getcert-refresh(1)
• getcert-rekey(1)
• getcert-remove-ca(1)
• getcert-request(1)
• getcert-resubmit(1)
• getcert-start-tracking(1)
• getcert-status(1)
• getcert-stop-tracking(1)
• certmonger-certmaster-submit(8)
• certmonger-dogtag-ipa-renew-agent-submit(8)
• certmonger-dogtag-submit(8)
• certmonger-ipa-submit(8)
• certmonger-local-submit(8)
• certmonger-scep-submit(8)
• certmonger_selinux(8)

---

and that's the whole page, bestie 🎀 this one is from the certmonger Manual, dated June 14, 2015. yeah she's an elder but she's still serving. go read her friends above, and remember: your certificates are expiring and she is the only one who cares. slay. 💖✨🦋