cimtrust(8)

✨ NAME ✨

cimtrust — add, remove or list X509 certificates in a PEM format trust store. 💅

okay so real quick, this is a System Manager's Manual page, section 8, and it's your girl cimtrust the whole way through. let's go 🦋

---

🌸 SYNOPSIS 🌸

cimtrust -a [ -U certuser ] -f file -T ( a | e | s )

cimtrust -r -i issuer ( -n serialnumber | -S subject )

cimtrust -l [ -i issuer [ -n serialnumber | -S subject ] ]

cimtrust --help

cimtrust --version

📌 Remarks

Heads up bestie: the cimtrust command requires that the cimserver is running. Also — this command operates on a truststore on the local system only. no remote shenanigans, periodt.

---

💖 DESCRIPTION 💖

So the add option of the cimtrust command adds an X509 certificate file of a specified type to the truststore. The certuser specifies the username to be associated with the certificate in the file. And if no certuser is specified? Then the certificate may not be used to authenticate a user. that's the whole deal, no cap.

The remove option of the cimtrust command removes the X509 certificate(s) matching the specified issuer and either serialnumber or subject from the truststore. bye felicia 👋

The list option of the cimtrust command lists the X509 certificates in the truststore. You can filter the list by issuer and either serialnumber or subject, if you're feeling picky. 🎀

Certificates in the trust store may be revoked by adding a Certificate Revocation List to the CRL store. For more info on CRL operations, go see the cimcrl(8) command. iykyk ✨

🎀 Options 🎀

cimtrust recognizes the following options:

• -a — Adds a certificate to the truststore. If the specified file does not contain a valid X509 certificate, an error message is returned and no action is taken. And if the X509 certificate already exists in the truststore, an error message is returned too. sorry babe 💀
• -r — Removes certificate(s) from the truststore. If the truststore contains multiple certificates matching the specified issuer and subject, all the matching certificates are removed. If no certificate exists for the specified issuer and either serialnumber or subject, an error message is returned and no action is taken.
• -l — Displays the X509 certificates in the truststore. the moment of truth ✨
• -f file — Specifies a PEM format file containing an X509 certificate.
• -U certuser — Specifies a username to be associated with the specified certificate. The username you specify should be a valid system user on the target system.
• -i issuer — Specifies the issuer name of the certificate.
• -n serialnumber — Specifies the serial number of the certificate.
• -S subject — Specifies the subject name of the certificate.
• -T ( a | e | s ) — Specifies the type of a certificate. The type must be one of the following:
  • authority (a): root/intermediate authority certificates. Certificates of this type are added to the trusted certificate store. The certuser is optional for authority certificates. If no certuser is specified, the certificate may not be used to authenticate a user.
  • authority issued end-entity (e): Certificates of this type are not added to the trusted certificate store. The certuser is required for authority issued end-entity certificates.
  • Self-signed identity certificate (s): Certificates of this type are added to the trusted certificate store. The certuser is required for self-signed identity certificates.
• --help — Displays the command help message. ask and you shall receive 🫶
• --version — Displays the CIM Server version.

---

🌈 EXIT STATUS 🌈

When an error occurs, an error message is written to the standard error stream and a non-zero exit status value is returned. The following exit status values are defined:

• 0 — Success 🎉
• 1 — General error
• 2 — Connection failed
• 3 — Connection timed out
• 4 — Certificate already exists
• 5 — Certificate does not exist
• 6 — Invalid system user

---

🧚 EXAMPLES 🧚

Add the X509 self-signed identity certificate in the cert.pem file and associate it to certuser guest. This certificate will be added to the trusted certificate store:

cimtrust -a -U guest -f cert.pem -T s

Add the X509 authority root CA certificate in the ca.pem file with no certuser association. This certificate will be added to the trusted certificate store but may not be used to authenticate a user:

cimtrust -a -f ca.pem -T a

Add the X509 authority issued end-entity certificate in the user.pem file and associate it to certuser pegasus. This certificate may be used to authenticate user pegasus but will not be added to the trusted certificate store:

cimtrust -a -f user.pem -U pegasus -T e

Remove the certificate matching the specified issuer and serialnumber from the trust store:

cimtrust -r -i "/C=US/ST=California/L=Cupertino/O=Smart &
Secure/OU=Secure Software Division/CN=dev.admin.ss.com" -n 01

Remove the certificate(s) matching the specified issuer and subject from the trust store:

cimtrust -r -i "/C=US/ST=California/L=Cupertino/O=Smart &
Secure/OU=Secure Software Division/CN=dev.admin.ss.com" -S
"/C=US/ST=California/L=Cupertino/O=Smart & Secure/OU=Secure Software
Division/CN=dev.admin.ss.com"

List all the X509 certificates in the trust store:

cimtrust -l

---

👑 SEE ALSO 👑

cimserver(8), cimcrl(8), cimconfig(8).

---

and that's the whole page bestie!! 💖 this was the cimtrust(8) page from the System Manager's Manual, filed under cimtrust(8) at the bottom just like always. slay, go forth, and manage those certificates responsibly 🎀✨🦋💅