Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help 
CERTMONGER(1)		     General Commands Manual		   CERTMONGER(1)

NAME
     getcert

SYNOPSIS
     getcert start-tracking [options]

DESCRIPTION
     Tells  certmonger	to  monitor  an already-issued certificate.  Optionally,
     when the certificate nears expiration, use an existing key pair (or to gen-
     erate one if one is not already found in the specified location), to gener-
     ate a signing request using the key pair and to submit them for signing  to
     a CA.

SPECIFYING EXISTING REQUESTS
     -i NAME, --id=NAME
	    Modify  the  request which has this nickname.  If this option is not
	    specified, and a tracking entry which matches the key  and	certifi-
	    cate  storage options which are specified already exists, that entry
	    will be modified.  Otherwise, a new tracking entry will be added.

KEY AND CERTIFICATE STORAGE OPTIONS
     -d DIR, --dbdir=DIR
	    Use an NSS database in the specified directory for reading this cer-
	    tificate and, if possible, the corresponding key.

     -n NAME, --nickname=NAME
	    Use the certificate with this nickname, and if a  private  key  with
	    the  same nickname or which corresponds to the certificate is avail-
	    able, to use it, too.  Only valid with -d.

     -t TOKEN, --token=TOKEN
	    If the NSS database has more than one token available, use the token
	    with this name for accessing the certificate and key.  This argument
	    only rarely needs to be specified.	Only valid with -d.

     -f FILE, --certfile=FILE
	    Read the certificate from this file.  For safety's sake, do not  use
	    the same file specified with the -k option.

     -k FILE, --keyfile=FILE
	    Use  the  key  stored in this file to generate a signing request for
	    refreshing the certificate.  If no such file is found  when  needed,
	    generate a new key pair and store them in the file.  Only valid with
	    -f.

KEY ENCRYPTION OPTIONS
     -p FILE, --pinfile=FILE
	    The  private  key  files  or  databases  are encrypted using the PIN
	    stored in the named file as the passphrase.

     -P PIN, --pin=PIN
	    The private key files or databases are encrypted using the specified
	    PIN as the passphrase.  Because command-line  arguments  to  running
	    processes are trivially discoverable, use of this option is not rec-
	    ommended except for testing.

TRACKING OPTIONS
     -I NAME, --new-id=NAME
	    Assign  the  specified nickname to this task.  If this option is not
	    specified, a name will be assigned automatically.

     -r, --renew
	    Attempt to obtain a new certificate from the CA when the  expiration
	    date of a certificate nears.  This is the default setting.

     -R, --no-renew
	    Don't attempt to obtain a new certificate from the CA when the expi-
	    ration date of a certificate nears.  If this option is specified, an
	    expired certificate will simply stay expired.

ENROLLMENT OPTIONS
     -c  NAME, --ca=NAME
	    Enroll  with  the  specified CA rather than a possible default.  The
	    name of the CA should correspond to one listed by getcert  list-cas.
	    Only useful in combination with -r.

     -T NAME, --profile=NAME
	    Request  a	certificate  using the named profile, template, or cert-
	    type, from the specified CA.

     --ms-template-spec SPEC
	    Include a V2 Certificate Template extension in the signing	request.
	    This  datum  includes  an  Object Identifier, a major version number
	    (positive integer) and an optional minor version number.  The format
	    is: <oid>:<majorVersion>[:<minorVersion>].

     -X NAME, --issuer=NAME
	    Request a certificate using the named issuer from the specified CA.

SIGNING REQUEST OPTIONS
     If and when certmonger attempts to obtain a new certificate to replace  the
     one  being monitored, the values to be added to the signing request will be
     taken from the current certificate, unless preferred values are  set  using
     one or more of -uU, -K, -E, and -D.

     -u keyUsage, --key-usage=keyUsage
	    Add  an  extensionRequest  for the specified keyUsage to the signing
	    request.  The keyUsage value is expected to be one of these names:

	    digitalSignature

	    nonRepudiation

	    keyEncipherment

	    dataEncipherment

	    keyAgreement

	    keyCertSign

	    cRLSign

	    encipherOnly

	    decipherOnly

     -U EKU, --extended-key-usage=EKU
	    Add an extensionRequest for the specified  extendedKeyUsage  to  the
	    signing  request.  The EKU value is expected to be an object identi-
	    fier (OID).

     -K NAME, --principal=NAME
	    Add an extensionRequest for a  subjectAltName,  with  the  specified
	    Kerberos principal name as its value, to the signing request.

     -E EMAIL, --email=EMAIL
	    Add  an  extensionRequest  for  a subjectAltName, with the specified
	    email address as its value, to the signing request.

     -D DNSNAME, --dns=DNSNAME
	    Add an extensionRequest for a subjectAltName, with the specified DNS
	    name as its value, to the signing request.

     -A ADDRESS, --ip-address=ADDRESS
	    Add an extensionRequest for a subjectAltName, with the specified  IP
	    address as its value, to the signing request.

     -l FILE, --challenge-password-file=FILE
	    Add  an optional ChallengePassword value, read from the file, to the
	    signing request.  A ChallengePassword is often required when the  CA
	    is accessed using SCEP.

     -L PASSWORD, --challenge-password=PASSWORD
	    Add the argument value to the signing request as a ChallengePassword
	    attribute.	A ChallengePassword is often required when the CA is ac-
	    cessed using SCEP.

OTHER OPTIONS
     -B COMMAND, --before-command=COMMAND
	    When  ever the certificate or the CA's certificates are saved to the
	    specified locations, run the specified command as  the  client  user
	    before saving the certificates.

     -C COMMAND, --after-command=COMMAND
	    When  ever the certificate or the CA's certificates are saved to the
	    specified locations, run the specified command as  the  client  user
	    after saving the certificates.

     -a DIR, --ca-dbdir=DIR
	    When  ever	the  certificate  is saved to the specified location, if
	    root certificates for the CA are available, save them to the  speci-
	    fied NSS database.

     -F FILE, --ca-file=FILE
	    When  ever	the  certificate  is saved to the specified location, if
	    root certificates for the CA  are  available,  and	when  the  local
	    copies  of	the CA's root certificates are updated, save them to the
	    specified file.

     -w, --wait
	    Wait for the certificate to become	valid  or  to  be  reissued  and
	    saved, or for the attempt to obtain a new one to fail.

     --wait-timeout=TIMEOUT
	    Maximum time to wait for the certificate to be issued.

     -v, --verbose
	    Be verbose about errors.  Normally, the details of an error received
	    from the daemon will be suppressed if the client can make a diagnos-
	    tic suggestion.

     -o OWNER, --key-owner=OWNER
	    After  generation  set the owner on the private key file or database
	    to OWNER.

     -m MODE, --key-perms=MODE
	    After generation set the file permissions on the private key file or
	    database to MODE.

     -O OWNER, --cert-owner=OWNER
	    After generation set the owner on the certificate file  or	database
	    to OWNER.

     -M MODE, --cert-perms=MODE
	    After generation set the file permissions on the certificate file or
	    database to MODE.

BUS OPTIONS
     -s, --session
	    Connect to certmonger on the session bus rather than the system bus.

     -S, --system
	    Connect to certmonger on the system bus rather than the session bus.
	    This is the default.

NOTES
     Locations	specified  for key and certificate storage need to be accessible
     to the certmonger daemon process.	When run as a system daemon on a  system
     which uses a mandatory access control mechanism such as SELinux, the system
     policy must ensure that the daemon is allowed to access the locations where
     certificates  and	keys that it will manage will be stored (these locations
     are typically labeled as cert_t or an equivalent).   More	SELinux-specific
     information  can  be  found  in the selinux.txt documentation file for this
     package.

BUGS
     Please file tickets for any that you find at https://fedorahosted.org/cert-
     monger/

SEE ALSO
     certmonger(8)    getcert(1)    getcert-add-ca(1)	  getcert-add-scep-ca(1)
     getcert-list-cas(1)    getcert-list(1)   getcert-modify-ca(1)   getcert-re-
     fresh-ca(1)   getcert-refresh(1)	getcert-rekey(1)    getcert-remove-ca(1)
     getcert-request(1) 	  getcert-resubmit(1)	       getcert-status(1)
     getcert-stop-tracking(1)  certmonger-certmaster-submit(8)	 certmonger-dog-
     tag-ipa-renew-agent-submit(8)	certmonger-dogtag-submit(8)	certmon-
     ger-ipa-submit(8)	 certmonger-local-submit(8)    certmonger-scep-submit(8)
     certmonger_selinux(8)

certmonger Manual		February 9, 2015		   CERTMONGER(1)

Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=getcert-start-tracking&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>

home | help