Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help 
CERTMONGER(1)		    General Commands Manual		 CERTMONGER(1)

NAME
       getcert

SYNOPSIS
       getcert start-tracking [options]

DESCRIPTION
       Tells certmonger	to monitor an already-issued certificate.  Optionally,
       when  the certificate nears expiration, use an existing key pair	(or to
       generate	one if one is not already found	in the specified location), to
       generate	a signing request using	the key	pair and to  submit  them  for
       signing to a CA.

SPECIFYING EXISTING REQUESTS
       -i NAME,	--id=NAME
	      Modify  the  request which has this nickname.  If	this option is
	      not specified, and a tracking entry which	matches	 the  key  and
	      certificate  storage options which are specified already exists,
	      that entry will be modified.  Otherwise, a  new  tracking	 entry
	      will be added.

KEY AND	CERTIFICATE STORAGE OPTIONS
       -d DIR, --dbdir=DIR
	      Use  an NSS database in the specified directory for reading this
	      certificate and, if possible, the	corresponding key.

       -n NAME,	--nickname=NAME
	      Use the certificate with this nickname, and  if  a  private  key
	      with  the	 same nickname or which	corresponds to the certificate
	      is available, to use it, too.  Only valid	with -d.

       -t TOKEN, --token=TOKEN
	      If the NSS database has more than	one token available,  use  the
	      token  with  this	 name  for  accessing the certificate and key.
	      This argument only rarely	needs to  be  specified.   Only	 valid
	      with -d.

       -f FILE,	--certfile=FILE
	      Read  the	certificate from this file.  For safety's sake,	do not
	      use the same file	specified with the -k option.

       -k FILE,	--keyfile=FILE
	      Use the key stored in this file to generate  a  signing  request
	      for  refreshing  the certificate.	 If no such file is found when
	      needed, generate a new key pair and  store  them	in  the	 file.
	      Only valid with -f.

KEY ENCRYPTION OPTIONS
       -p FILE,	--pinfile=FILE
	      The  private  key	files or databases are encrypted using the PIN
	      stored in	the named file as the passphrase.

       -P PIN, --pin=PIN
	      The private key files or databases are encrypted using the spec-
	      ified PIN	as the passphrase.  Because command-line arguments  to
	      running processes	are trivially discoverable, use	of this	option
	      is not recommended except	for testing.

TRACKING OPTIONS
       -I NAME,	--new-id=NAME
	      Assign  the  specified nickname to this task.  If	this option is
	      not specified, a name will be assigned automatically.

       -r, --renew
	      Attempt to obtain	a new certificate from the CA when the expira-
	      tion date	of a certificate nears.	 This is the default setting.

       -R, --no-renew
	      Don't attempt to obtain a	new certificate	from the CA  when  the
	      expiration date of a certificate nears.  If this option is spec-
	      ified, an	expired	certificate will simply	stay expired.

ENROLLMENT OPTIONS
       -c  NAME, --ca=NAME
	      Enroll  with  the	 specified  CA rather than a possible default.
	      The name of the CA should	correspond to one  listed  by  getcert
	      list-cas.	 Only useful in	combination with -r.

       -T NAME,	--profile=NAME
	      Request  a  certificate  using  the  named profile, template, or
	      certtype,	from the specified CA.

       --ms-template-spec SPEC
	      Include a	V2 Certificate Template	extension in the  signing  re-
	      quest.   This  datum includes an Object Identifier, a major ver-
	      sion number (positive integer) and  an  optional	minor  version
	      number.  The format is: <oid>:<majorVersion>[:<minorVersion>].

       -X NAME,	--issuer=NAME
	      Request  a certificate using the named issuer from the specified
	      CA.

SIGNING	REQUEST	OPTIONS
       If and when certmonger attempts to obtain a new certificate to  replace
       the  one	being monitored, the values to be added	to the signing request
       will be taken from the current certificate, unless preferred values are
       set using one or	more of	-uU, -K, -E, and -D.

       -u keyUsage, --key-usage=keyUsage
	      Add an extensionRequest for the specified	keyUsage to the	 sign-
	      ing  request.  The keyUsage value	is expected to be one of these
	      names:

	      digitalSignature

	      nonRepudiation

	      keyEncipherment

	      dataEncipherment

	      keyAgreement

	      keyCertSign

	      cRLSign

	      encipherOnly

	      decipherOnly

       -U EKU, --extended-key-usage=EKU
	      Add an extensionRequest for the  specified  extendedKeyUsage  to
	      the  signing request.  The EKU value is expected to be an	object
	      identifier (OID).

       -K NAME,	--principal=NAME
	      Add an extensionRequest for a subjectAltName, with the specified
	      Kerberos principal name as its value, to the signing request.

       -E EMAIL, --email=EMAIL
	      Add an extensionRequest for a subjectAltName, with the specified
	      email address as its value, to the signing request.

       -D DNSNAME, --dns=DNSNAME
	      Add an extensionRequest for a subjectAltName, with the specified
	      DNS name as its value, to	the signing request.

       -A ADDRESS, --ip-address=ADDRESS
	      Add an extensionRequest for a subjectAltName, with the specified
	      IP address as its	value, to the signing request.

       -l FILE,	--challenge-password-file=FILE
	      Add an optional ChallengePassword	value, read from the file,  to
	      the signing request.  A ChallengePassword	is often required when
	      the CA is	accessed using SCEP.

       -L PASSWORD, --challenge-password=PASSWORD
	      Add  the	argument  value	 to  the  signing  request  as a Chal-
	      lengePassword attribute.	A ChallengePassword is often  required
	      when the CA is accessed using SCEP.

OTHER OPTIONS
       -B COMMAND, --before-command=COMMAND
	      When  ever the certificate or the	CA's certificates are saved to
	      the specified locations, run the specified command as the	client
	      user before saving the certificates.

       -C COMMAND, --after-command=COMMAND
	      When ever	the certificate	or the CA's certificates are saved  to
	      the specified locations, run the specified command as the	client
	      user after saving	the certificates.

       -a DIR, --ca-dbdir=DIR
	      When ever	the certificate	is saved to the	specified location, if
	      root  certificates  for  the  CA are available, save them	to the
	      specified	NSS database.

       -F FILE,	--ca-file=FILE
	      When ever	the certificate	is saved to the	specified location, if
	      root certificates	for the	CA are available, and when  the	 local
	      copies  of  the CA's root	certificates are updated, save them to
	      the specified file.

       -w, --wait
	      Wait for the certificate to become valid or to be	 reissued  and
	      saved, or	for the	attempt	to obtain a new	one to fail.

       --wait-timeout=TIMEOUT
	      Maximum time to wait for the certificate to be issued.

       -v, --verbose
	      Be  verbose about	errors.	 Normally, the details of an error re-
	      ceived from the daemon will be suppressed	if the client can make
	      a	diagnostic suggestion.

       -o OWNER, --key-owner=OWNER
	      After generation set the owner on	the private key	file or	 data-
	      base to OWNER.

       -m MODE,	--key-perms=MODE
	      After  generation	 set  the  file	permissions on the private key
	      file or database to MODE.

       -O OWNER, --cert-owner=OWNER
	      After generation set the owner on	the certificate	file or	 data-
	      base to OWNER.

       -M MODE,	--cert-perms=MODE
	      After  generation	 set  the  file	permissions on the certificate
	      file or database to MODE.

BUS OPTIONS
       -s, --session
	      Connect to certmonger on the session bus rather than the	system
	      bus.

       -S, --system
	      Connect  to certmonger on	the system bus rather than the session
	      bus.  This is the	default.

NOTES
       Locations specified for key and certificate storage need	to be accessi-
       ble to the certmonger daemon process.  When run as a system daemon on a
       system which uses a mandatory access control mechanism such as SELinux,
       the system policy must ensure that the daemon is	allowed	to access  the
       locations  where	 certificates  and  keys  that	it will	manage will be
       stored (these locations are typically labeled as	cert_t or  an  equiva-
       lent).	 More	SELinux-specific  information  can  be	found  in  the
       selinux.txt documentation file for this package.

BUGS
       Please  file  tickets  for  any	that  you  find	  at   https://fedora-
       hosted.org/certmonger/

SEE ALSO
       certmonger(8)   getcert(1)   getcert-add-ca(1)	getcert-add-scep-ca(1)
       getcert-list-cas(1)  getcert-list(1)  getcert-modify-ca(1)  getcert-re-
       fresh-ca(1)  getcert-refresh(1)	getcert-rekey(1)  getcert-remove-ca(1)
       getcert-request(1)	 getcert-resubmit(1)	     getcert-status(1)
       getcert-stop-tracking(1)	   certmonger-certmaster-submit(8)    certmon-
       ger-dogtag-ipa-renew-agent-submit(8) certmonger-dogtag-submit(8)	 cert-
       monger-ipa-submit(8)   certmonger-local-submit(8)  certmonger-scep-sub-
       mit(8) certmonger_selinux(8)

certmonger Manual	       February	9, 2015			 CERTMONGER(1)

Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=getcert-start-tracking&sektion=1&manpath=FreeBSD+Ports+15.0>

home | help