Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

5.7. Performing Bulk Issuance

There can be instances when an administrator needs to submit and generate a large number of certificates simultaneously. A combination of tools supplied with Certificate System can be used to post a file containing certificate requests to the CA. This example procedure uses the PKCS10Client command to generate the requests and the sslget command to send the requests to the CA.
  1. Since this process is scripted, multiple variables need to be set to identify the CA (host, port) and the items used for authentication (the agent certificate and certificate database and password). For example, set these variables for the session by exporting them in the terminal:
    Copy to Clipboard Toggle word wrap 
    export d=/var/tmp/testDir
export p=password
export f=/var/tmp/server.csr.txt
export nick="CA agent cert"
export cahost=1.2.3.4
export caport=8443

    Note

    The local system must have a valid security database with an agent's certificate in it. To set up the databases:
    1. Export or download the agent user certificate and keys from the browser and save to a file, such as agent.p12.
    2. If necessary, create a new directory for the security databases.
      Copy to Clipboard Toggle word wrap 
      mkdir ${d}
    3. If necessary, create new security databases.
      Copy to Clipboard Toggle word wrap 
      certutil -N -d ${d}
    4. Stop the Certificate System instance.
      Copy to Clipboard Toggle word wrap 
      systemctl stop pki-tomcatd@instance_name.service
    5. Use pk12util to import the certificates.
      Copy to Clipboard Toggle word wrap 
      # pk12util -i /tmp/agent.p12 -d ${d} -W p12filepassword
      If the procedure is successful, the command prints the following output:
      Copy to Clipboard Toggle word wrap 
      pk12util: PKCS12 IMPORT SUCCESSFUL
    6. Start the Certificate System instance.
      Copy to Clipboard Toggle word wrap 
      systemctl start pki-tomcatd@instance_name.service
  2. Two additional variables must be set. A variable that identify the CA profile to be used to process the requests, and a variable that is used to send a post statement to supply the information for the profile form.
    Copy to Clipboard Toggle word wrap 
    export post="cert_request_type=pkcs10&xmlOutput=true&profileId=caAgentServerCert&cert_request="
export url="/ca/ee/ca/profileSubmitSSLClient"

    Note

    This example submits the certificate requests to the caAgentServerCert profile (identified in the profileId element of the post statement. Any certificate profile can be used, including custom profiles.
  3. Test the variable configuration.
    Copy to Clipboard Toggle word wrap 
    echo ${d} ${p} ${f} ${nick} ${cahost} ${caport} ${post} ${url}
  4. Generate the certificate requests using (for this example) PKCS10Client:
    Copy to Clipboard Toggle word wrap 
    time for i in {1..10}; do /usr/bin/PKCS10Client -d ${d} -p ${p} -o ${f}.${i} -s "cn=testms${i}.example.com"; cat ${f}.${i} >> ${f}; done

perl -pi -e 's/\r\n//;s/\+/%2B/g;s/\//%2F/g' ${f}

wc -l ${f}
  5. Check the status and the transaction logs for the CA. Copy to Clipboard Toggle word wrap 
    /etc/init.d/pki-ca status

tail -f /var/log/pki-ca/transactions&
  6. Submit the bulk certificate request file created in step 4 to the CA profile interface using sslget. For example: Copy to Clipboard Toggle word wrap 
    cat ${f} | while read thisreq; do /usr/bin/sslget -n "${nick}" -p ${p} -d ${d} -e ${post}${thisreq} -v -r ${url} ${cahost}:${caport}; done
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat, Inc.