12.2. Requesting a Self-signed Certificate with certmonger
To request a certificate with
certmonger, use the getcert request utility.
Certificates and keys are stored locally in plain text files with the
.pem extension or in an NSS database, identified by the certificate nickname. When requesting a certificate, then, the request should identify the location where the certificate will be stored and the nickname of the certificate. For example:
[root@server ~]# selfsign-getcert request -d /etc/pki/nssdb -n Server-Cert
The
/etc/pki/nssdb file is the global NSS database, and Server-Cert is the nickname of this certificate. The certificate nickname must be unique within this database.
The options you can provide with the command to generate a certificate vary depending on what kind of certificate you are requesting and the required configuration for the final certificate, as well as other settings:
-rautomatically renews the certificate when its expiration date is close if the key pair already exists. This option is used by default.-fstores the certificate in the given file.-keither stores the key in the given file or, if the key file already exists, uses the key in the file.-Kgives the Kerberos principal name of the service that will be using the certificate;-Kis required when requesting a certificate from an IdM server and optional when requesting a self-signed or locally-signed certificate-Ngives the subject name.-Drequests a DNS domain name to be included in the certificate as asubjectAltNamevalue.-Usets the extended key usage flag.-Arequests an IP address to be included in the certificate as asubjectAltNamevalue.-Isets a name for the task.certmongeruses this name to refer to the combination of storage locations and request options, and it is also displayed in the output of thegetcert listcommand. If you do not specify this option,certmongerassigns an automatically-generated name for the task.
A real CA, such as the one in IdM, can ignore anything that you specify in the signing request using the
-K, -N, -D, -U, and -A options according to the CA's own policies. For example, IdM requires that -K and -N agree with the local host name. Certificates generated using the selfsign-getcert and local-getcert commands, on the other hand, agree with the options that you specify because these commands do not enforce any policy.
Example 12.1. Using certmonger for a Service
[root@server ~]# selfsign-getcert request -f /etc/httpd/conf/ssl.crt/server.crt -k /etc/httpd/conf/ssl.key/server.key -N CN=`hostname --fqdn` -D `hostname` -U id-kp-serverAuth
