Ce contenu n'est pas disponible dans la langue sélectionnée.
12.2. Requesting a Self-signed Certificate with certmonger
To request a certificate with
certmonger
, use the getcert request
utility.
Certificates and keys are stored locally in plain text files with the
.pem
extension or in an NSS database, identified by the certificate nickname. When requesting a certificate, then, the request should identify the location where the certificate will be stored and the nickname of the certificate. For example:
[root@server ~]# selfsign-getcert request -d /etc/pki/nssdb -n Server-Cert
The
/etc/pki/nssdb
file is the global NSS database, and Server-Cert
is the nickname of this certificate. The certificate nickname must be unique within this database.
The options you can provide with the command to generate a certificate vary depending on what kind of certificate you are requesting and the required configuration for the final certificate, as well as other settings:
-r
automatically renews the certificate when its expiration date is close if the key pair already exists. This option is used by default.-f
stores the certificate in the given file.-k
either stores the key in the given file or, if the key file already exists, uses the key in the file.-K
gives the Kerberos principal name of the service that will be using the certificate;-K
is required when requesting a certificate from an IdM server and optional when requesting a self-signed or locally-signed certificate-N
gives the subject name.-D
requests a DNS domain name to be included in the certificate as asubjectAltName
value.-U
sets the extended key usage flag.-A
requests an IP address to be included in the certificate as asubjectAltName
value.-I
sets a name for the task.certmonger
uses this name to refer to the combination of storage locations and request options, and it is also displayed in the output of thegetcert list
command. If you do not specify this option,certmonger
assigns an automatically-generated name for the task.
A real CA, such as the one in IdM, can ignore anything that you specify in the signing request using the
-K
, -N
, -D
, -U
, and -A
options according to the CA's own policies. For example, IdM requires that -K
and -N
agree with the local host name. Certificates generated using the selfsign-getcert
and local-getcert
commands, on the other hand, agree with the options that you specify because these commands do not enforce any policy.
Example 12.1. Using certmonger for a Service
[root@server ~]# selfsign-getcert request -f /etc/httpd/conf/ssl.crt/server.crt -k /etc/httpd/conf/ssl.key/server.key -N CN=`hostname --fqdn` -D `hostname` -U id-kp-serverAuth