B.3. Tracking Certificates with certmonger

certmonger can manage the entire certificate lifecycle. Along with generating requests, certmonger can track a certificate and automatically renew it when it expires at the end of its validity period.

This is done using the start-tracking command with the getcert command. The -I option creates the tracking entry, along with pointers to the key and certificate files, either in an NSS database (-d and -n) or in the PEM file (-f and -k). The -r option tells certmonger to renew the certificate.

ipa-getcert start-tracking -I cert1-tracker -d /export/alias -n ServerCert -r

# ipa-getcert start-tracking -I cert1-tracker -d /export/alias -n ServerCert -r

A certificate can be untracked by certmonger by using the stop-tracking command.