25.4. Viewing the details of a certificate request tracked by certmonger

Procedure

• If you know how to specify the certificate request, list the details of only that particular certificate request. You can, for example, specify:

  • The request ID
  • The location of the certificate

  • The certificate nickname

    For example, to view the details of the certificate whose request ID is 20190408143846, using the -v option to view all the details of errors in case your request for a certificate was unsuccessful:

    # getcert list -i 20190408143846 -v
    Number of certificates and requests being tracked: 16.
    Request ID '20190408143846':
    	status: MONITORING
    	stuck: no
    	key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-IDM-EXAMPLE-COM',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-IDM-EXAMPLE-COM/pwdfile.txt'
    	certificate: type=NSSDB,location='/etc/dirsrv/slapd-IDM-EXAMPLE-COM',nickname='Server-Cert',token='NSS Certificate DB'
    	CA: IPA
    	issuer: CN=Certificate Authority,O=IDM.EXAMPLE.COM
    	subject: CN=server.idm.example.com,O=IDM.EXAMPLE.COM
    	expires: 2021-04-08 16:38:47 CEST
    	dns: server.idm.example.com
    	principal name: ldap/server.idm.example.com@IDM.EXAMPLE.COM
    	key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
    	eku: id-kp-serverAuth,id-kp-clientAuth
    	pre-save command:
    	post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv IDM-EXAMPLE-COM
    	track: true
    	auto-renew: true

  The output displays several pieces of information about the certificate, for example:

  • the certificate location; in the example above, it is the NSS database in the /etc/dirsrv/slapd-IDM-EXAMPLE-COM directory
  • the certificate nickname; in the example above, it is Server-Cert
  • the file storing the pin; in the example above, it is /etc/dirsrv/slapd-IDM-EXAMPLE-COM/pwdfile.txt
  • the Certificate Authority (CA) that will be used to renew the certificate; in the example above, it is the IPA CA
  • the expiration date; in the example above, it is 2021-04-08 16:38:47 CEST
  • the status of the certificate; in the example above, the MONITORING status means that the certificate is valid and it is being tracked
  • the post-save command; in the example above, it is the restart of the LDAP service

• If you do not know how to specify the certificate request, list the details of all the certificates that certmonger is monitoring or attempting to obtain:

  # getcert list