Red Hat Training

A Red Hat training course is available for Red Hat Enterprise Linux

12.2. Requesting a Self-signed Certificate with certmonger

To request a certificate with certmonger, use the getcert request utility.
Certificates and keys are stored locally in plain text files with the .pem extension or in an NSS database, identified by the certificate nickname. When requesting a certificate, then, the request should identify the location where the certificate will be stored and the nickname of the certificate. For example:
[root@server ~]# selfsign-getcert request -d /etc/pki/nssdb -n Server-Cert
The /etc/pki/nssdb file is the global NSS database, and Server-Cert is the nickname of this certificate. The certificate nickname must be unique within this database.
The options you can provide with the command to generate a certificate vary depending on what kind of certificate you are requesting and the required configuration for the final certificate, as well as other settings:
  • -r automatically renews the certificate when its expiration date is close if the key pair already exists. This option is used by default.
  • -f stores the certificate in the given file.
  • -k either stores the key in the given file or, if the key file already exists, uses the key in the file.
  • -K gives the Kerberos principal name of the service that will be using the certificate; -K is required when requesting a certificate from an IdM server and optional when requesting a self-signed or locally-signed certificate
  • -N gives the subject name.
  • -D requests a DNS domain name to be included in the certificate as a subjectAltName value.
  • -U sets the extended key usage flag.
  • -A requests an IP address to be included in the certificate as a subjectAltName value.
  • -I sets a name for the task. certmonger uses this name to refer to the combination of storage locations and request options, and it is also displayed in the output of the getcert list command. If you do not specify this option, certmonger assigns an automatically-generated name for the task.
A real CA, such as the one in IdM, can ignore anything that you specify in the signing request using the -K, -N, -D, -U, and -A options according to the CA's own policies. For example, IdM requires that -K and -N agree with the local host name. Certificates generated using the selfsign-getcert and local-getcert commands, on the other hand, agree with the options that you specify because these commands do not enforce any policy.

Example 12.1. Using certmonger for a Service

[root@server ~]# selfsign-getcert request -f /etc/httpd/conf/ssl.crt/server.crt -k /etc/httpd/conf/ssl.key/server.key -N CN=`hostname --fqdn` -D `hostname` -U id-kp-serverAuth