CERT-ENROLL(8)

NAME
cert-enroll - Requests X.509 certificates from a PKI via EST or SCEP protocols

SYNOPSIS
cert-enroll [-c file] [-i directory]
cert-enroll -h

DESCRIPTION
cert-enroll uses the strongSwan pki command to request an initial X.509 certificate from a PKI server using either the EST (Enrollment over Secure Transport) or the SCEP (Simple Certificate Enrollment Protocol) certificate enrollment protocol. After having received the host certificate, its expiration date can be monitored periodically and a new certificate will be automatically requested when a predefined deadline of remaining validity days is reached. The availability of new CA certificates is also monitored periodically. The generated RSA or EDCSA private key, the downloaded X.509 certificate and the current set of CA certificates can then be installed in specific places on the host via a selection of installation scripts.

OPTIONS

-h  Prints usage information and a short summary of the available commands.

-c file
    Path to the optional local configuration file that can be used to overwrite parameters in the default configuration file @sysconfdir@/cert-enroll.d/cert-enroll.conf. Defaults to @sysconfdir@/cert-enroll.d/cert-enroll.conf.local.

-i directory
    Path to the installation script directory. Defaults to @sysconfdir@/cert-enroll.d/cert-install.d. This directory will contain dynamic links to selected installation scripts available in the @sysconfdir@/cert-enroll.d/cert-install-available directory.

CONFIGURATION
The configuration parameters for the cert-enroll script are defined in cert-enroll.conf. and selected parameters can be overwritten with the local configuration file cert-enroll.conf.local.

FILES
@sysconfdir@/cert-enroll/cert-enroll.conf         default configuration file
@sysconfdir@/cert-enroll/cert-enroll.conf.local   optional local configuration file
@sysconfdir@/cert-enroll/cert-install.d           default installation script directory
@sysconfdir@/cert-enroll/cert-install-available   selection of available installation scripts
/root/certificates/                       default certificate directory