getcert add-scep-ca [options]
Adds a CA configuration to certmonger, which can
subsequently be used to enroll certificates. The configuration will use the
bundled scep-submit helper. The add-scep-ca command is more or
less a wrapper for the add-ca command.
- -c NAME,
--ca=NAME
- The nickname to give to this CA configuration. This same value can later
be passed in to getcert's request, resubmit, and
start-tracking commands using the -c flag.
- -u URL,
--url=URL
- The location of the SCEP server's enrollment interface. This option must
be specified.
- -R FILE,
--ca-cacert=FILE
- The location of a PEM-formatted copy of the CA's certificate used to
verify the TLS connection the SCEP server.
This option must be specified if the URL is an https
location.
- -N FILE,
--signingca=FILE
- The location of a PEM-formatted copy of the SCEP server's CA certificate.
A discovered value is normally supplied by the certmonger daemon, but one
can be specified for troubleshooting purposes.
- -r FILE,
--ra-cert=FILE
- The location of a PEM-formatted copy of the SCEP server's RA's
certificate. A discovered value is normally supplied by the certmonger
daemon, but one can be specified for troubleshooting purposes.
- -I FILE,
--other-certs=FILE
- The location of a file containing other PEM-formatted certificates which
may be needed in order to properly verify signed responses sent by the
SCEP server back to the client. A discovered set is normally supplied by
the certmonger daemon, but can be specified for troubleshooting
purposes.
- -i ID,
--id=ID
- A CA identifier value which will passed to the server when the
scep-submit helper is used to retrieve copies of the server's
certificates.
- -n,
--non-renewal
- The SCEP Renewal feature allows a client with a previously-issued
certificate to use that certificate and the associated private key to
request a new certificate for a different key pair, and can be used to
support certmonger's rekeying feature if the SCEP server advertises
support for it. This option forces the scep-submit helper to issue
requests without making use of this feature.
- -v, --verbose
- Be verbose about errors. Normally, the details of an error received from
the daemon will be suppressed if the client can make a diagnostic
suggestion.
Please file tickets for any that you find at
https://fedorahosted.org/certmonger/