asc certs

Use this command to manage x509 and CA certificates.

Syntax

asc certs [options]

Option

Description

-a, --authority

Use this option when performing operations on a certificate authority (CA) certificate set.

-b or --bulkimport

Perform bulk import of certificates from hosts into the database.

The following options are available for this command:

-f or --bulkfile—Specifies the bulk input file for '--bulkimport' option.
--bulkchain—Walk the certificate chain when using '--bulkimport'.
-y or --yes—Do not prompt for response. Currently used when performing '--bulkimport'.

Note:

This command imports vCenter and ESXi host certificates, not PCS certificates.

-c, --cert [file]

The fully qualified certificate target file path. The contents of this file are overwritten.

This option defines the certificate file location automatically.

--cabundle

By default, CloudControl contains a bundle of certificates, but they are not imported. Use this command if you want to import the certificate bundle.

The following options are available for this command:

enable—Imports the certificate bundle into your installation.

refresh—Refreshes the existing certificate bundle.

disable—Removes the certificate bundle from your installation.

-d, --delete <service>

Delete the specified CA certificate by service name.

Implies --authority.

--fipsmodeon

Enables FIPSMode

--fipsmodeoff

Disables FIPSMode

-g, --genselfsigned [file]

Generate a self-signed certificate using a local key.

This option accepts a temporary fully qualified filename as an argument with certificate data as contents. See --c or --csr help text for file content syntax.

-h, --help

Display usage text.

-i, --import <file>

Validate and install a certificate issued by a CA. Requires a temporary qualified filename as an argument. The temporary file contains the certificate as issued by the certificate authority.

The -s option is also required.

-k, --key [file]

The fully qualified key target file path. The contents of this file are overwritten.

Specifying the -s option defines the key file location automatically.

-l, --list

Lists the certificates installed locally and descriptions of each.

List output is one certificate per line with each value separated by a double length underscore (__).

The format is as follows:

svc__t__cn__o__l__st__c__ou__exp__isd__s__
icn__io__iou__v

Where:

svc—Service name. Valid values are gui, sso_signing, or sso_encryption.
t—Type. Valid values are ss (self-signed) or ext (external).
cn—Common name
o—Organization
l—Locality
st—State/region
c—Country code
ou—Organizational unit
exp—Expiration date stamp or the duration in days for CSR/self-signed generation
isd—Issued date stamp
s—Serial number (real certs only)
v—TLS version
icn—Issuers common name
io—Issuers organization
iou—Issuers organizational unit
key—Key length in bits
dns—DNS Subject Alternative Name fields (comma separated)
ips—IP Subject Alternative Name fields (comma separated)

-q, --csr

Generate a certificate request using a local key. This option accepts a temporary qualified filename as an argument with certificate data as contents. One entry per line prefixed by a two character certificate datatype identifier.

Sample temporary file contents (field separator is '__'):

svc__t__cn__o__l__st__c__ou__exp__isd__s__v__icn__io__iou__key__dns__ips

Where:

svn—Service name. Valid values are:
- gui—CloudControl Management Console
- sso_signing—CloudControl
cn—Common name
o—Organization
l—Locality
st—State/region
c—Country code
ou—Organizational unit
exp—Expiration date stamp or the duration in days for CSR/self-signed generation
dns—DNS Subject Alternative Name fields (comma separated)
ips—IP Subject Alternative Name fields (comma separated)

-r, --random <length>

Generate a random string of the specified length.

--rotate

Perform password rotation for the secure keystore

Note:

This will restart CloudControl.

--sandns

Returns a list of DNS entries of the CloudControl appliance and protected resources to be added as SAN entries to certificates and certificate requests.

--sanips

Returns a list of IP addresses of the CloudControl appliance and protected resources to be added as SAN entries to certificates and certificate requests.

-s, --service

The service to apply the certificate to. Valid values are:

gui—CloudControl Management Console
log—CloudControl Logging Service

-t, --csrtool

Runs the CSR tool which allows user to generate a CSR with SAN.

-v, --verbose

Enable verbose output.

-vv

Enable debug output.

Examples

Import all certificates from CloudControl-protected hosts:

asc certs -b -y

List all certificates installed:

asc certs -l

List all certificate authority (CA) certificates:

asc certs -l -a

Validate and install a certificate for the CloudControl Management Console service:

asc certs -s gui --import /tmp/newCert.pem

Export the current key and certificate to files:

asc certs -k /foo/mykey.pem -c /foo/ssCert.pem

Delete the ca0025 service certificate authority certificate:

asc certs -a -d ca0025

Generate a 32 character random string:

asc certs -r 32

Imports the bundle of certificates:

asc certs -cabundle enable

Import the SSO signing keys:

asc certs -i /usr/local/asc/etc/ssosigncert.pem -s sso_signing

Enable FIPS mode:

asc certs --fipsmodeon

Discover the DNS entries that can be added as SAN entries:

asc certs --sandns

Discover the IP addresses that can be added as SAN entries:

asc certs --sanips