Certificate Management

After submitting the certificate signing request to the CA, the CA will sign the request and return a signed copy of the certificate. Typically this will be sent in PEM format, the same format used for the CSR and private key.

The certificate data can be imported in one of two ways:

• Use pki certificate <name> enter then copy and paste the PEM data

• Copy the PEM format certificate file to the TNSR host, then use pki certificate <name> import <file> to import from a file from the current working directory.

The certificate data is stored in a file at /etc/pki/tls/tnsr/certs/<name>.crt after entering or importing the contents.

Warning

When importing a certificate created outside of TNSR, The private key must be imported and present before TNSR can import the certificate.

Copy and Paste

First, use the enter command:

tnsr# pki certificate mycert enter
Type or paste a PEM-encoded certificate.
Include the lines containing 'BEGIN CERTIFICATE' and 'END CERTIFICATE'

Note

Remember that the private key, CSR, and certificate must all use identical names!

Next, paste the certificate data:

-----BEGIN CERTIFICATE-----
<cert data>
-----END CERTIFICATE-----

Import from File

First, make sure that the copy of the certificate file is in PEM format. The CA may have delivered the certificate in PEM format, or another format. Convert the certificate to PEM format if it did not come that way.

Next, copy the certificate file to TNSR and start the CLI from the directory containing the certificate file. The filename extension is not significant, and may be pem, crt, txt, or anything else depending on how the file was delivered from the CA.

Next, use the import command:

tnsr# pki certificate mycert import mycert.pem

Other Certificate Operations

To view a list of all certificates known to TNSR, including the certificate validity times and status:

tnsr# pki certificate list
    restconf:   [Not after: Feb  9 15:31:27 2024 GMT] [days left: 361, valid]
    myuser:     [Not after: Feb  9 16:36:36 2024 GMT] [days left: 361, valid]

To view the PEM data for a specific certificate known to TNSR:

tnsr# pki certificate <name> get

To view a brief summary of the certificate details, use get short:

tnsr(config)# pki certificate restconf get short
Issuer:
   commonName: selfca
Subject:
   commonName: tnsr.example.com
NotBefore: Feb  9 15:31:27 2023 GMT
NotAfter: Feb  9 15:31:27 2024 GMT

To view the full certificate details, use get full:

tnsr(config)# pki certificate restconf get full
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            df:67:a7:68:8f:0f:cf:d0
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: CN=selfca
        Validity
            Not Before: Feb  9 15:31:27 2023 GMT
            Not After : Feb  9 15:31:27 2024 GMT
        Subject: CN=tnsr.example.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                   [data]
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:tnsr.example.com, IP Address:203.0.113.2
            X509v3 Subject Key Identifier:
                [Key ID]
            X509v3 Authority Key Identifier:
                [CA Key ID]
            X509v3 Basic Constraints:
                CA:FALSE
            X509v3 Key Usage:
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, 1.3.6.1.5.5.8.2.2
    Signature Algorithm: sha512WithRSAEncryption
    Signature Value:
       [data]

To delete a certificate:

tnsr# pki certificate <name> delete