Product SiteDocumentation Site

18.3. Tracking Certificates with certmonger

certmonger can manage the entire certificate lifecycle. Along with generating requests, certmonger can track a certificate and automatically renew it when it expires at the end of its validity period.
This is done using the start-tracking command with the getcert command. The -I option creates the tracking entry, along with pointers to the key and certificate files, either in an NSS database (-d and -n) or in the PEM file (-f and -k). The -r option tells certmonger to renew the certificate.
# ipa-getcert start-tracking -I cert1-tracker -d /export/alias -n ServerCert -r


The -r option can be passed with the request command, in Example 18.1, “Using certmonger for a Service”. In that case, the requested certificate is automatically tracked and renewed by certmonger. Then, it is not necessary to configure tracking manually.
A certificate can be untracked by certmonger by using the stop-tracking command.