Thanks,
I was actually looking fro certificates with notAfter within 20 days period
from now. This works in case someone needs:
ldapsearch -x -D 'cn=directory manager' -W -b
ou=certificateRepository,ou=ca,o=ipaca "(&(certStatus=VALID)(notAfter<=date
-d "+20 days" "+%Y%m%d000000Z")(notAfter>=date
"+%Y%m%d000000Z"))"
On Mon, Feb 25, 2019 at 4:31 PM Rob Crittenden <rcritten(a)redhat.com> wrote:
Andrey Bondarenko via FreeIPA-users wrote:
> Hello,
>
> Are there any possibilities to fetch certificates from the IPA that are
> (1) valid, (2) will expire in 20 (for example) days?
>
> ipa cert-find --validnotafter-to=`date -d "+20 days"
"+%Y-%m-%d"
>
> shows revoked serts, unfortunately. May be some ldapsearch?
>
> --
There are limited bind options to the CA repository. This is how you can
see the certificate data. Creating a query for your needs should be
pretty straightforward.
ldapsearch -x -D 'cn=directory manager' -W -b
ou=certificateRepository,ou=ca,o=ipaca
rob
--
With best regards,
Andrey Bondarenkomail:me@andreybondarenko.comhttps://andreybondarenko.com
skype:andrey.bondarenko
phone, Telegram, WhatsApp, etc:+420-773-591-443
7758 40AC 88CC 96C9 0C9A 9EE4 3B72 547B 7538 D41B