Thanks,

I was actually looking fro certificates with notAfter within 20 days period from now. This works in case someone needs:

ldapsearch -x -D 'cn=directory manager' -W -b ou=certificateRepository,ou=ca,o=ipaca "(&(certStatus=VALID)(notAfter<=date -d "+20 days" "+%Y%m%d000000Z")(notAfter>=date "+%Y%m%d000000Z"))"

On Mon, Feb 25, 2019 at 4:31 PM Rob Crittenden <rcritten@redhat.com> wrote:
Andrey Bondarenko via FreeIPA-users wrote:
> Hello,
>
> Are there any possibilities to fetch certificates from the IPA that are
> (1) valid, (2) will expire in 20 (for example) days?
>
> ipa cert-find --validnotafter-to=`date -d "+20 days" "+%Y-%m-%d"
>
> shows revoked serts,  unfortunately. May be some ldapsearch?
>
> --

There are limited bind options to the CA repository. This is how you can
see the certificate data. Creating a query for your needs should be
pretty straightforward.

ldapsearch -x -D 'cn=directory manager' -W -b
ou=certificateRepository,ou=ca,o=ipaca

rob


--

With best regards,
Andrey Bondarenko
mail:me@andreybondarenko.com
https://andreybondarenko.com
skype:andrey.bondarenko
phone, Telegram, WhatsApp, etc:+420-773-591-443

7758 40AC 88CC 96C9 0C9A 9EE4 3B72 547B 7538 D41B