NAME

OpenXPKI::Server::Workflow::Activity::Tools::SearchCertificates

DESCRIPTION

Search for certificates based on several criteria, useful as prestage for duplicate/renewal check or for bulk actions. The result is a list of identifiers written to context defined by target_key.

See the parameter section for available filters.

Configuration

Example

 class: OpenXPKI::Server::Workflow::Activity::Tools::SearchCertificates
    param:
        profile: tls_server
        realm: democa
        issuer: YHkkLxEKtqbopNbcFwdBcHqKWPE
        target_key: other_key

Configuration parameters

realm: The realm to search in, default is the current realm, _any searches globally
tenant: The tenant to search for, the default is to use the tenant of the current workflow.
profile: The profile of the certificate, default is all profiles.
entity_only: Boolean, find only certificates issued within this realm. Default is no.
cert_subject: Searches the full DN for an exact match! The '*' as wildcard is supported.
subject_alt_name: Searches in the SAN section, you must prefix the value with the SAN type, e.g. DNS:www.openxpki.org or IP:1.2.3.4. There might be some difficulties with non-ascii strings/encodings.
issuer: The certificate identifier of the issuer
subject_key_identifier: The certificate subject_key_identifier (hex notation with colon)
cert_serial: The certificate serial number (as hex with 0x prefix or integer, separator and casing is handled internally)
meta_*, system_*: Lets you search for any certificate attribute having a listed prefix. You can set the special value <undef> (including the angle brackets) to search for rows without a certain attribute.
target_key: Name of the context value to write the result to, the default is cert_identifier_list resp. cert_identifier when "limit: single" is used.
order: Sort the result, accepts a single column name, optionally prefixed by "asc" (default) or "desc" (reversed sorting)
limit: Limit the size of the result set. If you pass the special word single the result is a scalar with the first identifier matching the query. In case target_key is not set, the value is written to cert_identifier.
cert_identifier_ignore: Pass a single certificate identifier that is removed from the list in case it was found. This is useful to exclude the certificate in the current workflow when looking for e.g. duplicates.
include_expired: Parseable OpenXPKI::Datetime value (autodetected), certificates which are expired after the given date are included in the report. Set to _any to include all expired certificates. Default is not to include expired certificates.
include_revoked: If set to a true value, certificates which are not in ISSUED state (revoked, crl pending, on hold) are also included in the report. Default is to show only issued certificates.
valid_at: Parseable OpenXPKI::Datetime value (autodetected) used as base for validity calculation. Default is now.
cutoff_notbefore: Parseable OpenXPKI::Datetime value (autodetected), show only certificates where notebefore is between valid_at and this value. Relative intervals are calculated against the given valid_at date!
cutoff_notafter: Parseable OpenXPKI::Datetime value (autodetected), show certificates where notafter is less than value. Relative intervals are calculated against the given valid_at date!