6.0.3

certool --getrootca
Prints the current root CA certicate in human-readable form. If you are running this command from a
management node, use the machine name of the Platform Services Controller node to retrieve the root CA.
This output is not usable as a certicate, it is changed to be human readable.
Option Description
--getrootca
Required for printing the root certicate.
--server <server>
Optional name of the VMCA server. By default, the
command uses localhost.
Example:
certool --getrootca --server=remoteserver
certool --viewcert
Print all the elds in a certicate in human-readable form.
Option Description
--viewcert
Required for viewing a certicate.
--cert <certfile>
Optional name of the conguration le. Defaults to
certool.cfg.
Example:
certool --viewcert --cert=<filename>
certool --enumcert
List all certicates that the VMCA server knows about. The required filter option lets you list all
certicates or only revoked, active, or expired certicates.
Option Description
--enumcert
Required for listing all certicates.
--filter [all | active]
Required lter. Specify all or active. The revoked and
expired options are not currently supported.
Example:
certool --enumcert --filter=active
certool --status
Sends a specied certicate to the VMCA server to check whether the certicate has been revoked. Prints
Certicate: REVOKED if the certicate is revoked, and Certicate: ACTIVE otherwise.
vSphere Security
124 VMware, Inc.