Vascert does not have a functional backend on Linux and Unix since there isn’t a central cert store to store certificates as on macOS. Issues similar to the following will happen when running ‘vascert pulse’:
certstore-DEV.sh, located at /var/opt/quest/vascert/script, needs to be modified. vascert was intentionally designed to require further scripting in order to work properly. For vascert to function properly, the following functions require modification: exportMachineCerts and importMachineIdentity.
Determine if certificate autoenrollment needs to proceed
Before calling this function, vascert creates a 0 byte file for certstore-DEV.sh to export certs into. If the file remains 0 bytes when vascert proceeds, then it proceeds to enroll for a new certificate. If, however, the file contains a valid certificate then that template will be skipped by vascert and move on to either enroll for a different template or end without error.
$1 – The file passed in by vascert that vascert will check to determine if certificate autoenrollment needs to proceed.
$2 – Onetime passphrase used by vascert to decrypt the pkcs12 file. When exporting the machine certs, this function will need to use that passphrase to encrypt the file so vascert can read the contents
0 – Success. Even if there are no certs to export, return 0 for vascert to continue with autoenrollment
Other than 0 – Failure. Any other return code causes vascert to fail and end here.
Now that vascert has a new certificate, pass the location to the certstore-DEV.sh so it can be stored where it needs to be.
Now that vascert has acquired a new certificate, store it where it needs to be. The location to store it depends on the requirements for the software that will use it. Please see their documentation for that location.
$1 – Location of the certificate
0 – Success.
Other than 0 – Failure. Vascert will end with an error message.