Normally Group Policy triggers Certificate Autoenrollment. If you are not using Group Policy, use the vascert command line utility to manually trigger Certificate Autoenrollment processing for the machine. This will result in certificates being added to the System.keychain according to enrollment policy. You can schedule this command to run periodically if desired.
To manually trigger Certificate Autoenrollment
As root (or using sudo), run the following command to manually trigger Certificate Autoenrollment:
/opt/quest/bin/vascert trigger
Certificate Autoenrollment will proceed in the background. When complete, newly enrolled certificates will be installed in the System.keychain automatically. To troubleshoot Certificate Autoenrollment, run the vascert pulse command as root.
To help you troubleshoot Certificate Autoenrollment, One Identity recommends the following resolutions to some of the common errors, and methods for finding and correcting configuration problems.
You can enable full debug logging for all Certificate Autoenrollment components using the vascert command line utility.
UNIX/Linux: If debug logging is configured, the vascert tool writes files in /var/opt/quest/vascert/.com.quest.X509Enrollment/log for machine enrollment and ~/.com.quest.X509Enrollment/log for user enrollment. You can enable debug logging for all of these components.
To enable debug logging
As root, run the following command to configure debug logging for all users:
/opt/quest/bin/vascert configure debug
To configure debug logging for a specific user, log in as that user and run the same command.
|
NOTE: Enabling debug logging causes the vascert command to write debug messages to a file in addition to stdout. Even after you enable debug logging, you must set the debug level using the -d command line option when running vascert commands manually. |
When you are finished debugging, run the following command as root to turn off debug logging for all users. One Identity recommends that you turn off debug logging to improve performance and conserve disk space.
/opt/quest/bin/vascert unconfigure debug
Use the vascert command line utility to manually perform Certificate Autoenrollment.
To perform Certificate Autoenrollment processing manually
To pulse Certificate Autoenrollment for the machine, run the following command as root (or using sudo):
/opt/quest/bin/vascert pulse
|
NOTE: |
To pulse Certificate Autoenrollment for a specific user, log in as that user and run the following command:
/opt/quest/bin/vascert pulse
|
NOTE: |
© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy