ERS CLI

-c, --config-dir

false

${USER_HOME}/.ers

This option allows the definition of a custom configuration directory. If not set, the default directory of ${USER_HOME}/.ers will be used. It is used to persist configuration and state files between executions.

-u, --username

true

-

A string value corresponding to the api client provider ID.

-s

false

-

Provide this option to store the api client secret in the configuration file.

-p

true

-

The api client secret.

-e

true

-

A string value corresponding to the base URL of the MTG-CLM.

-o

true

-

A string value corresponding to the base URL of the Open ID Connect provider.

-x

false

-

A string value specifying the proxy server and port for the CLM server. This value must be given without http:// or https://. The server part is separated from the port part by using :.

Example: example.com:8080

-t, --truststore-path

false

-

The absolute path to the truststore which contains the trusted certificates necessary to validate the TLS connections to MTG-CLM and OpenID Connect provider.

-tp, --truststore-password

false

-

The password of the truststore which contains the trusted certificates necessary to validate the TLS connections to MTG-CLM and OpenID Connect provider.

--ee-uuid

true

-

The end entity id used in basic authentication.

--ee-password

true

-

The end entity password used in basic authentication.

-m or --mode

true

-

Specifies the mode of the certificate creation process. Possible values are SERVER_GENERATED, CLIENT_GENERATED, PKCS10, or RA_MODE.

--csr

false

-

Full path to the certificate signed request file used with PKCS 10 mode.

--output-type

false

PKCS12

The type of the generated files. Allowed values are: PKCS12, JCEKS, PEM, or DER.

--key-file

false

-

Full file name of the exported keystore file (absolute path + filename).

--key-file-password

false

-

The password used for the protection of the exported keystore file. For the output type PEM or DER, this option is not allowed. The PEM or DER file for the private key is stored without password protection.

--cert-file

false

-

Full file name of the exported certificate file (absolute path + filename).

--valid-for

false

One year

The period during which the certificate will be valid.

--algorithm

true

-

The crypto algorithm to be used during certificate creation process.

--rsa-key-size

false

2048

The RSA key size property.

--exponent

false

-

The exponent property.

--named-curve

false

brainpoolP256r1

The named curve property.

--eddsa-curve

false

curve25519

The EdDSA curve property.

--store

false

-

Automatically imports the certificate to Windows Certificate User Store (only for MS Windows system)

--servers

true (false if ips or ctlog is given)

-

The servers/hostnames to scan for certificates

--ips

false

-

The IPs to scan for certificates. Works together only with the --servers or --ips arguments.

--ports

true (false if servers or ctlog are given)

-

The ports of the servers or IPs to scan for certificates.

--ctlog

true (false if servers or ips are given)

-

The domain names (comma separated) to import all public SSL certificates they appear inside.

--proxy

false

-

A string value specifying the proxy server and port for the CtLog scan. This value must be given without the http:// or https://. The server part is separated from the port part by using :.

Example: example.com:8080

--no-proxy

false

false

Configure the scan to not use a proxy.

--import-batch-size

false

10

The batch size for the import.

--create-cert

false

true

Configure if the certificates for the imported requests should be created automatically in the CLM.

--save-cert

false

false

Configure if the imported certificates should be saved in the file system under the configuration directory of the application.

--server

false

-

The host and port for the LDAP server.

Example: proxy.example.com:8080

If no port is set, the default ports for the protocols ldap and ldaps will be used.

-t, --truststore-path

false

-

The absolute path to the truststore which contains the trusted certificates necessary to validate the TLS connections to the LDAP server.

-tp, --truststore-password

false

-

The password of the truststore which contains the trusted certificates necessary to validate the TLS connections to the LDAP server.

--auth-principal-name

false

-

The AD Principal Name of the user to use for LDAP requests in the form:

<LDAP user’s account name>@<domain name in upper case letters>

Example: ldap-user@EXAMPLE.COM

In AD this user must have read access to the LDAP entries

--auth-keytab

false

-

The location / path of the keytab file.

--auth-krb5conf

false

-

The location / path of the krb5.conf file.

--search-base-dn

false

-

The LDAP search baseDN in the form DC=<domain>,DC=<top level domain>

Example: DC=example,DC=com

----search-filter

false

-

The search filter for the entries which contain the certificates. It must be enclosed with brackets.

Example: (usercertificate=*)

--search-cert-attr

false

-

The attribute ID for the certificate.

--create-timestamp-attribute

false

-

The attribute ID for the creation timestamp.

--modified-timestamp-attribute

false

-

The attribute ID for the modification timestamp.

--page-size

false

1000

The page size for the LDAP search.

465

SMTP

636

LDAP

853

DNS

989

FTP

990

FTP

992

Telnet

993

IMAP

995

POP

--policy-id

true

-

The UUID of the policy of CLM in which the imported certificates are attached.

--scan-network

false

true

Enables the network scan.

--scan-ctlog

false

true

Enables the ctlog scan.

--scan-ldap

false

true

Enables the ldap scan.