NAME

ocifbsd-cert — ocifbsd certificate management tool

SYNOPSIS

DESCRIPTION

The ocifbsd-cert tool manages X.509 certificates used by the ocifbsd(8) OCI runtime. It supports certificate authority (CA) creation, node enrollment, automatic rotation, ACME/Let's Encrypt integration, and external CA enrollment (SCEP, EST, ADCS, Vault PKI).

Certificate data is stored under /etc/ocifbsd/certs with backups under /var/lib/ocifbsd/certs/backups.

The commands are:

list

List all known certificates as JSON to standard output.

rotate

Rotate every certificate that is due for renewal.

check

Verify every certificate's expiry and emit syslog alerts for those approaching the warning or critical thresholds.

backup name

Create a timestamped backup of name's key and certificate.

FILES

/etc/ocifbsd/certs

Certificate storage directory.

/var/lib/ocifbsd/certs/backups

Certificate backup directory.

/etc/ocifbsd/certs/registry.json

On-disk registry of known certificates.

/etc/ocifbsd/certs/history.log

Append-only audit log of certificate actions.

SEE ALSO

ocifbsd(8)

HISTORY

The ocifbsd-cert command first appeared in FreeBSD 16.0.

AUTHORS

The ocifbsd-cert utility was developed by Klara, Inc. under sponsorship from