vhsm pki list-intermediates
Learn how to determine which certificates were issued by a parent certificate.
The pki list-intermediates command determines which certificates from a given list were issued by a specified parent certificate.
Usage
<parent>: The certificate used as the issuer against which everything is verified.[child](optional): A path to a certificate to be compared to<parent>, or PKI mounts to search for certificates. If omitted, all accessible PKI mounts are used to construct the list.
This command returns a list of issuing certificates and whether they match the parent based on predefined criteria. By default, the match is determined by subject name, authority key ID, subject key ID, and the ability of the parent to have directly signed the issuer.
Flags
The following flags control the match criteria and output format:
Output Formatting
-use_names
false
Determines how issuers are referred to in the output: by issuer_id (default) or by their name/status as the default issuer (if true).
Match Criteria
-subject_match
true
Requires the subject of the parent issuer to match the issuer of the potential child.
-key_id_match
true
Requires the key ID of the parent issuer to match the key ID of the potential child.
-direct_verify
true
Requires that a trust relationship exists between the parent and child certificates without additional information.
-indirect_sign
true
Requires that if the parent is trusted, the child certificate must also be trusted using available certificate chains.
-path_contains
false
Requires the CA chain of the child certificate to contain the parent certificate for a match.
Required API Access
To run this command, the vHSM user must have access to the following API endpoints:
READ /:parent
Reads the parent certificate for verification.
LIST /sys/mounts
Retrieves a list of PKI mounts if no [child] argument is provided.
LIST /:child_mount/issuers/
Finds PKI issuers on a mount when [child] is omitted or is a mount.
READ /:child
Reads each potential child issuer for comparison against the parent.
Example
Output
Last updated
Was this helpful?