5.6. Performing Bulk Issuance There can be instances when an administrator needs to submit and generate a large number of certificates simultaneously. A combination of tools supplied with Certificate System can be used to post a file containing certificate requests to the CA. This example procedure uses the PKCS10Client command to generate the requests and the sslget command to send the requests to the CA. Since this process is scripted, multiple variables need to be set to identify the CA (host, port) and the items used for authentication (the agent certificate and certificate database and password). For example, set these variables for the session by exporting them in the terminal: export d=/var/tmp/testDir export p=password export f=/var/tmp/server.csr.txt export nick="CA agent cert" export cahost=1.2.3.4 export caport=8443 Note The local system must have a valid security database with an agent's certificate in it. To set up the databases: Export or download the agent user certificate and keys from the browser and save to a file, such as agent.p12 . If necessary, create a new directory for the security databases. If necessary, create new security databases. Stop the Certificate System instance. Use pk12util to import the certificates. If the procedure is successful, the command prints the following output: Start the Certificate System instance. Two additional variables must be set. A variable that identify the CA profile to be used to process the requests, and a variable that is used to send a post statement to supply the information for the profile form. export post="cert_request_type=pkcs10&xmlOutput=true&profileId=caAgentServerCert&cert_request=" export url="/ca/ee/ca/profileSubmitSSLClient" Note This example submits the certificate requests to the caAgentServerCert profile (identified in the profileId element of the post statement. Any certificate profile can be used, including custom profiles. Test the variable configuration. echo USD{d} USD{p} USD{f} USD{nick} USD{cahost} USD{caport} USD{post} USD{url} Generate the certificate requests using (for this example) PKCS10Client : time for i in {1..10}; do /usr/bin/PKCS10Client -d USD{d} -p USD{p} -o USD{f}.USD{i} -s "cn=testmsUSD{i}.example.com"; cat USD{f}.USD{i} >> USD{f}; done perl -pi -e 's/\r\n//;s/\+/%2B/g;s/\//%2F/g' USD{f} wc -l USD{f} Submit the bulk certificate request file created in step 4 to the CA profile interface using sslget . For example: cat USD{f} | while read thisreq; do /usr/bin/sslget -n "USD{nick}" -p USD{p} -d USD{d} -e USD{post}USD{thisreq} -v -r USD{url} USD{cahost}:USD{caport}; done

Commands:
export d=/var/tmp/testDir export p=password export f=/var/tmp/server.csr.txt export nick="CA agent cert" export cahost=1.2.3.4 export caport=8443
mkdir USD{d}
certutil -N -d USD{d}
pki-server stop instance_name
pk12util -i /tmp/agent.p12 -d USD{d} -W p12filepassword
pk12util: PKCS12 IMPORT SUCCESSFUL
pki-server start instance_name
export post="cert_request_type=pkcs10&xmlOutput=true&profileId=caAgentServerCert&cert_request=" export url="/ca/ee/ca/profileSubmitSSLClient"
echo USD{d} USD{p} USD{f} USD{nick} USD{cahost} USD{caport} USD{post} USD{url}
time for i in {1..10}; do /usr/bin/PKCS10Client -d USD{d} -p USD{p} -o USD{f}.USD{i} -s "cn=testmsUSD{i}.example.com"; cat USD{f}.USD{i} >> USD{f}; done perl -pi -e 's/\r\n//;s/\+/%2B/g;s/\//%2F/g' USD{f} wc -l USD{f}
cat USD{f} | while read thisreq; do /usr/bin/sslget -n "USD{nick}" -p USD{p} -d USD{d} -e USD{post}USD{thisreq} -v -r USD{url} USD{cahost}:USD{caport}; done