AC Hosting Environment

AC Hosting Environment Documentation
  • 1 Release Notes
    • 1.1 End-Of-Life (EOL) Notice
    • 1.2 Support Policy
    • 1.3 Differences to CentOS
  • 2 Deployment
    • 2.1 Prerequisites
    • 2.2 Preparing to Install
    • 2.3 Installation
    • 2.4 Post Installation Steps
  • 3 AC Tools
    • 3.1 AC Configure Syslog
      • 3.1.1 Introduction
      • 3.1.2 Un/Installation
      • 3.1.3 Usage
    • 3.2 AC Firewall
      • 3.2.1 Introduction
      • 3.2.2 Un/Installation
      • 3.2.3 Usage
    • 3.3 AC Integrity
      • 3.3.1 Introduction
      • 3.3.2 Un/Installation
      • 3.3.3 Usage
      • 3.3.4 Integration Tips
    • 3.4 Make Bash Installer
      • 3.4.1 Introduction
      • 3.4.2 Un/Installation
      • 3.4.3 Usage
    • 3.5 AC X509 Authority
      • 3.5.1 Introduction
      • 3.5.2 Un/Installation
      • 3.5.3 Command Reference
      • 3.5.4 Certificates For Beginners
      • 3.5.5 CA Management
      • 3.5.6 Server, Client, and User Certificate Management
      • 3.5.7 Reporting Commands
      • 3.5.8 Troubleshooting

3.5.7 Reporting Commands

February 25th, 2026

Several commands exist for getting read-only information out AC X509 Authority as a whole, a specific CA, or a specific certificate.

This article describes the following:

3.5.7.1 Getting a List of Certificates

It is possible to get the full list of certificates and their CAs with a single command which lists everything up grouped by CA, including the type of certificates (intermediate, server, or user).

# ac_x509_authority list --- AC X509 Authority certificate list --- Certificate Authority 'BigCorpCA' (intent: intermediate) certificate list: bigcorp-client-management.crt bigcorp-host-management.crt bigcorpICA.crt Certificate Authority 'BigCorpClientsCA' (intent: server) certificate list: hana-client.crt Certificate Authority 'BigCorpEngineeringRoot' (intent: intermediate) certificate list: bonzai.crt bigcorp-clients-ca.crt bigcorp-hosts-ca.crt Certificate Authority 'BigCorpHostsCA' (intent: server) certificate list: localhost2.crt localhost.crt Certificate Authority 'bigcorpICA' (intent: server) certificate list: 10-43-47-49.qa-ad.bigcorp.com.crt mssql.crt virt.bigcorp.asiacomtek.com.crt

The output can be restricted to a single specific CA by passing an optional CA name as the second argument.

3.5.7.2 Getting Certificate Information

In order to get the current validity information for a certificate, use the get-info command to fetch a certificate by it's name.

Usage

# ac_x509_authority <CA> get-info <common_name>

Example

# ac_x509_authority BigCorpCA get-info bigcorp-client-management status=valid serial=989682 notBefore=Feb 10 08:45:39 2026 GMT notAfter=Feb 10 08:45:39 2028 GMT Subjects=DNS:bigcorp-client-management

3.5.7.3 Getting CA Configuration

Being aware of the requirements of a CA for child certificate DN restrictions and the CA's own validity period is critical. A full summary can be extracted from the profile command.

Usage

# ac_x509_authority <CA> profile

Example

# ac_x509_authority BigCorpCA profile Certificate Authority summary for 'BigCorpCA' (fields marked will enforce matching in issued certificates) Type: self-signed Authority Intent: intermediate CA key length: 2048 CA validity period: From Jul 2 06:34:13 2025 GMT to Jul 2 06:34:13 2035 GMT CA is password locked: no CA Common Name (CN): BigCorpCA CA Organisation (O): BigCorp Inc. CA Department/s (OU): Support CA City (L): Sapporo CA State or Region (ST): Hokkaido CA Country (C): JP CA administrator email: noreply@bigcorp.local CRL path(s): CRL validity period: 30 days CRL auto update: no CRL export path: Password locked keys: no Issued validity periods: 730 days Issued key lengths: 2048 bit

3.5.7.4 Exporting Data to CSV

For the purpose of global reporting and system integration, detailed reports can be exported to CSV (pipe separated in this case) for easy transfer to either a spreadsheet or to integrate Ac X509 Authority with some other customised front-end application. This can be done with the get-report command and combined with the --verbose flag combines useful on-screen output with the actual CSV file.

Usage

# ac_x509_authority get-report [<CA>]

The <CA> is optional and merely restrict the report file to a single CA's contents.

Example

# ac_x509_authority get-report --verbose CA scope set to 'all'. Processing CA 'BigCorpCA'... Processing certificates. Adding certificate 'bigcorp-client-management'. Adding certificate 'bigcorp-host-management'. Adding certificate 'bigcorpICA'. Processing CSRs. Processing CA 'BigCorpClientsCA'... Processing certificates. Adding certificate 'hana-client'. Processing CSRs. Processing CA 'BigCorpEngineeringRoot'... Processing certificates. Adding certificate 'bonzai'. Adding certificate 'bigcorp-clients-ca'. Adding certificate 'bigcorp-hosts-ca'. Processing CSRs. Processing CA 'BigCorpHostsCA'... Processing certificates. Adding certificate 'localhost2'. Adding certificate 'localhost'. Processing CSRs. Processing CA 'BigCorpICA'... Processing certificates. Adding certificate '10-43-47-49.qa-ad.bigcorp.com'. Adding certificate 'mssql'. Adding certificate 'virt.bigcorp.asiacomtek.com'. Processing CSRs. Report file: '/var/CA/report_all_20260225T003409.csv'

Sample CSV Output

Truncated sample

CA|CN|SERIAL|KEY|CERT|START|END|VALID BigCorpCA|bigcorp-client-management|989682|bigcorp-client-management.key|bigcorp-client-management.crt|Feb 10 08:45:39 2026 GMT|Feb 10 08:45:39 2028 GMT|valid

previous: Server, Client, and User Certificate Management next: Troubleshooting