--- name: "certmonger.conf" section: "5" platform: "linux" package: "certmonger" version: "0.79.20-2" release: "Debian 13 (Trixie)" platforms: ["linux"] url: "https://new.carta.tech/certmonger.conf" --- # certmonger.conf(5) configuration file for certmonger ## NAME certmonger.conf - configuration file for certmonger ## DESCRIPTION The *certmonger.conf* file contains default settings used by certmonger. Its format is more or less that of a typical INI-style file. The only sections currently of note are named *defaults* and *selfsign*. ## DEFAULTS Within the *defaults* section, these variables and values are recognized: - notify\_ttls This is the list of times, given in seconds, before a certificate's not-after validity date (often referred to as its expiration time) when *certmonger* should warn that the certificate will soon no longer be valid. If this value is not specified, *certmonger* will attempt to use the value of the *ttls* setting. The default list of values is "2419200, 604800, 259200, 172800, 86400, 43200, 21600, 7200, 3600". - enroll\_ttls This is the list of times, given in seconds, before a certificate's not-after validity date (often referred to as its expiration time) when *certmonger* should attempt to automatically renew the certificate, if it is configured to do so. If this value is not specified, *certmonger* will attempt to use the value of the *ttls* setting. The default list of values is "2419200, 604800, 259200, 172800, 86400, 43200, 21600, 7200, 3600". - notification\_method This is the method by which *certmonger* will notify the system administrator that a certificate will soon become invalid. The recognized values are *syslog*, *mail*, and *command*. The default is *syslog*. When sending mail, the notification message will be the mail message subject. When invoking a command, the notification message and type will be available in the "CERTMONGER\_NOTIFICATION" and "CERTMONGER\_NOTIFICATION\_TYPE" environment variables and the related request's nickname/ID will be available in the "CERTMONGER\_NOTIFICATION\_CERT\_NICKNAME" environment variable. - notification\_destination This is the destination to which *certmonger* will send notifications. It can be a syslog priority and/or facility, separated by a period, it can be an email address, or it can be a command to run. The default value is *daemon.notice*. - key\_type This is the type of key pair which will be generated, used in certificate signing requests, and used when self-signing certificates. *RSA* is supported. *EC* (also known as *ECDSA*) is also supported. The default is *RSA*. - rsa\_key\_size This is the size of an RSA key if the value is not included in a certificate request. If this value is not set then the default is 2048. The minimum value allowed is 1024. - symmetric\_cipher This is the symmetric cipher which will be used to encrypt private keys stored in OpenSSL's PEM format. Recognized values include *aes128* and *aes256*. The default is *aes128*. It is not recommended that this value be changed except in cases where the default is incompatible with other software. - digest This is the digest algorithm which will be used when signing certificate signing requests and self-signed certificates. Recognized values include *sha1*, *sha256*, *sha384*, and *sha512*. The default is *sha256*. It is not recommended that this value be changed except in cases where the default is incompatible with other software. - nss\_ca\_trust These are the trust attributes which are applied to CA certificates which should be trusted, when they are saved to NSS databases. The default is *CT,C,C*. - nss\_other\_trust These are the trust attributes which are applied to certificates which are not necessarily to be trusted, when they are saved to NSS databases. The default is *,,*. - max\_key\_use\_count When attempting to replace a certificate, if *certmonger* has previously obtained at least this number of certificates using the current key pair, it will generate a new key pair to use before proceeding. There is effectively no default for this setting. - max\_key\_lifetime The amount of time after a key was first generated when *certmonger* will attempt to generate a new key pair to replace it, as part of the process of replacing a certificate. The value is specified as a combination of years (y), months (M), weeks (w), days (d), hours (h), minutes (m), and/or seconds (s). If no unit of time is specified, seconds are assumed. The date when a key was generated is not recorded if the key was not generated by *certmonger*, or if the key was generated with a version of *certmonger* older than 0.78, and for those cases, this option has no effect. There is effectively no default for this setting. ## SELFSIGN Within the *selfsign* section, these variables and values are recognized: - validity\_period This is the validity period given to self-signed certificates. The value is specified as a combination of years (y), months (M), weeks (w), days (d), hours (h), minutes (m), and/or seconds (s). If no unit of time is specified, seconds are assumed. The default value is *1y*. - populate\_unique\_id This controls whether or not self-signed certificates will have their subjectUniqueID and issuerUniqueID fields populated. While RFC5280 prohibits their use, they may be needed and/or used by older applications. The default value is *no*. ## LOCAL Within the *local* section, these variables and values are recognized: - validity\_period This is the validity period given to the locally-signed CA's certificate when it is generated. The value is specified as a combination of years (y), months (M), weeks (w), days (d), hours (h), minutes (m), and/or seconds (s). If no unit of time is specified, seconds are assumed. If not set, the value of the *validity\_period* setting from the *selfsign* section, if one is set there, will be used. The default value is *1y*. ## SCEP Within the *scep* section, these variables and values are recognized: - challenge\_password\_otp This controls whether the SCEP challenge password is treated as a one-time password. If set to yes then the challenge password and/or challenge password file will be removed from the tracking request after the first certificate issuance so will not be sent with renewal requests. The default is no. ## BUGS Please file tickets for any that you find at https://fedorahosted.org/certmonger/ ## SEE ALSO [**certmonger**(8)](/certmonger/8.md) **certmonger\_selinux**(8)