skarbiec certificates

Invocation#

skarbiec certificates [--expiring-before <iso8601>]

Purpose#

See when every certificate the vault keeps stops being valid, so a renewal is started before a service fails on it.

Required inputs and options#

• No positional input. --expiring-before keeps the certificates whose end of validity is before a UTC time of the vault's stamp form; without it every live certificate item is listed. The certificate is read from each item's certificate field by the OpenSSL SKARBIEC_OPENSSL names, else Homebrew's, else openssl on PATH; it must support -dateopt iso_8601.

Output and state effects#

• Prints ok, checked_at, expiring_before, certificates (item, subject, issuer, not_after and expired, soonest first) and unreadable (item and error). Only the certificate field is handed to OpenSSL; the private key and passphrase beside it are never read out. It writes nothing. POST /v1/operator/certificates takes expiring-before the same way; Desktop's Settings → Policy shows it as Certificates.

Refusals#

• An --expiring-before of another shape exits 2 with `--expiring-before <value> is not a UTC time of the form <now>`. An item that will not open, holds no certificate text, or that OpenSSL cannot read or dates in another form is listed under unreadable with that error rather than left out, because a missing row reads as one certificate fewer to renew.