1

The required options for certupdate seem to have changed in macOS Sierra Server or before, and the manpages have not caught up yet.

When trying:

certupdate remove -c /etc/certificates/secure.domain.com.1234567890123456789012345678901234567890.cert.pem


certupdate throws this error:

certupdate[92173:961471] Unable to recreate the missing certificate ID for /etc/certificates/secure.domain.com.1234567890123456789012345678901234567890.cert.pem error = 2


If you just use certupdate by itself you get:

certupdate remove [-c cert_path] [-p cert_persistent_ref_base64] -i cert_identifier
certupdate replace -c old_cert_path [-p old_cert_persistent_ref_base64] -C new_cert_path [-P new_cert_persistent_ref_base64] -i old_cert_identifier -I new_cert_identifier


which says that now -i and -I are required, though not mentioned in the manpages or anywhere online that I can find.

Unfortunately, I've been unable to construct a proper cert_identifier for use with either version of certupdate and have tried to use secure.domain.com.[SHA-1] with and without various extensions, various paths including /etc/certificates, but to no avail. I also asked security to find the certificate, hoping it would show some kind of clue, but it did not.

The only thing I've found is that asking serveradmin about websites reveals a key called web:defaultSecureSite:mstCertificateIdentifier which contains a SHA-256 hash and the domain, but no combination I made of that works, either.

Does anybody have any idea how to use certupdate now that these options are required?

BillEccles
  • 123

1 Answers1

1

The certupdate tool was not really intended to be used manually, it is supposed to be called by a process that watches the System keychain.

The cert identifier is made up of three parts separated by the ':' char they are: hashtype:hash:"subject"

sha256:0fa41022930ef3d200102d4f0a90e53b250674b9:"my server.com"

The hash portion is the hashtype hash of the DER formatted certificate.

you can get the identifier for the certificates of interest by running the server admin command: sudo serveradmin settings certs

and looking for the identifier key associated with each cert returned.

Leland Wallace
  • 685
  • One minor correction. The hashtype is currently "SHA-256" per the recently-updated manpage for certupdate. (Sorry it took so long to try this out and verify it. This answer is otherwise correct.) – BillEccles Nov 26 '17 at 21:09