Use the SignClient validatecertificate command to request a certificate to be validated by the specified service.

Command Options

Option

Description

-cert <cert-file>

Path to certificate file (DER or PEM). Required.

-certpurposes <certpurposes>

A ',' separated string containing requested certificate purposes.

-der

Certificate is in DER format.

-help

Display command option information.

-hosts <hosts>

A ',' separated string containing the hostnames of the validation service nodes. Required.

Example: 'host1.someorg.org,host2.someorg.org'

When using the HTTP protocol, only one host name can be specified.

-pem

Certificate is in PEM format (Default).

-port <port>

Remote port of service. Default is 8080 or 8442 for SSL.

-protocol <protocol>

Protocol to use, either WEBSERVICES or HTTP. Default: WEBSERVICES.

-service <service-name>

The name or ID of the validation service to process request. Required.

-silent

The command does not produce any output, only returns value.

-truststore <jks-file>

Path to JKS truststore containing trusted CA for SSL Server certificates.

-truststorepwd <password>

Password to unlock the truststore.

The following values are returned by the program that can be used when scripting:

-2 : Error happened during execution
-1 : Bad arguments
0 : Certificate is valid
1 : Certificate is revoked
2 : Certificate is not yet valid
3 : Certificate has expired
4 : Certificate doesn't verify
5 : CA Certificate has been revoked
6 : CA Certificate is not yet valid
7 : CA Certificate has expired
8 : Certificate has no valid certificate purpose

Example Use Cases

Basic Validation

Validate a PEM-format certificate against a named validation service on localhost, using the default WEBSERVICES protocol:

validatecertificate -service CertValidationWorker -hosts localhost -cert certificate.pem

PEM is the default, so no -pem flag is needed.

HTTPS with Server Certificate Validation

Connect over WEBSERVICES but with HTTPS and validate the server certificate using a truststore. The validation service is identified by its numeric worker ID (5806) rather than a name:

validatecertificate -service 5806 -hosts localhost -cert certificate.pem -truststore p12/truststore.jks -truststorepwd changeit

HTTP Protocol

Explicitly use the HTTP protocol instead of the default WEBSERVICES:

validatecertificate -service CertValidationWorker -hosts localhost -cert certificate.pem -protocol HTTP

When using HTTP, only a single hostname can be specified with -hosts.