Certificate Operations

Reusable reference for certificate inspection, trust validation, chain retrieval, and controlled management across Linux and Windows systems.

Commands are safe for inspection and controlled remediation. Removal commands must be executed only within approved change scope.

1. ISE Certificate Chain Retrieval

Pull the full certificate chain from Cisco ISE for inspection or trust store installation.

1.1. Pull Chain (Bash)

# Pull full certificate chain from ISE
openssl s_client -connect ise-02.inside.domusdigitalis.dev:443 -showcerts </dev/null

# Save chain to PEM file
openssl s_client -connect ise-02.inside.domusdigitalis.dev:443 -showcerts </dev/null \
  | awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' > ise-chain.pem

# Split chain into individual certificates
csplit -f ise-cert- ise-chain.pem '/BEGIN CERTIFICATE/' '{*}'

1.2. Pull Chain (PowerShell)

# Pull certificate chain from ISE
openssl s_client -connect ise-02.inside.domusdigitalis.dev:443 -showcerts

# Save chain to file
openssl s_client -connect ise-02.inside.domusdigitalis.dev:443 -showcerts |
  Out-File ise-chain.pem

2. ISE Certificate Chain Inspection

# Inspect each certificate in the chain
for cert in ise-cert-*; do
    echo "=== $cert ==="
    openssl x509 -in "$cert" -noout -subject -issuer -dates
    echo ""
done

# Individual inspection
openssl x509 -in ise-cert-01 -noout -subject -issuer -dates   # Leaf (ISE server)
openssl x509 -in ise-cert-02 -noout -subject -issuer -dates   # Intermediate CA
openssl x509 -in ise-cert-03 -noout -subject -issuer -dates   # Root CA

2.1. Verify Chain Against System Trust Store

# Verify ISE leaf certificate against system trust store
openssl verify -CApath /etc/ssl/certs ise-cert-01

# Verify with explicit CA chain
openssl verify -CAfile ise-chain.pem ise-cert-01

3. Linux Trust Store Validation

# Check if Root CA is installed
ls -la /usr/local/share/ca-certificates/ | grep -i HOME-ROOT-CA

# Check Root CA in system trust bundle
openssl x509 -in /etc/ssl/certs/HOME-ROOT-CA.pem -noout -subject -issuer -dates 2>/dev/null \
  || echo "Root CA not found in /etc/ssl/certs"

# Verify machine certificate
openssl x509 -in /etc/ssl/certs/machine.crt -noout -subject -issuer -dates -purpose 2>/dev/null \
  || echo "Machine cert not found"

# Check private key matches certificate (hashes must match)
openssl x509 -in /etc/ssl/certs/machine.crt -noout -modulus 2>/dev/null | md5sum
openssl rsa  -in /etc/ssl/private/machine.key  -noout -modulus 2>/dev/null | md5sum

4. Machine Certificate Inspection

4.1. Full Certificate Details

# Full certificate information
openssl x509 -in /etc/ssl/certs/machine.crt -text -noout

# Key fields only
openssl x509 -in /etc/ssl/certs/machine.crt -noout \
  -subject -issuer -dates -serial -fingerprint

4.2. Check Extended Key Usage

# Verify Client Authentication EKU present
openssl x509 -in /etc/ssl/certs/machine.crt -noout -purpose | grep "SSL client"
# Should show: SSL client : Yes

# Full EKU extension
openssl x509 -in /etc/ssl/certs/machine.crt -text -noout | grep -A1 "Extended Key Usage"
# Should show: TLS Web Client Authentication (1.3.6.1.5.5.7.3.2)

4.3. Check Subject Alternative Names (SANs)

# Extract SANs
openssl x509 -in /etc/ssl/certs/machine.crt -text -noout | grep -A1 "Subject Alternative Name"

4.4. Check Certificate Validity

# Check validity dates
openssl x509 -in /etc/ssl/certs/machine.crt -noout -dates

# Check if certificate is currently valid
openssl x509 -in /etc/ssl/certs/machine.crt -checkend 0
# Returns 0 if valid, 1 if expired

# Check if expires in next 30 days
openssl x509 -in /etc/ssl/certs/machine.crt -checkend 2592000
# Returns 1 if expires within 30 days

5. Windows Trust Store Validation (PowerShell)

5.1. Machine Certificates (Personal Store)

# List machine certificates with private keys
Get-ChildItem Cert:\LocalMachine\My |
  Where-Object { $_.HasPrivateKey } |
  Select-Object Subject, Thumbprint, NotAfter

# List certificates with Client Authentication EKU
Get-ChildItem Cert:\LocalMachine\My |
  Where-Object {
    $_.HasPrivateKey -and
    $_.EnhancedKeyUsageList.FriendlyName -contains "Client Authentication"
  } |
  Format-List Subject, Issuer, Thumbprint, NotBefore, NotAfter

5.2. Trusted Root CA Store

# Validate Root CA in Trusted Root store
Get-ChildItem Cert:\LocalMachine\Root |
  Where-Object { $_.Subject -match "HOME-ROOT-CA" } |
  Select Subject, Thumbprint, NotAfter

5.3. Intermediate CA Store

# Validate Intermediate CA
Get-ChildItem Cert:\LocalMachine\CA |
  Where-Object { $_.Subject -match "Issuing" } |
  Select Subject, Thumbprint, NotAfter

5.4. Expiring Certificates (Next 60 Days)

Get-ChildItem Cert:\LocalMachine\My |
  Where-Object { $_.NotAfter -lt (Get-Date).AddDays(60) } |
  Select-Object Subject, Thumbprint, NotAfter

6. Certificate Chain Verification

6.1. Verify Full Chain

# Verify machine cert against CA chain
openssl verify -CAfile /etc/ssl/certs/HOME-ROOT-CA.pem /etc/ssl/certs/machine.crt

# Verify with intermediate CA
openssl verify -CAfile /etc/ssl/certs/ca-chain.pem /etc/ssl/certs/machine.crt

6.2. Build Certificate Chain File

# Combine intermediate and root into chain file
cat intermediate-ca.crt root-ca.crt > /etc/ssl/certs/ca-chain.pem

# Verify chain is complete
openssl verify -CAfile /etc/ssl/certs/ca-chain.pem /etc/ssl/certs/machine.crt

7. Private Key Operations

7.1. Verify Key Matches Certificate

# Compare modulus hashes (must match)
CERT_MOD=$(openssl x509 -in /etc/ssl/certs/machine.crt -noout -modulus | md5sum | cut -d' ' -f1)
KEY_MOD=$(openssl rsa -in /etc/ssl/private/machine.key -noout -modulus | md5sum | cut -d' ' -f1)

if [ "$CERT_MOD" = "$KEY_MOD" ]; then
    echo "Key matches certificate"
else
    echo "ERROR: Key does NOT match certificate!"
fi

7.2. Check Key Type and Size

# Key type and size
openssl rsa -in /etc/ssl/private/machine.key -text -noout | head -1
# Should show: RSA Private-Key: (2048 bit) or similar

# Check if key is encrypted
openssl rsa -in /etc/ssl/private/machine.key -check -noout
# If encrypted, will prompt for passphrase

7.3. Remove Passphrase from Key

# Remove passphrase (required for wpa_supplicant)
openssl rsa -in /etc/ssl/private/machine.key -out /etc/ssl/private/machine-nopass.key

# Set correct permissions
sudo chmod 600 /etc/ssl/private/machine-nopass.key
sudo chown root:root /etc/ssl/private/machine-nopass.key

8. Certificate Format Conversion

8.1. PFX/PKCS#12 to PEM

# Extract certificate (no private key)
openssl pkcs12 -in machine.pfx -out /etc/ssl/certs/machine.crt -clcerts -nokeys

# Extract private key (unencrypted)
openssl pkcs12 -in machine.pfx -out /etc/ssl/private/machine.key -nocerts -nodes

# Extract CA certificates
openssl pkcs12 -in machine.pfx -out /etc/ssl/certs/ca-chain.crt -cacerts -nokeys

8.2. PEM to PFX/PKCS#12

# Combine cert and key into PFX
openssl pkcs12 -export \
  -in /etc/ssl/certs/machine.crt \
  -inkey /etc/ssl/private/machine.key \
  -certfile /etc/ssl/certs/ca-chain.crt \
  -out machine.pfx

8.3. DER to PEM

# Convert DER to PEM
openssl x509 -in cert.der -inform DER -out cert.pem -outform PEM

# Convert PEM to DER
openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER

9. Controlled Certificate Removal

Removal is intended for troubleshooting and validation only. Target certificates by explicit thumbprint. Never use wildcards in production.

9.1. Linux

# Remove from system trust store
sudo rm /usr/local/share/ca-certificates/old-ca.crt
sudo update-ca-certificates --fresh

# Remove machine certificate
sudo rm {cert-dir}/machine.crt
sudo rm {key-dir}/machine.key

9.2. Windows (PowerShell)

# Remove from Personal store (by thumbprint)
Remove-Item Cert:\LocalMachine\My\<THUMBPRINT>

# Remove from Trusted Root store
Remove-Item Cert:\LocalMachine\Root\<THUMBPRINT>

# Remove from Intermediate CA store
Remove-Item Cert:\LocalMachine\CA\<THUMBPRINT>

10. Certificate Expiration Monitoring

10.1. Check Days Until Expiration

#!/bin/bash
# check-cert-expiry.sh - Monitor certificate expiration

CERT="/etc/ssl/certs/machine.crt"
WARN_DAYS=30

EXPIRY=$(openssl x509 -in "$CERT" -noout -enddate | cut -d= -f2)
EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s)
NOW_EPOCH=$(date +%s)
DAYS_LEFT=$(( ($EXPIRY_EPOCH - $NOW_EPOCH) / 86400 ))

echo "Certificate: $CERT"
echo "Expires: $EXPIRY"
echo "Days remaining: $DAYS_LEFT"

if [ $DAYS_LEFT -lt $WARN_DAYS ]; then
    echo "WARNING: Certificate expires in less than $WARN_DAYS days!"
    exit 1
fi

10.2. Cron Job for Monitoring

# Add to crontab - check weekly
0 8 * * 1 /usr/local/bin/check-cert-expiry.sh || echo "Certificate expiring soon!" | mail -s "Cert Alert" admin@example.com

11. Quick Reference

Task Command

Task	Command
View certificate details	`openssl x509 -in cert.pem -text -noout`
Check validity dates	`openssl x509 -in cert.pem -noout -dates`
Verify key matches cert	Compare modulus md5sums (see above)
Pull ISE chain	`openssl s_client -connect ise:443 -showcerts`
Convert PFX to PEM	`openssl pkcs12 -in file.pfx -out file.pem -nodes`
Check EKU	`openssl x509 -in cert.pem -noout -purpose`
Check expiration	`openssl x509 -in cert.pem -checkend 2592000`

View certificate details

openssl x509 -in cert.pem -text -noout

Check validity dates

openssl x509 -in cert.pem -noout -dates

Verify key matches cert

Compare modulus md5sums (see above)

Pull ISE chain

openssl s_client -connect ise:443 -showcerts

Convert PFX to PEM

openssl pkcs12 -in file.pfx -out file.pem -nodes

Check EKU

openssl x509 -in cert.pem -noout -purpose

Check expiration

openssl x509 -in cert.pem -checkend 2592000