Example

 class: OpenXPKI::Server::Workflow::Activity::Tools::SearchCertificates
    param:
        profile: tls_server
        realm: democa
        issuer: YHkkLxEKtqbopNbcFwdBcHqKWPE
        target_key: other_key

Configuration parameters

realm

The realm to search in, default is the current realm, _any searches globally

tenant

The tenant to search for, the default is to use the tenant of the current workflow.

profile

The profile of the certificate, default is all profiles.

entity_only

Boolean, find only certificates issued within this realm. Default is no.

cert_subject

Searches the full DN for an exact match! The '*' as wildcard is supported.

subject_alt_name

Searches in the SAN section, you must prefix the value with the SAN type, e.g. DNS:www.openxpki.org or IP:1.2.3.4. There might be some difficulties with non-ascii strings/encodings.

issuer

The certificate identifier of the issuer

subject_key_identifier

The certificate subject_key_identifier (hex notation with colon)

cert_serial

The certificate serial number (as hex with 0x prefix or integer, separator and casing is handled internally)

meta_*, system_*

Lets you search for any certificate attribute having a listed prefix. You can set the special value <undef> (including the angle brackets) to search for rows without a certain attribute.

target_key

Name of the context value to write the result to, the default is cert_identifier_list resp. cert_identifier when "limit: single" is used.

order

Sort the result, accepts a single column name, optionally prefixed by "asc" (default) or "desc" (reversed sorting)

limit

Limit the size of the result set. If you pass the special word single the result is a scalar with the first identifier matching the query. In case target_key is not set, the value is written to cert_identifier.

include_expired

Parseable OpenXPKI::Datetime value (autodetected), certificates which are expired after the given date are included in the report. Set to _any to include all expired certificates. Default is not to include expired certificates.

include_revoked

If set to a true value, certificates which are not in ISSUED state (revoked, crl pending, on hold) are also included in the report. Default is to show only issued certificates.

valid_at

Parseable OpenXPKI::Datetime value (autodetected) used as base for validity calculation. Default is now.

cutoff_notbefore

Parseable OpenXPKI::Datetime value (autodetected), show only certificates where notebefore is between valid_at and this value. Relative intervals are calculated against the given valid_at date!

cutoff_notafter

Parseable OpenXPKI::Datetime value (autodetected), show certificates where notafter is less than value. Relative intervals are calculated against the given valid_at date!