validatecertificate | Keyfactor Docs

Use the SignClient validatecertificate command to request a certificate to be validated by the specified service.

Command Options

Option	Description
`-cert <cert-file>`	Path to certificate file (DER or PEM). Required.
`-certpurposes <certpurposes>`	A '`,`' separated string containing requested certificate purposes.
`-der`	Certificate is in DER format.
`-help`	Display command option information.
`-hosts <hosts>`	A '`,`' separated string containing the hostnames of the validation service nodes. Required. Example: `'host1.someorg.org,host2.someorg.org'` When using the HTTP protocol, only one host name can be specified.
`-pem`	Certificate is in PEM format (Default).
`-port <port>`	Remote port of service. Default is `8080` or `8442` for SSL.
`-protocol <protocol>`	Protocol to use, either `WEBSERVICES` or `HTTP`. Default: `WEBSERVICES`.
`-service <service-name>`	The name or ID of the validation service to process request. Required.
`-silent`	The command does not produce any output, only returns value.
`-truststore <jks-file>`	Path to JKS truststore containing trusted CA for SSL Server certificates.
`-truststorepwd <password>`	Password to unlock the truststore.

The following values are returned by the program that can be used when scripting:

-2   : Error happened during execution
-1   : Bad arguments
 0   : Certificate is valid
 1   : Certificate is revoked
 2   : Certificate is not yet valid
 3   : Certificate has expired
 4   : Certificate doesn't verify
 5   : CA Certificate has been revoked
 6   : CA Certificate is not yet valid
 7   : CA Certificate has expired
 8   : Certificate has no valid certificate purpose

Example Use Cases

Basic Validation

Validate a PEM-format certificate against a named validation service on localhost, using the default WEBSERVICES protocol:

validatecertificate -service CertValidationWorker -hosts localhost -cert certificate.pem

PEM is the default, so no -pem flag is needed.

HTTPS with Server Certificate Validation

Connect over WEBSERVICES but with HTTPS and validate the server certificate using a truststore. The validation service is identified by its numeric worker ID (5806) rather than a name:

validatecertificate -service 5806 -hosts localhost -cert certificate.pem -truststore p12/truststore.jks -truststorepwd changeit

HTTP Protocol

Explicitly use the HTTP protocol instead of the default WEBSERVICES:

validatecertificate -service CertValidationWorker -hosts localhost -cert certificate.pem -protocol HTTP

When using HTTP, only a single hostname can be specified with -hosts.