Listing all certificates issued by step-ca?

[eamontaf]

I am looking for a way to list all the issued certificates including serial number, preferably with the ability to filter on things like revocation status and validity. I do not see a way to do this with step-cli. I further tried to read certificates from a postgres db backing a test instance of stepca and I haven't yet figured out the encoding used for the key-value pairs. If anyone knows of a way to read this info directly with step-cli or by reading the database, I'd appreciate any info you can provide.

[tashian]

Hi! Good question.

There's a few options here:

• You could have a process tail the CA logs (all of the PEM objects will be there)
• You could ETL certs from the database, but we don't have any code that specifically does that so you'd need to write something
• You could link your CA to a smallstep.com account, and you'll get a list of certs there (you keep your signing keys)
• We are working on a step-ca Pro version, for commercial use, and it includes a complete SQL schema for certificate storage (rather than key-value blobs). Schedule time to talk with us if you think this might be interesting.

[lukasz-lobocki]

Hi, you may try using step-badger.