SIC certificates can be viewed in the Internal CA Management Tool on the Security Management Server / Domain Management Server:

Follow the steps in sk30501 - Setting up the ICA Management Tool and in sk39915 - Invoking the ICA Management Tool.

SIC certificates can be viewed on the Command Line by running the following command on the Security Management Server / Domain Management Server:

[Expert@HostName_MGMT:0]# cpca_client [-d] lscert -kind SIC [-stat Pending|Valid|Revoked|Expired|Renewed] [-dn <SubString>] [-ser <Serial_Number>] [-dp <DP_Number>]

Note: On Provider-1 / Multi-Domain Security Management Server, this command should be run in the context of the relevant Domain Management Server.

Notes:

• The cpca_client lscert command works only on R65 HFA_50 and above.

• To check only the SIC certificate of the Security Management Server / Domain Management Server itself:

  [Expert@HostName_MGMT:0]# cpca_client lscert -kind SIC | grep -A 2 "CN=cp_mgmt,"

• A SIC Certificate is valid for 5 years from its creation. At the 75% threshold, it will be renewed automatically.

• Currently, there is no SNMP OID that can be queried to check the SIC Certificate expiration date (as a result, there is also no such SNMP Trap).
  The administrator can extend the SNMP by using the relevant shell script to execute the above command.
  Refer to sk90860 - How to configure SNMP on Gaia OS - section "(IV-6) Advanced SNMP configuration - Extend SNMP with shell script"

• The command "fwm printcert -ca internal_ca" can be used for displaying the CA signing certificate details.

Example outputs:

• To check only the SIC certificate of the Security Management Server / Domain Management Server itself:

  [Expert@HostName_MGMT:0]# cpca_client lscert -kind SIC | grep -A 2 "CN=cp_mgmt,"
  Subject = CN=cp_mgmt,O=MGMT..yosa26
  Status = Valid   Kind = SIC   Serial = 39561   DP = 0
  Not_Before: Tue Oct 13 10:33:09 2015   Not_After: Mon Oct 12 10:33:09 2020
  [Expert@mgmt:0]#
  

• To check all the SIC certificates on the Security Management Server / Domain Management Server

  [Expert@HostName_MGMT:0]# cpca_client lscert -kind SIC
  Operation succeeded. rc=0.
  4 certs found.
  
  Subject = CN=mgmt,O=mgmt..bbqdkc
  Status = Valid   Kind = SIC   Serial = 37748   DP = 0
  Not_Before: Sun Apr  3 09:50:11 2011   Not_After: Sat Apr  2 09:50:11 2016
  
  Subject = CN=cp_mgmt,O=mgmt..bbqdkc
  Status = Valid   Kind = SIC   Serial = 42070   DP = 0
  Not_Before: Sun Apr  3 09:50:06 2011   Not_After: Sat Apr  2 09:50:06 2016
  
  Subject = CN=gw,O=mgmt..bbqdkc
  Status = Valid   Kind = SIC   Serial = 10659   DP = 0
  Not_Before: Wed Apr  20 23:42:35 2011   Not_After: Tue Apr  19 23:42:35 2016
  
  Subject = CN=gw,O=mgmt..bbqdkc
  Status = Revoked   Kind = SIC   Serial = 8013   DP = 0
  Not_Before: Sun Apr  3 10:28:55 2011   Not_After: Sat Apr  2 10:28:55 2016
  

Related documentation:

• Command Line Interface (CLI) Reference Guide (R65, R70, R71, R75, R75.20, R75.40, R75.40VS, R76, R77)

Related solutions:

• sk43744 - Automatic SIC renewal mechanism does not function correctly in R70, R70.1 and R70.20