Certum Certificate Manager 2.4.2

Interactive Bash certificate manager for the Certum Partner API described by API User Guide 5.19.

What changed in 2.4.2

• Fixed the Manage order browser when Reports showed valid order IDs but Manage displayed an empty list.
• Reports and Manage now share a persistent order cache at ~/.certum-certificate-manager/orders.tsv.
• The order index parser now starts from the same Order ID XPath used by the working report fallback, improving compatibility with xmllint-only systems.
• If a report row contains only an Order ID, Manage retrieves getOrderByOrderID automatically and enriches the row with status, product, customer and certificate details.
• A successful Orders or Modified Orders report automatically adds its returned order IDs to the Manage inventory.
• The cache is stored with mode 0600 inside the existing 0700 state directory where supported.
• The Bash source remains strictly ASCII-only to avoid ambiguous Unicode warnings in Git clients.

Shared Reports and Manage order inventory

The order list used by Manage is no longer independent from Reports.

Whenever an Orders or Modified Orders report succeeds, every returned Order ID is merged into:

~/.certum-certificate-manager/orders.tsv

When Manage opens, the manager combines this cache with a fresh getOrdersByDateRange query. Duplicate Order IDs are removed. If Certum returned only an Order ID in a report row, the manager retrieves the single order with getOrderByOrderID so the selection screen can show useful details such as status, product, customer, Common Name and certificate status.

This also means an Order ID that was visible in Reports remains selectable from Manage after returning to the main menu and across later sessions.

Persistent username profile

The interactive manager now maintains a non-secret user profile at:

~/.certum-certificate-manager/config

The profile is automatically checked and loaded on every start. It stores the partner username and non-secret operator defaults. It never stores the Certum password or a password-file path.

Example:

# Certum Certificate Manager persistent profile
# No password or password-file path is stored here.
username=partner@example.com
environment=production
csr_store=/home/user/.certum-certificate-manager/csr
customer_profile_store=/home/user/.certum-certificate-manager/customer-profiles
order_browser_from_date=2000-01-01

The directory is created with mode 0700 and the profile with mode 0600 where supported by the filesystem.

When the username is entered for the first time, or changed under Settings, it is written to this profile. The next start therefore needs only the password.

Session-only password

In interactive mode, the password is requested only when the first authenticated API action is performed. It is copied into a temporary file with mode 0600 inside the manager's temporary session directory.

The same temporary password is reused for the rest of the running session. The entire temporary directory is deleted by the existing EXIT/INT/TERM cleanup handler when the manager exits.

The password itself is never written to ~/.certum-certificate-manager/config.

CLI automation still supports --password-file and CERTUM_PASSWORD_FILE explicitly. When such a source is used from the interactive manager, its value is copied into the temporary session credential file before API calls.

Browse and select orders instead of typing an Order ID

The main menu now contains:

Browse all orders and select one to manage

Selecting this action no longer immediately asks for an Order ID. The manager calls the Certum order report with order status, order details, and certificate details enabled, retrieves every reported page, and builds a selectable order browser.

A row looks like:

ORD-2026-00123   2026-08-10 | ENROLLED | Commercial SSL | customer-123 | CN: www.example.com | Cert: VALID
ORD-2026-00122   2026-08-10 | VERIFICATION | Trusted SSL | customer-122

The real Certum Order ID is displayed as the selectable item. The description contains the most useful details that are available in the report:

• order date
• order status
• product name
• customer identifier
• certificate Common Name when issued
• certificate status when issued

The browser shows 14 orders per screen with Previous and Next navigation. It also supports searching across Order ID, customer, Common Name, and serial number. Manual Order ID entry remains available as a fallback.

Full report pagination

Certum's getOrdersByDateRange API is date-range based and returns at most 100 orders per page. The manager starts with the configured order_browser_from_date, default 2000-01-01, through the current date and automatically retrieves all pages reported by Certum.

The Partner API exposes page numbers 1 through 100. If one broad query reaches that paging ceiling, or Certum returns error 1154 for too many records, the manager automatically retries the order index year by year to avoid silently hiding older orders behind the single-range limit.

The start date can be changed in the persistent profile:

order_browser_from_date=2020-01-01

or in an explicit Bash configuration:

CERTUM_ORDER_BROWSER_FROM_DATE='2020-01-01'

Start screen

The start screen shows the active environment and saved username without revealing the password:

Environment:       PRODUCTION
Username:          partner@example.com
Credentials:       username configured; password will be requested when needed
User profile:      /home/user/.certum-certificate-manager/config (loaded automatically)
Config override:   none
Customer profiles: 7 saved

After the first authenticated action in the session, the credential state changes to indicate a temporary session password is loaded.

Customer CSR subject profiles

Reusable customer subject profiles remain stored under:

~/.certum-certificate-manager/customer-profiles

A profile stores standard subject data such as:

• Organization, O
• Organizational Unit, OU
• Locality, L
• State or Province, ST
• Country, C

This allows a colleague to select a customer profile and normally enter only the FQDN and additional SAN values for a new TLS CSR.

CSR and key storage

Generated CSRs and private keys remain stored under:

~/.certum-certificate-manager/csr

The manager keeps the CSR, associated private key, metadata, selected customer profile, FQDNs, and local usage state together.

Certum error 1032 is handled as a used-public-key condition. A CSR/key that Certum reports as already used is retained for audit and key lookup, but it is not offered as a normal reusable key for another Certum issuance.

TLS key profiles

The generator retains these profiles:

ECDSA secp384r1 + SHA-384
ECDSA secp256r1 + SHA-256
RSA 3072-bit + SHA-384
RSA 4096-bit + SHA-384

The normal order wizard also checks the live supportedHashAlgorithms returned for the selected partner product. In partner configurations where a product reports only RSA-SHA256, an ECDSA CSR is stopped before order submission because live testing showed Certum error 2089 for that combination.

API-side preflight

A new certificate request runs validateOrderParameters before quickOrder. The actual order is sent only after the preflight succeeds.

This gives operator-friendly handling for issues such as:

• field-length errors
• customer equal to partner username
• unsupported partner/product algorithm
• already-used public key
• invalid SAN or CSR data

Configuration

The automatic user profile is separate from the optional Bash configuration file accepted through --config or CERTUM_CONFIG_FILE.

The automatic profile contains no secrets. An explicit Bash configuration remains intended for controlled automation and is sourced as Bash, so it should be trusted and protected with mode 0600.

Interactive profile location:

~/.certum-certificate-manager/config

Useful explicit configuration variables include:

CERTUM_ENVIRONMENT=production
CERTUM_USERNAME='partner@example.com'
CERTUM_CSR_STORE_DIR="$HOME/.certum-certificate-manager/csr"
CERTUM_CUSTOMER_PROFILE_DIR="$HOME/.certum-certificate-manager/customer-profiles"
CERTUM_ORDER_BROWSER_FROM_DATE='2000-01-01'

For unattended CLI use only, an external password file remains supported:

CERTUM_PASSWORD_FILE='/secure/path/certum-password'

Start

chmod 750 certum-certificate-manager-v2.4.2.sh
./certum-certificate-manager-v2.4.2.sh --interactive

Version check:

./certum-certificate-manager-v2.4.2.sh --version

Expected:

certum-certificate-manager-v2.4.2.sh 2.4.2, API guide 5.19

Release validation

The 2.4.2 release was checked for:

• Bash syntax with bash -n
• internal SCRIPT_VERSION="2.4.2"
• persistent profile creation
• profile mode 0600 and state-directory mode 0700
• automatic profile reload
• no password or password-file entry in the persistent profile
• temporary session password file mode 0600
• session-directory cleanup on script exit
• parsing of order report data into a selectable order index
• preservation of empty report fields
• selectable real Order IDs rather than internal row numbers
• paging in the terminal order browser
• search by Order ID, customer, Common Name, or serial number
• fallback manual Order ID entry
• automatic retrieval of all API report pages
• year-by-year fallback when a broad order report reaches the API paging ceiling or returns error 1154

Version

SCRIPT_VERSION="2.4.2"

API documentation baseline: Certum Partner API User Guide 5.19.