From 0dae8b61facbd777f3de53fd064cc2c4bc348ba0 Mon Sep 17 00:00:00 2001
From: Endi Sukma Dewata <edewata@redhat.com>
Date: Thu, 7 Jun 2012 01:14:40 -0500
Subject: [PATCH] Added cert revocation CLI.

The cert revocation CLI provides a tool to revoke and unrevoke certificates.

Ticket #161
---
 base/common/src/CMakeLists.txt                     |    7 +
 .../src/com/netscape/cms/client/cert/CertCLI.java  |  135 ++++++++++++++++++++
 .../com/netscape/cms/client/cert/CertFindCLI.java  |   66 ++++++++++
 .../com/netscape/cms/client/cert/CertHoldCLI.java  |   84 ++++++++++++
 .../cms/client/cert/CertReleaseHoldCLI.java        |   60 +++++++++
 .../netscape/cms/client/cert/CertRestClient.java   |   69 ++++++++++
 .../netscape/cms/client/cert/CertRevokeCLI.java    |  134 +++++++++++++++++++
 .../com/netscape/cms/client/cert/CertShowCLI.java  |   92 +++++++++++++
 .../src/com/netscape/cms/client/cli/MainCLI.java   |    4 +-
 base/setup/pki                                     |    2 +
 10 files changed, 652 insertions(+), 1 deletions(-)
 create mode 100644 base/common/src/com/netscape/cms/client/cert/CertCLI.java
 create mode 100644 base/common/src/com/netscape/cms/client/cert/CertFindCLI.java
 create mode 100644 base/common/src/com/netscape/cms/client/cert/CertHoldCLI.java
 create mode 100644 base/common/src/com/netscape/cms/client/cert/CertReleaseHoldCLI.java
 create mode 100644 base/common/src/com/netscape/cms/client/cert/CertRestClient.java
 create mode 100644 base/common/src/com/netscape/cms/client/cert/CertRevokeCLI.java
 create mode 100644 base/common/src/com/netscape/cms/client/cert/CertShowCLI.java

diff --git a/base/common/src/CMakeLists.txt b/base/common/src/CMakeLists.txt
index 0a6fb8ad3866e2fb3c3e94dc7b14aa63ea819ce9..4c275009be016a83a823476abac091070edeb464 100644
--- a/base/common/src/CMakeLists.txt
+++ b/base/common/src/CMakeLists.txt
@@ -460,6 +460,13 @@ set(pki-certsrv_java_SRCS
 set(pki-cms_java_SRCS
     com/netscape/cms/client/cli/CLI.java
     com/netscape/cms/client/cli/MainCLI.java
+    com/netscape/cms/client/cert/CertCLI.java
+    com/netscape/cms/client/cert/CertFindCLI.java
+    com/netscape/cms/client/cert/CertHoldCLI.java
+    com/netscape/cms/client/cert/CertReleaseHoldCLI.java
+    com/netscape/cms/client/cert/CertRestClient.java
+    com/netscape/cms/client/cert/CertRevokeCLI.java
+    com/netscape/cms/client/cert/CertShowCLI.java
     com/netscape/cms/client/group/GroupAddCLI.java
     com/netscape/cms/client/group/GroupAddMemberCLI.java
     com/netscape/cms/client/group/GroupFindMemberCLI.java
diff --git a/base/common/src/com/netscape/cms/client/cert/CertCLI.java b/base/common/src/com/netscape/cms/client/cert/CertCLI.java
new file mode 100644
index 0000000000000000000000000000000000000000..1530899abbbd699afdcb40cb5683c4c7fb74c6e1
--- /dev/null
+++ b/base/common/src/com/netscape/cms/client/cert/CertCLI.java
@@ -0,0 +1,135 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cms.client.cert;
+
+import java.util.Arrays;
+
+import org.apache.commons.lang.StringUtils;
+import org.jboss.resteasy.plugins.providers.atom.Link;
+
+import com.netscape.cms.client.cli.CLI;
+import com.netscape.cms.client.cli.MainCLI;
+import com.netscape.cms.servlet.cert.model.CertDataInfo;
+import com.netscape.cms.servlet.cert.model.CertificateData;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class CertCLI extends CLI {
+
+    public MainCLI parent;
+    public CertRestClient client;
+
+    public CertCLI(MainCLI parent) {
+        super("cert", "Certificate management commands");
+        this.parent = parent;
+
+        addModule(new CertFindCLI(this));
+        addModule(new CertShowCLI(this));
+
+        addModule(new CertRevokeCLI(this));
+        addModule(new CertHoldCLI(this));
+        addModule(new CertReleaseHoldCLI(this));
+    }
+
+    public void printHelp() {
+
+        System.out.println("Commands:");
+
+        int leftPadding = 1;
+        int rightPadding = 25;
+
+        for (CLI module : modules.values()) {
+            String label = name + "-" + module.getName();
+
+            int padding = rightPadding - leftPadding - label.length();
+            if (padding < 1)
+                padding = 1;
+
+            System.out.print(StringUtils.repeat(" ", leftPadding));
+            System.out.print(label);
+            System.out.print(StringUtils.repeat(" ", padding));
+            System.out.println(module.getDescription());
+        }
+    }
+
+    public void execute(String[] args) throws Exception {
+
+        client = new CertRestClient(parent.url + "/pki", parent.certNickname);
+
+        String command = args[0];
+        String[] commandArgs = Arrays.copyOfRange(args, 1, args.length);
+
+        if (command == null) {
+            printHelp();
+            System.exit(1);
+        }
+
+        CLI module = getModule(command);
+        if (module != null) {
+            module.execute(commandArgs);
+
+        } else {
+            System.err.println("Error: Invalid command \"" + command + "\"");
+            printHelp();
+            System.exit(1);
+        }
+    }
+
+    public static void printCertInfo(CertDataInfo info) {
+        System.out.println("  Serial Number: "+info.getID().toHexString());
+        System.out.println("  Subject DN: "+info.getSubjectDN());
+        System.out.println("  Status: "+info.getStatus());
+
+        Link link = info.getLink();
+        if (verbose && link != null) {
+            System.out.println("  Link: " + link.getHref());
+        }
+    }
+
+    public static void printCertData(
+            CertificateData certData,
+            boolean showPrettyPrint,
+            boolean showEncoded) {
+
+        System.out.println("  Serial Number: " + certData.getSerialNumber().toHexString());
+        System.out.println("  Issuer: " + certData.getIssuerDN());
+        System.out.println("  Subject: " + certData.getSubjectDN());
+        System.out.println("  Status: "+certData.getStatus());
+        System.out.println("  Not Before: "+certData.getNotBefore());
+        System.out.println("  Not After: "+certData.getNotAfter());
+
+        Link link = certData.getLink();
+        if (verbose && link != null) {
+            System.out.println("  Link: " + link.getHref());
+        }
+
+        String prettyPrint = certData.getPrettyPrint();
+        if (showPrettyPrint && prettyPrint != null) {
+            System.out.println();
+            System.out.println(prettyPrint);
+        }
+
+        String encoded = certData.getEncoded();
+        if (showEncoded && encoded != null) {
+            System.out.println();
+            System.out.println(encoded);
+        }
+    }
+}
diff --git a/base/common/src/com/netscape/cms/client/cert/CertFindCLI.java b/base/common/src/com/netscape/cms/client/cert/CertFindCLI.java
new file mode 100644
index 0000000000000000000000000000000000000000..32457d6dfb17317482091976e9c6445931851772
--- /dev/null
+++ b/base/common/src/com/netscape/cms/client/cert/CertFindCLI.java
@@ -0,0 +1,66 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cms.client.cert;
+
+import com.netscape.cms.client.cli.CLI;
+import com.netscape.cms.client.cli.MainCLI;
+import com.netscape.cms.servlet.cert.model.CertDataInfo;
+import com.netscape.cms.servlet.cert.model.CertDataInfos;
+import com.netscape.cms.servlet.cert.model.CertSearchData;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class CertFindCLI extends CLI {
+
+    public CertCLI parent;
+
+    public CertFindCLI(CertCLI parent) {
+        super("find", "Find certificates");
+        this.parent = parent;
+    }
+
+    public void printHelp() {
+        formatter.printHelp(parent.name + "-" + name + " [OPTIONS...]", options);
+    }
+
+    public void execute(String[] args) throws Exception {
+
+        CertSearchData searchData = new CertSearchData();
+        searchData.setSerialNumberRangeInUse(true);
+
+        CertDataInfos certs = parent.client.findCerts(searchData);
+
+        MainCLI.printMessage(certs.getCertInfos().size() + " certificate(s) matched");
+
+        boolean first = true;
+
+        for (CertDataInfo cert : certs.getCertInfos()) {
+            if (first) {
+                first = false;
+            } else {
+                System.out.println();
+            }
+
+            CertCLI.printCertInfo(cert);
+        }
+
+        MainCLI.printMessage("Number of entries returned " + certs.getCertInfos().size());
+    }
+}
diff --git a/base/common/src/com/netscape/cms/client/cert/CertHoldCLI.java b/base/common/src/com/netscape/cms/client/cert/CertHoldCLI.java
new file mode 100644
index 0000000000000000000000000000000000000000..8478a94553293c0d30fcdafbbce3eeb4e5a1c0cd
--- /dev/null
+++ b/base/common/src/com/netscape/cms/client/cert/CertHoldCLI.java
@@ -0,0 +1,84 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cms.client.cert;
+
+import netscape.security.x509.RevocationReason;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+
+import com.netscape.certsrv.dbs.certdb.CertId;
+import com.netscape.cms.client.cli.CLI;
+import com.netscape.cms.client.cli.MainCLI;
+import com.netscape.cms.servlet.cert.model.CertRevokeRequest;
+import com.netscape.cms.servlet.cert.model.CertificateData;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class CertHoldCLI extends CLI {
+
+    public CertCLI parent;
+
+    public CertHoldCLI(CertCLI parent) {
+        super("hold", "Place certificate on-hold");
+        this.parent = parent;
+    }
+
+    public void printHelp() {
+        formatter.printHelp(parent.name + "-" + name + " <Serial Number> [OPTIONS...]", options);
+    }
+
+    public void execute(String[] args) throws Exception {
+
+        Option option = new Option(null, "comments", true, "Holding comments");
+        option.setArgName("comments");
+        options.addOption(option);
+
+        CommandLine cmd = null;
+
+        try {
+            cmd = parser.parse(options, args);
+
+        } catch (Exception e) {
+            System.err.println("Error: " + e.getMessage());
+            printHelp();
+            System.exit(1);
+        }
+
+        String[] cmdArgs = cmd.getArgs();
+
+        if (cmdArgs.length != 1) {
+            printHelp();
+            System.exit(1);
+        }
+
+        CertId certID = new CertId(cmdArgs[0]);
+
+        CertRevokeRequest request = new CertRevokeRequest();
+        request.setReason(RevocationReason.CERTIFICATE_HOLD);
+        request.setComments(cmd.getOptionValue("comments"));
+
+        CertificateData certData = parent.client.revokeCert(certID, request);
+
+        MainCLI.printMessage("Placed certificate \"" + certID.toHexString() + "\" on-hold");
+
+        CertCLI.printCertData(certData, false, false);
+    }
+}
diff --git a/base/common/src/com/netscape/cms/client/cert/CertReleaseHoldCLI.java b/base/common/src/com/netscape/cms/client/cert/CertReleaseHoldCLI.java
new file mode 100644
index 0000000000000000000000000000000000000000..ca2af7e4606da6f0c2e0dcff10cbd3c336eb8700
--- /dev/null
+++ b/base/common/src/com/netscape/cms/client/cert/CertReleaseHoldCLI.java
@@ -0,0 +1,60 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cms.client.cert;
+
+import com.netscape.certsrv.dbs.certdb.CertId;
+import com.netscape.cms.client.cli.CLI;
+import com.netscape.cms.client.cli.MainCLI;
+import com.netscape.cms.servlet.cert.model.CertUnrevokeRequest;
+import com.netscape.cms.servlet.cert.model.CertificateData;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class CertReleaseHoldCLI extends CLI {
+
+    public CertCLI parent;
+
+    public CertReleaseHoldCLI(CertCLI parent) {
+        super("release-hold", "Place certificate off-hold");
+        this.parent = parent;
+    }
+
+    public void printHelp() {
+        formatter.printHelp(parent.name + "-" + name + " <Serial Number> [OPTIONS...]", options);
+    }
+
+    public void execute(String[] args) throws Exception {
+
+        if (args.length != 1) {
+            printHelp();
+            System.exit(1);
+        }
+
+        CertId certID = new CertId(args[0]);
+
+        CertUnrevokeRequest request = new CertUnrevokeRequest();
+
+        CertificateData certData = parent.client.unrevokeCert(certID, request);
+
+        MainCLI.printMessage("Placed certificate \"" + certID.toHexString() + "\" off-hold");
+
+        CertCLI.printCertData(certData, false, false);
+    }
+}
diff --git a/base/common/src/com/netscape/cms/client/cert/CertRestClient.java b/base/common/src/com/netscape/cms/client/cert/CertRestClient.java
new file mode 100644
index 0000000000000000000000000000000000000000..cd171b194cd302a929307ba690fcb23d1fbdc474
--- /dev/null
+++ b/base/common/src/com/netscape/cms/client/cert/CertRestClient.java
@@ -0,0 +1,69 @@
+//--- BEGIN COPYRIGHT BLOCK ---
+//This program is free software; you can redistribute it and/or modify
+//it under the terms of the GNU General Public License as published by
+//the Free Software Foundation; version 2 of the License.
+//
+//This program is distributed in the hope that it will be useful,
+//but WITHOUT ANY WARRANTY; without even the implied warranty of
+//MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//GNU General Public License for more details.
+//
+//You should have received a copy of the GNU General Public License along
+//with this program; if not, write to the Free Software Foundation, Inc.,
+//51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+//(C) 2012 Red Hat, Inc.
+//All rights reserved.
+//--- END COPYRIGHT BLOCK ---
+package com.netscape.cms.client.cert;
+
+import java.net.URISyntaxException;
+
+import com.netscape.certsrv.dbs.certdb.CertId;
+import com.netscape.cms.servlet.cert.CertResource;
+import com.netscape.cms.servlet.cert.CertsResource;
+import com.netscape.cms.servlet.cert.model.CertDataInfos;
+import com.netscape.cms.servlet.cert.model.CertRevokeRequest;
+import com.netscape.cms.servlet.cert.model.CertSearchData;
+import com.netscape.cms.servlet.cert.model.CertUnrevokeRequest;
+import com.netscape.cms.servlet.cert.model.CertificateData;
+import com.netscape.cms.servlet.csadmin.CMSRestClient;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class CertRestClient extends CMSRestClient {
+
+    public CertResource certClient;
+    public CertsResource certsClient;
+
+    public CertRestClient(String baseUri) throws URISyntaxException {
+        this(baseUri, null);
+    }
+
+    public CertRestClient(String baseUri, String nickname) throws URISyntaxException {
+        super(baseUri);
+
+        certClient = createProxy(CertResource.class);
+        certsClient = createProxy(CertsResource.class);
+    }
+
+    public CertificateData getCert(CertId id) {
+        return certClient.getCert(id);
+    }
+
+    public CertDataInfos findCerts(CertSearchData searchData) {
+        return certsClient.searchCerts(
+                searchData,
+                CertsResource.DEFAULT_MAXRESULTS,
+                CertsResource.DEFAULT_MAXTIME);
+    }
+
+    public CertificateData revokeCert(CertId id, CertRevokeRequest request) {
+        return certClient.revokeCert(id, request);
+    }
+
+    public CertificateData unrevokeCert(CertId id, CertUnrevokeRequest request) {
+        return certClient.unrevokeCert(id, request);
+    }
+}
diff --git a/base/common/src/com/netscape/cms/client/cert/CertRevokeCLI.java b/base/common/src/com/netscape/cms/client/cert/CertRevokeCLI.java
new file mode 100644
index 0000000000000000000000000000000000000000..f166b7cef323370d5b23fa517f96aa61449c7772
--- /dev/null
+++ b/base/common/src/com/netscape/cms/client/cert/CertRevokeCLI.java
@@ -0,0 +1,134 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cms.client.cert;
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+
+import netscape.security.x509.RevocationReason;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+
+import com.netscape.certsrv.dbs.certdb.CertId;
+import com.netscape.cms.client.cli.CLI;
+import com.netscape.cms.client.cli.MainCLI;
+import com.netscape.cms.servlet.cert.model.CertRevokeRequest;
+import com.netscape.cms.servlet.cert.model.CertificateData;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class CertRevokeCLI extends CLI {
+
+    public CertCLI parent;
+
+    public CertRevokeCLI(CertCLI parent) {
+        super("revoke", "Revoke certificate");
+        this.parent = parent;
+    }
+
+    public void printHelp() {
+        formatter.printHelp(parent.name + "-" + name + " <Serial Number> [OPTIONS...]", options);
+    }
+
+    public void execute(String[] args) throws Exception {
+
+        StringBuilder sb = new StringBuilder();
+
+        for (RevocationReason reason : RevocationReason.REASONS_BY_CODE.values()) {
+            if (sb.length() > 0) {
+                sb.append(", ");
+            }
+            sb.append(reason);
+            if (reason == RevocationReason.UNSPECIFIED) {
+                sb.append(" (default)");
+            }
+        }
+
+        Option option = new Option(null, "reason", true, "Revocation reason: " + sb);
+        option.setArgName("reason");
+        options.addOption(option);
+
+        option = new Option(null, "comments", true, "Revocation comments");
+        option.setArgName("comments");
+        options.addOption(option);
+
+        options.addOption(null, "force", false, "Force");
+
+        CommandLine cmd = null;
+
+        try {
+            cmd = parser.parse(options, args);
+
+        } catch (Exception e) {
+            System.err.println("Error: " + e.getMessage());
+            printHelp();
+            System.exit(1);
+        }
+
+        String[] cmdArgs = cmd.getArgs();
+
+        if (cmdArgs.length != 1) {
+            printHelp();
+            System.exit(1);
+        }
+
+        CertId certID = new CertId(cmdArgs[0]);
+
+        String string = cmd.getOptionValue("reason", RevocationReason.UNSPECIFIED.toString());
+        RevocationReason reason = RevocationReason.valueOf(string);
+
+        if (reason == null) {
+            System.err.println("Error: Invalid revocation reason: "+string);
+            printHelp();
+            System.exit(1);
+            return;
+        }
+
+        if (!cmd.hasOption("force") && reason != RevocationReason.CERTIFICATE_HOLD) {
+            CertificateData certData = parent.client.getCert(certID);
+            System.out.println("Revoking certificate:");
+            CertCLI.printCertData(certData, false, false);
+            System.out.print("Are you sure (Y/N)? ");
+            System.out.flush();
+
+            BufferedReader reader = new BufferedReader(new InputStreamReader(System.in));
+            String line = reader.readLine();
+            if (!line.equalsIgnoreCase("Y")) {
+                System.exit(1);
+                return;
+            }
+        }
+
+        CertRevokeRequest request = new CertRevokeRequest();
+        request.setReason(reason);
+        request.setComments(cmd.getOptionValue("comments"));
+
+        CertificateData certData = parent.client.revokeCert(certID, request);
+
+        if (reason == RevocationReason.CERTIFICATE_HOLD) {
+            MainCLI.printMessage("Placed certificate \"" + certID.toHexString() + "\" on-hold");
+        } else {
+            MainCLI.printMessage("Revoked certificate \"" + certID.toHexString() + "\"");
+        }
+
+        CertCLI.printCertData(certData, false, false);
+    }
+}
diff --git a/base/common/src/com/netscape/cms/client/cert/CertShowCLI.java b/base/common/src/com/netscape/cms/client/cert/CertShowCLI.java
new file mode 100644
index 0000000000000000000000000000000000000000..2815e0254eb93f9cbea64ca3fe113f287a1dd9f4
--- /dev/null
+++ b/base/common/src/com/netscape/cms/client/cert/CertShowCLI.java
@@ -0,0 +1,92 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cms.client.cert;
+
+import java.io.FileWriter;
+import java.io.PrintWriter;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+
+import com.netscape.certsrv.dbs.certdb.CertId;
+import com.netscape.cms.client.cli.CLI;
+import com.netscape.cms.servlet.cert.model.CertificateData;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class CertShowCLI extends CLI {
+
+    public CertCLI parent;
+
+    public CertShowCLI(CertCLI parent) {
+        super("show", "Show certificate");
+        this.parent = parent;
+    }
+
+    public void printHelp() {
+        formatter.printHelp(parent.name + "-" + name + " <Serial Number> [OPTIONS...]", options);
+    }
+
+    public void execute(String[] args) throws Exception {
+
+        Option option = new Option(null, "output", true, "Output file");
+        option.setArgName("file");
+        options.addOption(option);
+
+        options.addOption(null, "pretty", false, "Pretty print");
+        options.addOption(null, "encoded", false, "Base-64 encoded");
+
+        CommandLine cmd = null;
+
+        try {
+            cmd = parser.parse(options, args);
+
+        } catch (Exception e) {
+            System.err.println("Error: " + e.getMessage());
+            printHelp();
+            System.exit(1);
+        }
+
+        boolean showPrettyPrint = cmd.hasOption("pretty");
+        boolean showEncoded = cmd.hasOption("encoded");
+
+        String[] cmdArgs = cmd.getArgs();
+
+        if (cmdArgs.length != 1) {
+            printHelp();
+            System.exit(1);
+        }
+
+        CertId certID = new CertId(args[0]);
+        String file = cmd.getOptionValue("output");
+
+        CertificateData certData = parent.client.getCert(certID);
+
+        String encoded = certData.getEncoded();
+        if (encoded != null && file != null) {
+            // store cert to file
+            PrintWriter out = new PrintWriter(new FileWriter(file));
+            out.print(encoded);
+            out.close();
+        }
+
+        CertCLI.printCertData(certData, showPrettyPrint, showEncoded);
+    }
+}
diff --git a/base/common/src/com/netscape/cms/client/cli/MainCLI.java b/base/common/src/com/netscape/cms/client/cli/MainCLI.java
index 4932fb183b3bff34c5a61b40b2e221df06124ae0..55cac0b64b51a5479649de7e1fa1780ad87eb350 100644
--- a/base/common/src/com/netscape/cms/client/cli/MainCLI.java
+++ b/base/common/src/com/netscape/cms/client/cli/MainCLI.java
@@ -26,6 +26,7 @@ import org.mozilla.jss.crypto.AlreadyInitializedException;
 import org.mozilla.jss.crypto.CryptoToken;
 import org.mozilla.jss.util.Password;
 
+import com.netscape.cms.client.cert.CertCLI;
 import com.netscape.cms.client.group.GroupCLI;
 import com.netscape.cms.client.user.UserCLI;
 
@@ -48,8 +49,9 @@ public class MainCLI extends CLI {
     public MainCLI() throws Exception {
         super("pki", "PKI command-line interface");
 
-        addModule(new UserCLI(this));
+        addModule(new CertCLI(this));
         addModule(new GroupCLI(this));
+        addModule(new UserCLI(this));
     }
 
     public String getProtocol() {
diff --git a/base/setup/pki b/base/setup/pki
index f4ab1a4fc22af66d0d6e149d54739a12974f9d29..81ddc898c6df314a2c636539c4452ca65a06c5e6 100755
--- a/base/setup/pki
+++ b/base/setup/pki
@@ -73,10 +73,12 @@ if( $ARCHITECTURE eq "i386" ) {
 
 $ENV{CLASSPATH} = "/usr/share/java/${PRODUCT}/pki-certsrv.jar:"
                 . "/usr/share/java/${PRODUCT}/pki-cms.jar:"
+                . "/usr/share/java/${PRODUCT}/pki-nsutil.jar:"
                 . "/usr/share/java/apache-commons-cli.jar:"
                 . "/usr/share/java/apache-commons-lang.jar:"
                 . "/usr/share/java/commons-httpclient.jar:"
                 . "/usr/share/java/httpcomponents/httpclient.jar:"
+                . "/usr/share/java/jaxb-api.jar:"
                 . "/usr/share/java/resteasy/jaxrs-api.jar:"
                 . "/usr/share/java/resteasy/resteasy-atom-provider.jar:"
                 . "/usr/share/java/resteasy/resteasy-jaxb-provider.jar:"
-- 
1.7.7.6

