Some of you may be interested:
http://adam.younglogic.com/2011/09/talking-to-dogtag-pki-via-curl/
Here's the short of it: once you have an NSS database set up, you can do
something like:
curl --cacert ./CA.crt \
--cert "CA Administrator of Instance pki-ca2's AyoungBostonDevelRedhat
Domain ID" \
https://servername:8443/ca/agent/ca/displayBySerial?serialNumber=0x6 \
--pass freeipa4all