Check Validity and Mapping on UNIX

You can test whether a user or server certificate is valid and determine which identities are allowed to authenticate with that certificate. To be valid, a certificate must be signed by a trusted CA (one that is a member of a chain of trust that extends to a trust anchor that you have configured) and it must pass all other validation checks (for example, it must not be expired or revoked and all required intermediate certificates must be available).

Note: The certificate validation test applies only to end-entity certificates, not CA certificates. Valid CA-signed root and intermediate certificates will not pass the validation test.

To test certificates

Use the pki-val command to test certificates. Refer to these examples:

To	Use this command
Check if the certificate test.crt is valid.	pki-val /path/test.crt
Check if the certificate is valid and if the server abc.com can authenticate with test.crt.	pki-val /path/test.crt -t abc.com
Check if the certificate is valid and if the user joe can authenticate with test.crt.	pki-val /path/test.crt -u joe
See which identities can authenticate with test.crt.	pki-val /path/test.crt -w