Search the request log in Certificate Manager

This article is valid for Certificate Manager 8.0 and later.

This article describes how to search for specific client requests or audit notifications (that is, events) in the request log within Smart ID Certificate Manager (CM). This task is done in the Administrator's workbench (AWB).

The request log contains information concerning requests made from the different clients to the Certificate Factory (CF) and audit notifications generated by the components of the CF. See Types of logs in the request log in Certificate Manager for further information on the logs that can be viewed.

Prerequisites

The following prerequisites apply:

• An administration officer must sign the request.

• The officer must have the following roles:

  • Use AWB

  • Audit tasks

• A connection to the CM host must have been established (see Connect to a Certificate Manager host).

Step-by-step instruction

Object searches

Object search for Entity

1. In AWB, select Request under the Audit group in the explorer bar. The information pane changes to show the search request utility. To hide the explorer bar, select that option from the View menu, from the toolbar or press F4.

2. Click Object.

3. Select the Entity option.

4. Click the Entity browse button to open the Select an entity window.

5. Highlight the required entity and click OK.

6. Click Search in the Request log window. The applicable results are displayed in the upper right pane of the search utility.

7. To save the search to a text file, click Save Report.

Object search for Certificate

1. In AWB, select Request under the Audit group in the explorer bar. The information pane changes to show the search request utility. To hide the explorer bar, select that option from the View menu, from the toolbar or press F4.

2. Click Object.

3. Select the Certificate option.

4. Click the Certificate browse button to open the Select Certificate window.

5. Check the Serial Number and Subject check boxes as required to search for the user certificate by serial number or subject.

6. Enter the search criteria in the relevant fields and click Search. The search results are displayed in the right-hand pane of the Select Certificate window.

   Details of a highlighted certificate are displayed in the lower Details section of the right-hand pane. The Certificate ID is a decimal string that uniquely represents a certificate in a CM installation. The Certificate Serial Number must be entered as a hexadecimal string and is shown as a hexadecimal string.

7. Highlight the required user certificate and click OK.

8. Click Search in the Request log window. The applicable results are displayed in the upper right pane of the search utility.

9. To save the search to a text file, click Save Report.

Object search for Archived Key

1. In AWB, select Request under the Audit group in the explorer bar. The information pane changes to show the search request utility. To hide the explorer bar, select that option from the View menu, from the toolbar or press F4.

2. Click Object.

3. Select the Archived Key option.

4. Click the Archived Key browse button to open the Select Archived Key window.

5. Check the Serial Number and Subject check boxes as required to search for the user certificate by serial number or subject. You find the archived key by searching for the user certificate.

6. Enter the search criteria in the relevant fields and click Search.

7. Highlight the required user certificate and click OK.

8. Click Search in the Request log window. The applicable results are displayed in the upper right pane of the search utility.

9. To save the search to a text file, click Save Report.

Filter searches

Filter search

• The Category filter can be used in combination with Failed only, Signing Officer and Date & Time filters to further refine the search.

• The Event filter can only be used in combination with the Date & Time filter.

Do the following:

1. In AWB, select Request under the Audit group in the explorer bar. The information pane changes to show the search request utility. To hide the explorer bar, select that option from the View menu, from the toolbar or press F4.

2. Click Filter.

3. Select the Category filter, if required, and select the type of request from the Certificates, Keys, Card Production and Administration categories, by checking the required check boxes.

4. Select the Event filter, if required, and check the components for which audit notifications should be viewed.

5. Select the Failed only filter if only failed requests are required. Note that the Failed only filter cannot be used in conjunction with the Event filter as audit notifications do not contain Success or Failed status information.

6. Select the Signing Officer filter, if required, and then select a specific officer from the drop down list. Leaving the default selection of <any> removes the effect of the filter.

7. Select the Date & Time period for those records you wish to analyze. To modify the date and time, highlight the figures that require modification and either use the up and down arrows or enter the new figure directly.

8. Click Search in the Request logwindow. The applicable results are displayed in the upper right pane of the search utility.

9. Highlight an item in the Results pane to display any available information in the Detail pane. Right-clicking on a highlighted items to produce a shortcut menu for browsing.

10. To initiate further searches, change the request parameters. The Clear button resets the search parameters to their default state.

Results pane

Each result of e filter search is displayed under the following column headers:

• Object - icon identifying the request type or an audit notification

• Description - plain text description of the request type

• Time - showing the date and the time of the request

• Status - the status of the request, either OK or failed

• Signer - the name of the signing officer

• Co-Signer - the name of the second officer when co-signing requests

You can:

• sort the result by any column

• double-click on the column header to set the column width to the best fit

• select any single result to display the details available for that message

• right-click an object and choose Open from the short-cut menu to display additional information

Audit notifications

Audit notifications are displayed in the results pane of the request log.

The Description column contains the notification type in the following format:
Audit - <component> - <notification>

See the "Audit Notifications table" in the Technical Description, which lists all the audit notifications for the different components, selectable in the request log window.

Typical searches

Who issued a certificate to this person, and when?

1. Select Object and then the Certificate options.

2. Click the Certificate browse button to open the Select Certificate window.

3. Check Subject and enter the details of the person to whom the certificate was issued.

4. Click Search.

5. Locate the created certificate request in the Results pane. The issuing officer is shown in the Signer column. The date and time of certificate creation is shown in the Time column.

What information was contained in the request?

Continued from previous steps...

1. Click on the request in the Results pane to highlight it.

2. The request information is shown in the Detail pane.

What information is contained in the certificate?

Continued from previous steps...

1. Right-click on the highlighted request and select the certificate from the view entity window. To see the certificate details, click the Details tab in the Certificate window.

Some certificate details are also available in the Detail pane.

Who requested revocation of a certificate, and when?

1. Select Object and then Certificate.

2. Click the Certificate browse button to open the Select Certificate window.

3. Check Subject and enter the details of the person to who the certificate was issued.

4. Click Search.

5. Locate the revoked certificate request in the Results pane. The revoking officer is shown in the Signer column. The date and time of certificate revocation is shown in the Time column.

Which certificates have been issued/revoked by an officer, and when?

1. Select Filter and check Signing Officer.

2. Select the officer from the drop down list.

3. Check Category, Certificates, Issued and Revoked.

4. Click Search.

5. Click each created certificate and revoked certificate request and view the certificate details for each request in the Detail pane. The date and time of each request is shown in the Time column.

The number of hits in the results pane can be reduced by checking Date & Time and entering the approximate period to be searched.

Who created this CA key, and when?

1. Select Object and then Entity.

2. Click the Entity browse button to open the Select an entity window.

3. Select the required key from the hierarchical list.

4. Click Search.

5. Locate the created key request in the Results pane. The issuing officer is shown in the Signer column. The date and time of key creation is shown in the Time column.

How many times have this key been recovered?

1. Select Object and Archived Key.

2. Click the Archived Key browse button to open the Select Archived Key window.

3. Select, for example, Subject and enter the <Common Name> of the certificate holder.

4. Click Search.

5. The search results will be displayed in the right-hand pane of the Select Archived Key window. Details of a highlighted certificate is displayed in the Detail section. In the Result pane, locate the appropriate certificate and select it.

6. Click OK to return to the Request window where the selected certificate now will appear in the Archived Key box.

7. Click Search.

8. Certificates and events related to the key are listed in the Result pane.

9. Count the entries containing the message text KAR management operation 'Recover' succeed. The sum will tell how many times the key has been recovered.

Which keys have been recovered by this officer?

1. Select Filter.

2. Check Category, Keys and Recovered.

3. Select Signing Officer and click the associated browse button to select the officer of concern.

4. Click Search.

5. The Result pane will contain the objects where the selected signing officer has recovered keys.