quaxar-asm-certificates
Get certificates attached to exposed assets from the S2W Quaxar ASM service.
Syntax
Options
- profile=STRING
- Optional. QUAXAR connect profile code. If omitted, an available profile is used automatically.
- value=STRING
- Optional. Serial or CN domain name to search.
- statuses=STRING
- Optional. Comma-separated certificate statuses to filter. Allowed values: VALID, INVALID, SOON_EXPIRED, EXPIRED.
- issuers=STRING
- Optional. Comma-separated certificate issuers.
- orgs=STRING
- Optional. Comma-separated customer organization names.
- sorts=STRING
- Optional. Sort order. Allowed values: detected_time_desc, detected_time_asc, expiration_desc, expiration_asc.
- duration=STRING
- Optional. Scan only recent data. Use s(second), m(minute), h(hour), d(day), mon(month) time unit. e.g. 7d.
- from=STRING
- Optional. Start time of range in yyyyMMddHHmmss format. If you omit the time part, it is padded by zero.
- to=STRING
- Optional. End time of range in yyyyMMddHHmmss format. Cannot be used alone; specify with from or duration.
- pretty=BOOL
- Optional. Set t to enable pretty print with line breaks (default: f).
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | string | Connect profile | Profile name of QUAXAR |
| certificate_id | string | Certificate ID | Certificate unique ID |
| serial | string | Serial | Certificate serial number |
| cn_domain_name | string | CN domain name | Certificate CN domain name |
| detected | date | Detected | Certificate detection time |
| valid_until | date | Valid until | Certificate expiration time |
| issuer | string | Issuer | Certificate issuer |
| status | string | Status | VALID, INVALID, SOON_EXPIRED or EXPIRED |
Error codes
Parsing errors
| Error message | Cause | Resolution |
|---|---|---|
| Specify valid Quaxar profile. | Invalid profile in the profile option | Specify a valid Quaxar connect profile code |
| No available Quaxar profile found. | No Quaxar connect profile registered | Register a Quaxar connect profile first |
| Invalid statuses. Available statuses are VALID, INVALID, SOON_EXPIRED, EXPIRED. | Disallowed status value in statuses | Use only allowed status values |
| Invalid sorts. Available sorts are detected_time_desc, detected_time_asc, expiration_desc, expiration_asc. | Disallowed value in sorts | Use one of the allowed sort orders |
| Invalid duration. Use s(second), m(minute), h(hour), d(day), mon(month) time unit. (e.g. 7d) | Malformed duration | Use the specified time unit format |
| Specify from or duration option. | to specified without from or duration | Specify from or duration with to |
Runtime errors
| Error message | Cause | Resolution |
|---|---|---|
| quaxar asm api error: status=..., message=... | ASM API returned an error state | Check profile permission and ASM service |
Description
quaxar-asm-certificates is a source command that iterates the certificate list discovered by the Quaxar ASM API page by page, emitting each certificate as a row. Every row carries the connect profile name used for the query in the profile field.
Use statuses to filter by validity/expiration state and issuers to filter by issuer; use sorts to order by detection or expiration time. It is useful for periodically checking soon-to-expire (SOON_EXPIRED) and expired (EXPIRED) certificates.
Examples
Example: Act early on soon-to-expire certificates
Situation: An infrastructure manager wants to review soon-to-expire certificates ordered by ascending expiration time to prioritize renewals.
Expected result:
| certificate_id | cn_domain_name | status | valid_until | issuer |
|---|---|---|---|---|
| cert-1a2b3c | example.com | SOON_EXPIRED | 2026-08-10 00:00:00 | Example CA |
| cert-4d5e6f | api.example.com | EXPIRED | 2026-07-01 00:00:00 | Example CA |
Interpretation: Certificates closest to expiration are sorted to the top. Use the certificate_id with the quaxar-asm-certificate command to inspect details such as signature algorithm and alt names.