Web UI:Certificate pages

Following pages were added to Web UI:
 * certificated details
 * certificate search

Certificate is not regular object so it gets no metadata. Therefore artificial
metadata were created for it to allow usage of search and details facet.

Search and details facet were modified to allow removing of add/remove/update/
reset buttons - certificates have no mod operation and they are not added by
standard means.

User can revoke and restore certificated in details facet.

https://fedorahosted.org/freeipa/ticket/3419

13 files changed, 621 insertions, 31 deletions

diff --git a/install/ui/src/freeipa/certificate.js b/install/ui/src/freeipa/certificate.js
index f7bc84359..84cff41f6 100755
--- a/install/ui/src/freeipa/certificate.js
+++ b/install/ui/src/freeipa/certificate.js
@@ -19,7 +19,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-define(['./ipa', './jquery', './dialog'], function(IPA, $) {
+define(['./ipa', './jquery','dojo/_base/lang', './dialog'], function(IPA, $, lang) {
 
 IPA.cert = {};
 
@@ -486,6 +486,7 @@ IPA.cert.load_policy = function(spec) {
 
     var that = IPA.facet_policy();
     that.loader = IPA.build(spec.loader);
+    that.has_reason = spec.has_reason;
 
     that.post_load = function(data) {
 
@@ -499,7 +500,8 @@ IPA.cert.load_policy = function(spec) {
         // initialize another load of certificate because current entity
         // show commands don't contain revocation_reason so previous data
         // might be slightly incorrect
-        if (certificate && certificate.certificate && !IPA.cert.is_selfsign()) {
+        if (!that.has_reason && certificate && certificate.certificate &&
+                !IPA.cert.is_selfsign()) {
             that.load_revocation_reason(certificate.serial_number);
         }
     };
@@ -639,6 +641,7 @@ IPA.cert.request_action = function(spec) {
                     on_success: function(data, text_status, xhr) {
                         facet.refresh();
                         IPA.notify_success(IPA.messages.objects.cert.requested);
+                        facet.certificate_updated.notify([], that.facet);
                     }
                 }).execute();
             }
@@ -672,9 +675,12 @@ IPA.cert.revoke_action = function(spec) {
         var entity_label = that.entity_label || facet.entity.metadata.label_singular;
         var entity_name = certificate.entity_info.name;
 
-        var title = IPA.messages.objects.cert.revoke_certificate;
-        title = title.replace('${entity}', entity_label);
-        title = title.replace('${primary_key}', entity_name);
+        var title = IPA.messages.objects.cert.revoke_certificate_simple;
+        if (entity_name && entity_label) {
+            title = IPA.messages.objects.cert.revoke_certificate;
+            title = title.replace('${entity}', entity_label);
+            title = title.replace('${primary_key}', entity_name);
+        }
 
         that.dialog.title = title;
         that.dialog.message = that.get_confirm_message(facet);
@@ -694,6 +700,7 @@ IPA.cert.revoke_action = function(spec) {
             on_success: function(data, text_status, xhr) {
                 facet.refresh();
                 IPA.notify_success(IPA.messages.objects.cert.revoked);
+                facet.certificate_updated.notify([], that.facet);
             }
         }).execute();
     };
@@ -725,9 +732,12 @@ IPA.cert.restore_action = function(spec) {
         var entity_label = that.entity_label || facet.entity.metadata.label_singular;
         var entity_name = certificate.entity_info.name;
 
-        var title = IPA.messages.objects.cert.restore_certificate;
-        title = title.replace('${entity}', entity_label);
-        title = title.replace('${primary_key}', entity_name);
+        var title = IPA.messages.objects.cert.restore_certificate_simple;
+        if (entity_name && entity_label) {
+            title = IPA.messages.objects.cert.restore_certificate;
+            title = title.replace('${entity}', entity_label);
+            title = title.replace('${primary_key}', entity_name);
+        }
 
         that.dialog.title = title;
         that.dialog.message = that.get_confirm_message(facet);
@@ -744,6 +754,7 @@ IPA.cert.restore_action = function(spec) {
             on_success: function(data, text_status, xhr) {
                 facet.refresh();
                 IPA.notify_success(IPA.messages.objects.cert.restored);
+                facet.certificate_updated.notify([], that.facet);
             }
         }).execute();
     };
@@ -923,5 +934,275 @@ IPA.cert.status_field = function(spec) {
 IPA.widget_factories['certificate_status'] = IPA.cert.status_widget;
 IPA.field_factories['certificate_status'] = IPA.cert.status_field;
 
+IPA.cert.entity = function(spec) {
+
+    spec = spec || {};
+
+    spec.policies = spec.policies || [
+        IPA.search_facet_update_policy(),
+        IPA.details_facet_update_policy(),
+        IPA.cert.cert_update_policy({
+            source_facet: 'details',
+            dest_facet: 'search'
+        }),
+        IPA.cert.cert_update_policy({
+            source_facet: 'details',
+            dest_entity: 'host',
+            dest_facet: 'details'
+        }),
+        IPA.cert.cert_update_policy({
+            source_facet: 'details',
+            dest_entity: 'service',
+            dest_facet: 'details'
+        })
+    ];
+
+    var that = IPA.entity(spec);
+
+    that.get_default_metadata = function() {
+
+        var add_param = function(name, label, doc,  primary_key) {
+            entity.takes_params.push({
+                name: name,
+                label: label,
+                doc: doc,
+                primary_key: !!primary_key,
+                flags: ['no_update']
+            });
+        };
+
+        var get_param = function(params, name) {
+
+            for (var i=0;i<params.length;i++) {
+                if (params[i].name === name) return params[i];
+            }
+            return null;
+        };
+
+        var cmd = IPA.metadata.commands['cert_find'];
+        var entity = lang.clone(cmd);
+        entity.attribute_members = {};
+        entity.label = IPA.messages.objects.cert.certificates;
+        entity.label_singular = IPA.messages.objects.cert.certificate;
+        entity.methods = [
+            'find',
+            'remove-hold',
+            'request',
+            'revoke',
+            'show',
+            'status'
+        ];
+        entity.name = "certificate";
+        entity.object_name = "certificate";
+        entity.object_name_plural = "certificates";
+        entity.parent_object = "";
+        entity.primary_key = "serial_number";
+        entity.rdn_attribute = "";
+        entity.relationships = {};
+        entity.takes_params = lang.clone(entity.takes_options);
+
+        get_param(entity.takes_params, 'subject').flags = ['no_update'];
+        var reason = get_param(entity.takes_params, 'revocation_reason');
+        reason.flags = ['no_update'];
+        reason.label = IPA.messages.objects.cert.revocation_reason;
+
+        add_param('serial_number',
+                  IPA.messages.objects.cert.serial_number,
+                  IPA.messages.objects.cert.serial_number,
+                  true);
+        add_param('serial_number_hex',
+                  IPA.messages.objects.cert.serial_number_hex,
+                  IPA.messages.objects.cert.serial_number_hex);
+        add_param('issuer',
+                  IPA.messages.objects.cert.issued_by,
+                  IPA.messages.objects.cert.issued_by);
+        add_param('status',
+                  IPA.messages.objects.cert.status,
+                  IPA.messages.objects.cert.status);
+        add_param('valid_not_before',
+                  IPA.messages.objects.cert.issued_on,
+                  IPA.messages.objects.cert.issued_on);
+        add_param('valid_not_after',
+                  IPA.messages.objects.cert.expires_on,
+                  IPA.messages.objects.cert.expires_on);
+        add_param('md5_fingerprint',
+                  IPA.messages.objects.cert.md5_fingerprint,
+                  IPA.messages.objects.cert.md5_fingerprint);
+        add_param('sha1_fingerprint',
+                  IPA.messages.objects.cert.sha1_fingerprint,
+                  IPA.messages.objects.cert.sha1_fingerprint);
+        add_param('certificate',
+                  IPA.messages.objects.cert.certificate,
+                  IPA.messages.objects.cert.certificate);
+
+
+        IPA.metadata.objects.cert = entity;
+        return entity;
+    };
+
+    that.init = function() {
+
+        if (IPA.cert.is_selfsign()) {
+            throw {
+                expected: true
+            };
+        }
+
+        that.entity_init();
+
+        that.builder.search_facet({
+            factory: IPA.cert.search_facet,
+            label: IPA.messages.objects.cert.label,
+            pagination: false,
+            no_update: true,
+            columns: [
+                {
+                    name: 'serial_number',
+                    primary_key: true,
+                    width: '90px'
+                },
+                'subject',
+                {
+                    name: 'status',
+                    width: '120px'
+                }
+            ]
+        }).
+        details_facet({
+            factory: IPA.cert.details_facet,
+            no_update: true,
+            actions: [
+                IPA.cert.revoke_action,
+                IPA.cert.restore_action
+            ],
+            state: {
+                evaluators: [
+                    IPA.cert.certificate_evaluator
+                ]
+            },
+            sections: [
+                {
+                    name: 'details',
+                    label: IPA.messages.objects.cert.certificate,
+                    action_panel: {
+                        factory: IPA.action_panel,
+                        name: 'cert_actions',
+                        actions: [
+                            'revoke_cert', 'restore_cert'
+                        ]
+                    },
+                    fields: [
+                        'serial_number',
+                        'serial_number_hex',
+                        'subject',
+                        'issuer',
+                        'valid_not_before',
+                        'valid_not_after',
+                        'sha1_fingerprint',
+                        'md5_fingerprint',
+                        {
+                            type: 'revocation_reason',
+                            name: 'revocation_reason'
+                        },
+                        {
+                            type: 'textarea',
+                            name: 'certificate',
+                            style: {
+                                width: '550px',
+                                height: '350px'
+                            }
+                        }
+                    ]
+                }
+            ],
+            policies: [
+                IPA.cert.load_policy({ has_reason: true}),
+                IPA.hide_empty_row_policy({
+                    widget: 'revocation_reason',
+                    section: 'details'
+                })
+            ]
+        });
+    };
+
+    return that;
+};
+
+IPA.cert.search_facet = function(spec) {
+
+    spec = spec || {};
+
+    var that = IPA.search_facet(spec);
+
+
+    that.create_refresh_command = function() {
+
+        var command = that.search_facet_create_refresh_command();
+        var arg = command.args.pop();
+
+        if (arg) {
+            command.set_option('subject', arg);
+        }
+
+        return command;
+    };
+
+    return that;
+};
+
+IPA.cert.details_facet = function(spec, no_init) {
+
+    spec = spec || {};
+
+    var that = IPA.details_facet(spec, true);
+    that.certificate_loaded = IPA.observer();
+    that.certificate_updated = IPA.observer();
+
+    that.create_refresh_command = function() {
+
+        var command = that.details_facet_create_refresh_command();
+        delete command.options.all;
+        delete command.options.rights;
+        return command;
+    };
+
+    if (!no_init) that.init_details_facet();
+
+    return that;
+};
+
+
+IPA.revocation_reason_field = function(spec) {
+
+    spec = spec || {};
+
+    var that = IPA.field(spec);
+
+    that.load = function(record) {
+
+        that.field_load(record);
+
+        var reason = record.revocation_reason;
+        var text = IPA.cert.CRL_REASON[reason] || '';
+        that.values = [text];
+
+        that.reset();
+    };
+
+    return that;
+};
+
+IPA.cert.cert_update_policy = function(spec) {
+
+    spec = spec || {};
+    spec.event = spec.event || 'certificate_updated';
+    return IPA.facet_update_policy(spec);
+};
+
+IPA.field_factories['revocation_reason'] = IPA.revocation_reason_field;
+IPA.widget_factories['revocation_reason'] = IPA.text_widget;
+
+IPA.register('cert', IPA.cert.entity);
+
 return {};
-});
+});
\ No newline at end of file
diff --git a/install/ui/src/freeipa/details.js b/install/ui/src/freeipa/details.js
index e8f1e86d9..bd23e564e 100644
--- a/install/ui/src/freeipa/details.js
+++ b/install/ui/src/freeipa/details.js
@@ -238,21 +238,25 @@ IPA.details_facet = function(spec, no_init) {
         IPA.update_action);
 
     spec.control_buttons = spec.control_buttons || [];
+
+    if (!spec.no_update) {
+        spec.control_buttons.unshift(
+            {
+                name: 'reset',
+                label: IPA.messages.buttons.reset,
+                icon: 'reset-icon'
+            },
+            {
+                name: 'update',
+                label: IPA.messages.buttons.update,
+                icon: 'update-icon'
+            });
+    }
     spec.control_buttons.unshift(
         {
             name: 'refresh',
             label: IPA.messages.buttons.refresh,
             icon: 'reset-icon'
-        },
-        {
-            name: 'reset',
-            label: IPA.messages.buttons.reset,
-            icon: 'reset-icon'
-        },
-        {
-            name: 'update',
-            label: IPA.messages.buttons.update,
-            icon: 'update-icon'
         });
 
     spec.state = spec.state || {};
diff --git a/install/ui/src/freeipa/facet.js b/install/ui/src/freeipa/facet.js
index 77e05cab6..3ad868e84 100644
--- a/install/ui/src/freeipa/facet.js
+++ b/install/ui/src/freeipa/facet.js
@@ -38,6 +38,7 @@ IPA.facet = function(spec, no_init) {
     that.title = spec.title || that.label;
     that.tab_label = spec.tab_label || that.label;
     that.display_class = spec.display_class;
+    that.no_update = spec.no_update;
 
     that.disable_breadcrumb = spec.disable_breadcrumb;
     that.disable_facet_tabs = spec.disable_facet_tabs;
diff --git a/install/ui/src/freeipa/field.js b/install/ui/src/freeipa/field.js
index f705ef7b8..f972a6589 100644
--- a/install/ui/src/freeipa/field.js
+++ b/install/ui/src/freeipa/field.js
@@ -275,7 +275,7 @@ IPA.field = function(spec) {
      */
     that.test_dirty = function() {
 
-        if (that.read_only) return false;
+        if (that.read_only || !that.writable) return false;
 
         var values = that.save();
 
diff --git a/install/ui/src/freeipa/host.js b/install/ui/src/freeipa/host.js
index 133c38ffd..d064a2fa2 100644
--- a/install/ui/src/freeipa/host.js
+++ b/install/ui/src/freeipa/host.js
@@ -26,6 +26,23 @@ IPA.host = {};
 
 IPA.host.entity = function(spec) {
 
+    spec = spec || {};
+
+    spec.policies = spec.policies || [
+        IPA.search_facet_update_policy(),
+        IPA.details_facet_update_policy(),
+        IPA.cert.cert_update_policy({
+            source_facet: 'details',
+            dest_entity: 'cert',
+            dest_facet: 'details'
+        }),
+        IPA.cert.cert_update_policy({
+            source_facet: 'details',
+            dest_entity: 'cert',
+            dest_facet: 'search'
+        })
+    ];
+
     var that = IPA.entity(spec);
 
     that.init = function() {
@@ -223,6 +240,7 @@ IPA.host.details_facet = function(spec, no_init) {
 
     var that = IPA.details_facet(spec, true);
     that.certificate_loaded = IPA.observer();
+    that.certificate_updated = IPA.observer();
 
     that.get_refresh_command_name = function() {
         return that.entity.name+'_show_'+that.pkey;
diff --git a/install/ui/src/freeipa/search.js b/install/ui/src/freeipa/search.js
index a3f35b5e9..d57c40126 100644
--- a/install/ui/src/freeipa/search.js
+++ b/install/ui/src/freeipa/search.js
@@ -42,21 +42,25 @@ IPA.search_facet = function(spec, no_init) {
         IPA.add_action);
 
     spec.control_buttons = spec.control_buttons || [];
+
+    if (!spec.no_update) {
+        spec.control_buttons.unshift(
+            {
+                name: 'remove',
+                label: IPA.messages.buttons.remove,
+                icon: 'remove-icon'
+            },
+            {
+                name: 'add',
+                label: IPA.messages.buttons.add,
+                icon: 'add-icon'
+            });
+    }
     spec.control_buttons.unshift(
         {
             name: 'refresh',
             label: IPA.messages.buttons.refresh,
             icon: 'reset-icon'
-        },
-        {
-            name: 'remove',
-            label: IPA.messages.buttons.remove,
-            icon: 'remove-icon'
-        },
-        {
-            name: 'add',
-            label: IPA.messages.buttons.add,
-            icon: 'add-icon'
         });
 
     spec.state = spec.state || {};
diff --git a/install/ui/src/freeipa/service.js b/install/ui/src/freeipa/service.js
index ecb8ce9b3..c38cfef1b 100644
--- a/install/ui/src/freeipa/service.js
+++ b/install/ui/src/freeipa/service.js
@@ -25,6 +25,23 @@ IPA.service = {};
 
 IPA.service.entity = function(spec) {
 
+    spec = spec || {};
+
+    spec.policies = spec.policies || [
+        IPA.search_facet_update_policy(),
+        IPA.details_facet_update_policy(),
+        IPA.cert.cert_update_policy({
+            source_facet: 'details',
+            dest_entity: 'cert',
+            dest_facet: 'details'
+        }),
+        IPA.cert.cert_update_policy({
+            source_facet: 'details',
+            dest_entity: 'cert',
+            dest_facet: 'search'
+        })
+    ];
+
     var that = IPA.entity(spec);
 
     that.init = function() {
@@ -172,6 +189,7 @@ IPA.service.details_facet = function(spec, no_init) {
 
     var that = IPA.details_facet(spec, true);
     that.certificate_loaded = IPA.observer();
+    that.certificate_updated = IPA.observer();
 
     if (!no_init) that.init_details_facet();
 
diff --git a/install/ui/src/freeipa/webui.js b/install/ui/src/freeipa/webui.js
index f6c3339ec..2bc3bdd47 100644
--- a/install/ui/src/freeipa/webui.js
+++ b/install/ui/src/freeipa/webui.js
@@ -42,7 +42,8 @@ IPA.admin_navigation = function(spec) {
                  {entity: 'dnsconfig'},
                  {entity: 'dnsrecord', hidden:true}
              ]
-            }
+            },
+            {entity: 'cert', label: IPA.messages.tabs.cert }
         ]},
         {name: 'policy', label: IPA.messages.tabs.policy, children: [
             {name: 'hbac', label: IPA.messages.tabs.hbac, children: [
diff --git a/install/ui/src/freeipa/widget.js b/install/ui/src/freeipa/widget.js
index 6472cab97..5ce767e7e 100644
--- a/install/ui/src/freeipa/widget.js
+++ b/install/ui/src/freeipa/widget.js
@@ -960,6 +960,7 @@ IPA.textarea_widget = function (spec) {
 
     that.rows = spec.rows || 5;
     that.cols = spec.cols || 40;
+    that.style = spec.style;
 
     that.create = function(container) {
 
@@ -972,12 +973,15 @@ IPA.textarea_widget = function (spec) {
             rows: that.rows,
             cols: that.cols,
             disabled: that.disabled,
+            readOnly: !!that.read_only,
             title: that.tooltip,
             keyup: function() {
                 that.on_value_changed();
             }
         }).appendTo(container);
 
+        if (that.style) that.input.css(that.style);
+
         that.input.bind('input', function() {
             that.on_value_changed();
         });
@@ -990,11 +994,17 @@ IPA.textarea_widget = function (spec) {
     };
 
     that.save = function() {
+        if (that.read_only || !that.writable) {
+            return null;
+        }
         var value = that.input.val();
         return [value];
     };
 
     that.update = function(values) {
+        var read_only = that.read_only || !that.writable;
+        that.input.prop('readOnly', read_only);
+
         var value = values && values.length ? values[0] : '';
         that.input.val(value);
     };
@@ -2947,6 +2957,27 @@ IPA.details_table_section = function(spec) {
     return that;
 };
 
+IPA.hide_empty_row_policy = function (spec) {
+
+    spec = spec || {};
+
+    var that = IPA.facet_policy();
+    that.value_name = spec.value_name || spec.widget;
+    that.widget_name = spec.widget;
+    that.section_name = spec.section;
+
+    that.post_load = function(data) {
+
+        var value = data.result.result[that.value_name];
+        var visible = !IPA.is_empty(value);
+
+        var section = that.container.widgets.get_widget(that.section_name);
+        section.set_row_visible(that.widget_name, visible);
+    };
+
+    return that;
+};
+
 //non-collabsible section
 IPA.details_table_section_nc = function(spec) {
 
diff --git a/install/ui/test/data/cert_find.json b/install/ui/test/data/cert_find.json
new file mode 100644
index 000000000..6c059bd7a
--- /dev/null
+++ b/install/ui/test/data/cert_find.json
@@ -0,0 +1,71 @@
+{
+    "error": null,
+    "id": null,
+    "result": {
+        "count": 10,
+        "result": [
+            {
+                "serial_number": 1,
+                "serial_number_hex": "0x1",
+                "status": "VALID",
+                "subject": "CN=Certificate Authority,O=EXAMPLE.COM"
+            },
+            {
+                "serial_number": 2,
+                "serial_number_hex": "0x2",
+                "status": "VALID",
+                "subject": "CN=OCSP Subsystem,O=EXAMPLE.COM"
+            },
+            {
+                "serial_number": 3,
+                "serial_number_hex": "0x3",
+                "status": "VALID",
+                "subject": "CN=dev.example.com,O=EXAMPLE.COM"
+            },
+            {
+                "serial_number": 4,
+                "serial_number_hex": "0x4",
+                "status": "VALID",
+                "subject": "CN=CA Subsystem,O=EXAMPLE.COM"
+            },
+            {
+                "serial_number": 5,
+                "serial_number_hex": "0x5",
+                "status": "VALID",
+                "subject": "CN=CA Audit,O=EXAMPLE.COM"
+            },
+            {
+                "serial_number": 6,
+                "serial_number_hex": "0x6",
+                "status": "VALID",
+                "subject": "CN=ipa-ca-agent,O=EXAMPLE.COM"
+            },
+            {
+                "serial_number": 7,
+                "serial_number_hex": "0x7",
+                "status": "VALID",
+                "subject": "CN=IPA RA,O=EXAMPLE.COM"
+            },
+            {
+                "serial_number": 8,
+                "serial_number_hex": "0x8",
+                "status": "VALID",
+                "subject": "CN=dev.example.com,O=EXAMPLE.COM"
+            },
+            {
+                "serial_number": 9,
+                "serial_number_hex": "0x9",
+                "status": "VALID",
+                "subject": "CN=dev.example.com,O=EXAMPLE.COM"
+            },
+            {
+                "serial_number": 10,
+                "serial_number_hex": "0xA",
+                "status": "VALID",
+                "subject": "CN=Object Signing Cert,O=EXAMPLE.COM"
+            }
+        ],
+        "summary": "10 certificates matched",
+        "truncated": false
+    }
+}
\ No newline at end of file
diff --git a/install/ui/test/data/ipa_init.json b/install/ui/test/data/ipa_init.json
index 73d54578b..685367473 100644
--- a/install/ui/test/data/ipa_init.json
+++ b/install/ui/test/data/ipa_init.json
@@ -176,6 +176,8 @@
                             "aa_compromise": "AA Compromise",
                             "affiliation_changed": "Affiliation Changed",
                             "ca_compromise": "CA Compromise",
+                            "certificate": "Certificate",
+                            "certificates": "Certificates",
                             "certificate_hold": "Certificate Hold",
                             "cessation_of_operation": "Cessation of Operation",
                             "common_name": "Common Name",
@@ -198,14 +200,18 @@
                             "request_message": "<ol> <li>Create a certificate database or use an existing one. To create a new database:<br/> <code># certutil -N -d &lt;database path&gt;</code> </li> <li>Create a CSR with subject <em>CN=&lt;hostname&gt;,O=&lt;realm&gt;</em>, for example:<br/> <code># certutil -R -d &lt;database path&gt; -a -g &lt;key size&gt; -s 'CN=${hostname},O=${realm}'</code> </li> <li> Copy and paste the CSR (from <em>-----BEGIN NEW CERTIFICATE REQUEST-----</em> to <em>-----END NEW CERTIFICATE REQUEST-----</em>) into the text area below: </li> </ol>",
                             "requested": "Certificate requested",
                             "restore_certificate": "Restore Certificate for ${entity} ${primary_key}",
+                            "restore_certificate_simple": "Restore Certificate",
                             "restore_confirmation": "To confirm your intention to restore this certificate, click the \"Restore\" button.",
                             "restored": "Certificate restored",
+                            "revocation_reason": "Revocation reason",
                             "revoke_certificate": "Revoke Certificate for ${entity} ${primary_key}",
+                            "revoke_certificate_simple": "Revoke Certificate",
                             "revoke_confirmation": "To confirm your intention to revoke this certificate, select a reason from the pull-down list, and click the \"Revoke\" button.",
                             "revoked": "Certificate Revoked",
                             "serial_number": "Serial Number",
                             "serial_number_hex": "Serial Number (hex)",
                             "sha1_fingerprint": "SHA1 Fingerprint",
+                            "status": "Status",
                             "superseded": "Superseded",
                             "unspecified": "Unspecified",
                             "valid": "Valid Certificate Present",
@@ -510,6 +516,7 @@
                         "audit": "Audit",
                         "automember": "Automember",
                         "automount": "Automount",
+                        "cert": "Certificates",
                         "dns": "DNS",
                         "hbac": "Host Based Access Control",
                         "identity": "Identity",
diff --git a/install/ui/test/data/ipa_init_commands.json b/install/ui/test/data/ipa_init_commands.json
index 2c128f73e..a7e00ba55 100644
--- a/install/ui/test/data/ipa_init_commands.json
+++ b/install/ui/test/data/ipa_init_commands.json
@@ -1825,6 +1825,153 @@
                 ],
                 "takes_options": []
             },
+            "cert_find": {
+                "name": "cert_find",
+                "takes_args": [],
+                "takes_options": [
+                    {
+                        "class": "Str",
+                        "doc": "Subject",
+                        "flags": [],
+                        "label": "Subject",
+                        "name": "subject",
+                        "noextrawhitespace": true,
+                        "type": "unicode"
+                    },
+                    {
+                        "class": "Int",
+                        "doc": "Reason for revoking the certificate (0-10)",
+                        "flags": [],
+                        "label": "Reason",
+                        "maxvalue": 10,
+                        "minvalue": 0,
+                        "name": "revocation_reason",
+                        "type": "int"
+                    },
+                    {
+                        "class": "Int",
+                        "doc": "minimum serial number",
+                        "flags": [],
+                        "label": "<min_serial_number>",
+                        "maxvalue": 2147483647,
+                        "minvalue": 0,
+                        "name": "min_serial_number",
+                        "type": "int"
+                    },
+                    {
+                        "class": "Int",
+                        "doc": "maximum serial number",
+                        "flags": [],
+                        "label": "<max_serial_number>",
+                        "maxvalue": 2147483647,
+                        "minvalue": -2147483648,
+                        "name": "max_serial_number",
+                        "type": "int"
+                    },
+                    {
+                        "class": "Flag",
+                        "doc": "match the common name exactly",
+                        "flags": [],
+                        "label": "<exactly>",
+                        "name": "exactly",
+                        "type": "bool"
+                    },
+                    {
+                        "class": "Str",
+                        "doc": "Valid not after from this date (YYYY-mm-dd)",
+                        "flags": [],
+                        "label": "<validnotafter_from>",
+                        "name": "validnotafter_from",
+                        "noextrawhitespace": true,
+                        "type": "unicode"
+                    },
+                    {
+                        "class": "Str",
+                        "doc": "Valid not after to this date (YYYY-mm-dd)",
+                        "flags": [],
+                        "label": "<validnotafter_to>",
+                        "name": "validnotafter_to",
+                        "noextrawhitespace": true,
+                        "type": "unicode"
+                    },
+                    {
+                        "class": "Str",
+                        "doc": "Valid not before from this date (YYYY-mm-dd)",
+                        "flags": [],
+                        "label": "<validnotbefore_from>",
+                        "name": "validnotbefore_from",
+                        "noextrawhitespace": true,
+                        "type": "unicode"
+                    },
+                    {
+                        "class": "Str",
+                        "doc": "Valid not before to this date (YYYY-mm-dd)",
+                        "flags": [],
+                        "label": "<validnotbefore_to>",
+                        "name": "validnotbefore_to",
+                        "noextrawhitespace": true,
+                        "type": "unicode"
+                    },
+                    {
+                        "class": "Str",
+                        "doc": "Issued on from this date (YYYY-mm-dd)",
+                        "flags": [],
+                        "label": "<issuedon_from>",
+                        "name": "issuedon_from",
+                        "noextrawhitespace": true,
+                        "type": "unicode"
+                    },
+                    {
+                        "class": "Str",
+                        "doc": "Issued on to this date (YYYY-mm-dd)",
+                        "flags": [],
+                        "label": "<issuedon_to>",
+                        "name": "issuedon_to",
+                        "noextrawhitespace": true,
+                        "type": "unicode"
+                    },
+                    {
+                        "class": "Str",
+                        "doc": "Revoked on from this date (YYYY-mm-dd)",
+                        "flags": [],
+                        "label": "<revokedon_from>",
+                        "name": "revokedon_from",
+                        "noextrawhitespace": true,
+                        "type": "unicode"
+                    },
+                    {
+                        "class": "Str",
+                        "doc": "Revoked on to this date (YYYY-mm-dd)",
+                        "flags": [],
+                        "label": "<revokedon_to>",
+                        "name": "revokedon_to",
+                        "noextrawhitespace": true,
+                        "type": "unicode"
+                    },
+                    {
+                        "class": "Int",
+                        "default": 100,
+                        "doc": "Maximum number of certs returned",
+                        "flags": [
+                            "no_display"
+                        ],
+                        "label": "Size Limit",
+                        "maxvalue": 2147483647,
+                        "minvalue": 0,
+                        "name": "sizelimit",
+                        "type": "int"
+                    },
+                    {
+                        "name": "all"
+                    },
+                    {
+                        "name": "raw"
+                    },
+                    {
+                        "name": "version"
+                    }
+                ]
+            },
             "cert_remove_hold": {
                 "name": "cert_remove_hold",
                 "takes_args": {
diff --git a/ipalib/plugins/internal.py b/ipalib/plugins/internal.py
index 2ca112ee0..cc0bf99d5 100644
--- a/ipalib/plugins/internal.py
+++ b/ipalib/plugins/internal.py
@@ -312,6 +312,8 @@ class i18n_messages(Command):
                 "aa_compromise": _("AA Compromise"),
                 "affiliation_changed": _("Affiliation Changed"),
                 "ca_compromise": _("CA Compromise"),
+                "certificate": _("Certificate"),
+                "certificates": _("Certificates"),
                 "certificate_hold": _("Certificate Hold"),
                 "cessation_of_operation": _("Cessation of Operation"),
                 "common_name": _("Common Name"),
@@ -334,14 +336,18 @@ class i18n_messages(Command):
                 "request_message": _("<ol> <li>Create a certificate database or use an existing one. To create a new database:<br/> <code># certutil -N -d &lt;database path&gt;</code> </li> <li>Create a CSR with subject <em>CN=&lt;hostname&gt;,O=&lt;realm&gt;</em>, for example:<br/> <code># certutil -R -d &lt;database path&gt; -a -g &lt;key size&gt; -s 'CN=${hostname},O=${realm}'</code> </li> <li> Copy and paste the CSR (from <em>-----BEGIN NEW CERTIFICATE REQUEST-----</em> to <em>-----END NEW CERTIFICATE REQUEST-----</em>) into the text area below: </li> </ol>"),
                 "requested": _("Certificate requested"),
                 "restore_certificate": _("Restore Certificate for ${entity} ${primary_key}"),
+                "restore_certificate_simple": _("Restore Certificate"),
                 "restore_confirmation": _("To confirm your intention to restore this certificate, click the \"Restore\" button."),
                 "restored": _("Certificate restored"),
+                "revocation_reason": _("Revocation reason"),
                 "revoke_certificate": _("Revoke Certificate for ${entity} ${primary_key}"),
+                "revoke_certificate_simple": _("Revoke Certificate"),
                 "revoke_confirmation": _("To confirm your intention to revoke this certificate, select a reason from the pull-down list, and click the \"Revoke\" button."),
                 "revoked": _("Certificate Revoked"),
                 "serial_number": _("Serial Number"),
                 "serial_number_hex": _("Serial Number (hex)"),
                 "sha1_fingerprint": _("SHA1 Fingerprint"),
+                "status": _("Status"),
                 "superseded": _("Superseded"),
                 "unspecified": _("Unspecified"),
                 "valid": _("Valid Certificate Present"),
@@ -649,6 +655,7 @@ class i18n_messages(Command):
             "audit": _("Audit"),
             "automember": _("Automember"),
             "automount": _("Automount"),
+            "cert": _("Certificates"),
             "dns": _("DNS"),
             "hbac": _("Host Based Access Control"),
             "identity": _("Identity"),