pki-server-ocsp(8)

NAME
pki-server-ocsp - Command-Line Interface for managing OCSP.

SYNOPSIS
pki-server ocsp-clone-prepare -i <instance ID>
pki-server ocsp-audit-event-find -i <instance ID>
pki-server ocsp-audit-event-enable <event_name> -i <instance ID>
pki-server ocsp-audit-event-modify <event_name> -i <instance ID> -f <event_filter>
pki-server ocsp-audit-event-disable <event_name> -i <instance ID>
pki-server ocsp-audit-file-find -i <instance ID>
pki-server ocsp-audit-file-verify -i <instance ID>

DESCRIPTION

The pki-server ocsp commands provide command-line interfaces to manage Online Status Certificate Protocol instances.

Operations that are available include: OCSP clone prepare will store certificates into pkcs12 file; OCSP certificate backup (clone prepare); finding OCSP audit file; verifying OCSP audit file.

pki-server ocsp
    This command is to list available ocsp commands.

pki-server ocsp-clone-prepare -i <instance ID> --pkcs12-file <file_name.p12> --pkcs12-password <password>
    This command export all OCSP instance certificate to the PKCS #12 file with private keys.

pki-server ocsp-audit-event-find -i <instance ID> --enabled True/False
    This command list all the audit events which are enabled/disabled.

pki-server ocsp-audit-event-enable <event_name> -i <instance ID>
    This command will enable audit events in the instance. You can enable following events for the instance: Logging Events: AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,CONFIG_SIGNED_AUDIT Authorisation/Authentication Logging events: AUTHZ,AUTH,ROLE_ASSUME,CONFIG_AUTH,CONFIG_ROLE,ACCESS_SESSION_ESTABLISH,ACCESS_SESSION_TERMINATED Key Logging events: PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,CONFIG_TRUSTED_PUBLIC_KEY,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS,DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE CMC logging events: CMC_RESPONSE_SENT,CMC_ID_POP_LINK_WITNESS,CMC_SIGNED_REQUEST_SIG_VERIFY,CMC_PROOF_OF_IDENTIFICATION,CMC_REQUEST_RECEIVED,CMC_USER_SIGNED_REQUEST_SIG_VERIFY,PROOF_OF_POSSESSION Profile logging events: CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE Certificate logging events: CERT_SIGNING_INFO,CERT_PROFILE_APPROVAL,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,CONFIG_CERT_POLICY,PROFILE_CERT_REQUEST,CIMC_CERT_VERIFICATION,NON_PROFILE_CERT_REQUEST ACL logging events: CONFIG_ACL OCSP loggin events: OCSP_SIGNING_INFO,OCSP_GENERATION CRL logging events: SCHEDULE_CRL_GENERATION,DELTA_CRL_PUBLISHING,CRL_VALIDATION,CRL_RETRIEVAL,CRL_SIGNING_INFO,FULL_CRL_GENERATION,DELTA_CRL_GENERATION Authority logging events: AUTHORITY_CONFIG,SECURITY_DOMAIN_UPDATE,CONFIG_DRM Selftest logging events: SELFTESTS_EXECUTION Encryption data events: CONFIG_ENCRYPTION,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE,COMPUTE_RANDOM_DATA_REQUEST,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS,SECURITY_DATA_ARCHIVAL_REQUEST Serial/Random number logging event: INTER_BOUNDARY,CONFIG_SERIAL_NUMBER,RANDOM_GENERATION

pki-server ocsp-audit-event-modify <event_name> -i <instance ID> -f <event_filter>
    This command will modify the event filter for audit event logs. Using -f option you can specify event name. For ex: pki-server ocsp-audit-event-modify RANDOM_GENERATION -f "(Output=*)"

pki-server ocsp-audit-event-disable <event_name> -i <instance ID>
    This command will disable audit events in the instance.

pki-server ocsp-audit-file-find -i <instance ID>
    This command find the OCSP instance audit log file.

pki-server ocsp-audit-file-verify -i <instance ID>
    This command will verify that audit log file is signed or not.

All pki-server commands must be executed as the system administrator.

AUTHORS
Amol Kahat <akahat@redhat.com>

COPYRIGHT
Copyright (c) 2018 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.