pki-server-ca(8)

NAME
pki-server-ca - Command-Line Interface for managing Certificate System CA.

SYNOPSIS
pki-server ca-cert-chain-export -i <instance ID>
pki-server ca-cert-request-find -i <instance ID>
pki-server ca-cert-request-show -i <instance ID>
pki-server ca-clone-prepare -i <instance ID>
pki-server ca-audit-event-find -i <instance ID>
pki-server ca-audit-event-enable <event_name> -i <instance ID>
pki-server ca-audit-event-modify <event_name> -i <instance ID> -f <event_filter>
pki-server ca-audit-event-disable <event_name> -i <instance ID>
pki-server ca-audit-file-find -i <instance ID>
pki-server ca-audit-file-verify -i <instance ID>

DESCRIPTION

The pki-server ca commands provide command-line interfaces to manage Certificate Authority instances. A Certificate Authority instance consists of a single Apache Tomcat instance that contain database of certificate request and certificates.

Operations that are available include: certificate chain export and storeing it into pkcs12 file; certificate request find; certificate request show; certificate backup (clone prepare); finding certificate authority audit file; verifying certificate authority audit file.

pki-server ca
    This command is to list available ca commands.

pki-server ca-cert-chain-export -i <instance ID> --pkcs12-file <p12_file> --pkcs12-password <password> --pkcs12-password-file <password_file>
    This command is to export CA certificates with chain and keys to PKCS #12 file. The output filename and either passowrd or password file is required.

pki-server ca-cert-request-find -i <instance ID> --cert-file <certificate file>
    This command will list all the certificate request in the CA instance. After specifying the ceriticate file it will search for certificate request in the database. It accept certificate without any BEGIN/END CERTIFICATE header/footer.

pki-server ca-cert-request-show <certificate request ID> -i <instance ID>
    This command is to show the certificate request as per certificate request no. It shows the Request ID, Type, Status and Request (in b64 format).

pki-server ca-clone-prepare -i <instance ID> --pkcs12-file <file_name.p12> --pkcs12-password <password>
    This command export all CA instance certificate to the PKCS #12 file with private keys.

pki-server ca-audit-event-find -i <instance ID> --enabled True/False
    This command list all the audit events which are enabled/disabled.

pki-server ca-audit-event-enable <event_name> -i <instance ID>
    This command will enable audit events in the instance. You can enable following events for the instance: Logging Events: AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,CONFIG_SIGNED_AUDIT Authorisation/Authentication Logging events: AUTHZ,AUTH,ROLE_ASSUME,CONFIG_AUTH,CONFIG_ROLE,ACCESS_SESSION_ESTABLISH,ACCESS_SESSION_TERMINATED Key Logging events: PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,CONFIG_TRUSTED_PUBLIC_KEY,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS,DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE CMC logging events: CMC_RESPONSE_SENT,CMC_ID_POP_LINK_WITNESS,CMC_SIGNED_REQUEST_SIG_VERIFY,CMC_PROOF_OF_IDENTIFICATION,CMC_REQUEST_RECEIVED,CMC_USER_SIGNED_REQUEST_SIG_VERIFY,PROOF_OF_POSSESSION Profile logging events: CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE Certificate logging events: CERT_SIGNING_INFO,CERT_PROFILE_APPROVAL,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,CONFIG_CERT_POLICY,PROFILE_CERT_REQUEST,CIMC_CERT_VERIFICATION,NON_PROFILE_CERT_REQUEST ACL logging events: CONFIG_ACL OCSP loggin events: OCSP_SIGNING_INFO,OCSP_GENERATION CRL logging events: SCHEDULE_CRL_GENERATION,DELTA_CRL_PUBLISHING,CRL_VALIDATION,CRL_RETRIEVAL,CRL_SIGNING_INFO,FULL_CRL_GENERATION,DELTA_CRL_GENERATION Authority logging events: AUTHORITY_CONFIG,SECURITY_DOMAIN_UPDATE,CONFIG_DRM Selftest logging events: SELFTESTS_EXECUTION Encryption data events: CONFIG_ENCRYPTION,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE,COMPUTE_RANDOM_DATA_REQUEST,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS,SECURITY_DATA_ARCHIVAL_REQUEST Serial/Random number logging event: INTER_BOUNDARY,CONFIG_SERIAL_NUMBER,RANDOM_GENERATION

pki-server ca-audit-event-modify <event_name> -i <instance ID> -f <event_filter>
    This command will modify the event filter for audit event logs. Using -f option you can specify event name. For ex: pki-server ca-audit-event-modify RANDOM_GENERATION -f "(Output=*)"

pki-server ca-audit-event-disable <event_name> -i <instance ID>
    This command will disable audit events in the instance.

pki-server ca-audit-file-find -i <instance ID>
    This command find CA instance audit log file.

pki-server ca-audit-file-verify -i <instance ID>
    This command will verify that audit log file is signed or not.

All pki-server commands must be executed as the system administrator.

AUTHORS
Amol Kahat <akahat@redhat.com>

COPYRIGHT
Copyright (c) 2018 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.