1pki-tps-connector(5) PKI TPS Connector Configuration pki-tps-connector(5)
2
6 pki-tps-connector - PKI TPS Connector Configuration
7
10 /var/lib/pki/instance/conf/tps/CS.cfg
11
14 TPS connector provides a mechanism for TPS to communicate with other
15 PKI subsystems. There are three supported connector types: CA, KRA,
16 and TKS. The connectors are defined using properties in the TPS con‐
17 figuration file.
18
21 A CA connector is defined using properties that begin with tps.connec‐
22 tor.ca<n> where n is a positive integer indicating the ID of the CA
23 connector.
24 tps.connector.ca<n>.enable
27 This property contains a boolean value indicating whether the connector
28 is enabled.
29 tps.connector.ca<n>.host
32 In no-failover configuration, the property contains the hostname of the
33 CA.
34 In failover configuration, the property contains a list of hostnames
37 and port numbers of the CA subsystems. The format is hostname:port
38 separated by spaces.
39 tps.connector.ca<n>.port
42 In no-failover configuration, the property contains the port number of
43 the CA.
44 tps.connector.ca<n>.nickName
47 This property contains the nickname of the TPS subsystem certificate
48 for SSL client authentication to the CA.
49 tps.connector.ca<n>.minHttpConns
52 This property contains the minimum number of HTTP connections.
53 tps.connector.ca<n>.maxHttpConns
56 This property contains the maximum number of HTTP connections.
57 tps.connector.ca<n>.uri.<op>
60 This property contains the URI to contact CA for the operation <op>.
61 Example ops: enrollment, renewal, revoke, unrevoke, getcert.
62 tps.connector.ca<n>.timeout
65 This property contains the connection timeout.
66 tps.connCAList
69 This property is used for Revocation Routing. It contains a list of
70 ordered ca id's separated by ',' that the revocation attempt should be
71 made to. Example: tps.connCAList=ca1,ca2
72 tps.connector.ca<n>.caNickname
75 This property is used for Revocation Routing. It contains the nickname
76 of the CA signing certificate that represents this ca<n>.
77 tps.connector.ca<n>.caSKI
80 This property is used for Revocation Routing. It contains the Subject
81 Key Identifier of the CA signing certificate of this ca<n>. This value
82 is automatically calculated by TPS once and should not need handling by
83 the administrator.
84
87 A KRA connector is defined using properties that begin with tps.connec‐
88 tor.kra<n> where n is a positive integer indicating the ID of the KRA
89 connector.
90 tps.connector.kra<n>.enable
93 This property contains a boolean value indicating whether the connector
94 is enabled.
95 tps.connector.kra<n>.host
98 In no-failover configuration, the property contains the hostname of the
99 KRA.
100 In failover configuration, the property contains a list of hostnames
103 and port numbers of the KRA subsystems. The format is hostname:port
104 separated by spaces.
105 tps.connector.kra<n>.port
108 In no-failover configuration, the property contains the port number of
109 the KRA.
110 tps.connector.kra<n>.nickName
113 This property contains the nickname of the TPS subsystem certificate
114 for SSL client authentication to the KRA.
115 tps.connector.kra<n>.minHttpConns
118 This property contains the minimum number of HTTP connections.
119 tps.connector.kra<n>.maxHttpConns
122 This property contains the maximum number of HTTP connections.
123 tps.connector.kra<n>.uri.<op>
126 This property contains the URI to contact KRA for the operation <op>.
127 Example ops: GenerateKeyPair, TokenKeyRecovery.
128 tps.connector.kra<n>.timeout
131 This property contains the connection timeout.
132
135 A TKS connector is defined using properties that begin with tps.connec‐
136 tor.tks<n> where n is a positive integer indicating the ID of the TKS
137 connector.
138 tps.connector.tks<n>.enable
141 This property contains a boolean value indicating whether the connector
142 is enabled.
143 tps.connector.tks<n>.host
146 In no-failover configuration, the property contains the hostname of the
147 TKS.
148 In failover configuration, the property contains a list of hostnames
151 and port numbers of the TKS subsystems. The format is hostname:port
152 separated by spaces.
153 tps.connector.tks<n>.port
156 In no-failover configuration, the property contains the port number of
157 the TKS.
158 tps.connector.tks<n>.nickName
161 This property contains the nickname of the TPS subsystem certificate
162 for SSL client authentication to the TKS.
163 tps.connector.tks<n>.minHttpConns
166 This property contains the minimum number of HTTP connections.
167 tps.connector.tks<n>.maxHttpConns
170 This property contains the maximum number of HTTP connections.
171 tps.connector.tks<n>.uri.<op>
174 This property contains the URI to contact TKS for the operation <op>.
175 Example ops: computeRandomData, computeSessionKey, createKeySetData,
176 encryptData.
177 tps.connector.tks<n>.timeout
180 This property contains the connection timeout.
181 tps.connector.tks<n>.generateHostChallenge
184 This property contains a boolean value indicating whether to generate
185 host challenge.
186 tps.connector.tks<n>.serverKeygen
189 This property contains a boolean value indicating whether to generate
190 keys on server side.
191 tps.connector.tks<n>.keySet
194 This property contains the key set to be used on TKS.
195 tps.connector.tks<n>.tksSharedSymKeyName
198 This property contains the shared secret key name.
199
202 tps.connector.ca1.enable=true
203 tps.connector.ca1.host=server.example.com
204 tps.connector.ca1.port=8443
205 tps.connector.ca1.minHttpConns=1
206 tps.connector.ca1.maxHttpConns=15
207 tps.connector.ca1.nickName=subsystemCert cert-pki-tomcat TPS
208 tps.connector.ca1.timeout=30
209 tps.connector.ca1.uri.enrollment=/ca/ee/ca/profileSubmitSSLClient
210 tps.connector.ca1.uri.renewal=/ca/ee/ca/profileSubmitSSLClient
211 tps.connector.ca1.uri.revoke=/ca/ee/subsystem/ca/doRevoke
212 tps.connector.ca1.uri.unrevoke=/ca/ee/subsystem/ca/doUnrevoke
213 # in case of Revocation Routing
214 # note that caSKI is automatically calculated by TPS
215 tps.connCAList=ca1,ca2
216 tps.connector.ca1.caNickname=caSigningCert cert-pki-tomcat CA
217 tps.connector.ca1.caSKI=hAzNarQMlzit4BymAlbduZMwVCc
218 # ca2 connector in case of Revocation Routing
219 tps.connector.ca2.<etc.>
220 tps.connector.kra1.enable=true
222 tps.connector.kra1.host=server.example.com
223 tps.connector.kra1.port=8443
224 tps.connector.kra1.minHttpConns=1
225 tps.connector.kra1.maxHttpConns=15
226 tps.connector.kra1.nickName=subsystemCert cert-pki-tomcat TPS
227 tps.connector.kra1.timeout=30
228 tps.connector.kra1.uri.GenerateKeyPair=/kra/agent/kra/GenerateKeyPair
229 tps.connector.kra1.uri.TokenKeyRecovery=/kra/agent/kra/TokenKeyRecovery
230 tps.connector.tks1.enable=true
232 tps.connector.tks1.host=server.example.com
233 tps.connector.tks1.port=8443
234 tps.connector.tks1.minHttpConns=1
235 tps.connector.tks1.maxHttpConns=15
236 tps.connector.tks1.nickName=subsystemCert cert-pki-tomcat TPS
237 tps.connector.tks1.timeout=30
238 tps.connector.tks1.generateHostChallenge=true
239 tps.connector.tks1.serverKeygen=false
240 tps.connector.tks1.keySet=defKeySet
241 tps.connector.tks1.tksSharedSymKeyName=sharedSecret
242 tps.connector.tks1.uri.computeRandomData=/tks/agent/tks/computeRandomData
243 tps.connector.tks1.uri.computeSessionKey=/tks/agent/tks/computeSessionKey
244 tps.connector.tks1.uri.createKeySetData=/tks/agent/tks/createKeySetData
245 tps.connector.tks1.uri.encryptData=/tks/agent/tks/encryptData
246
250 Dogtag PKI Team <pki-devel@redhat.com>.
251
254 Copyright (c) 2014 Red Hat, Inc. This is licensed under the GNU Gen‐
255 eral Public License, version 2 (GPLv2). A copy of this license is
256 available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.
257PKI April 22, 2014 pki-tps-connector(5)