1pki-server-ca(8)          PKI CA Management Commands          pki-server-ca(8)
2
3
4

NAME

6       pki-server-ca - Command-line interface for managing PKI CA.
7
8

SYNOPSIS

10       pki-server [CLI-options] ca-cert-chain-export [command-options]
11       pki-server [CLI-options] ca-cert-request-find [command-options]
12       pki-server  [CLI-options]  ca-cert-request-show  [command-options]  re‐
13       quest-ID
14       pki-server [CLI-options] ca-clone-prepare [command-options]
15       pki-server [CLI-options] ca-audit-event-find [command-options]
16       pki-server [CLI-options] ca-audit-event-enable [command-options] event-
17       ID
18       pki-server   [CLI-options]   ca-audit-event-disable   [command-options]
19       event-ID
20       pki-server [CLI-options] ca-audit-event-modify [command-options] event-
21       ID
22       pki-server [CLI-options] ca-audit-file-find [command-options]
23       pki-server [CLI-options] ca-audit-file-verify [command-options]
24
25

DESCRIPTION

27       The  pki-server  ca  commands provide command-line interfaces to manage
28       PKI CA.
29
30
31       pki-server [CLI-options] ca [command-options]
32           This command is to list available PKI CA management commands.
33
34
35       pki-server [CLI-options] ca-cert-chain-export [command-options]
36           This command is to export CA certificates with chain  and  keys  to
37       PKCS #12 file.
38           The  output  filename  and either password or password file are re‐
39       quired.
40
41
42       pki-server [CLI-options] ca-cert-request-find [command-options]
43           This command will list all the certificate request in the CA.
44           After specifying the certificate file it will search  for  certifi‐
45       cate request in the database.
46           It   accepts   certificate   without   any   BEGIN/END  CERTIFICATE
47       header/footer.
48
49
50       pki-server  [CLI-options]  ca-cert-request-show  [command-options]  re‐
51       quest-ID
52           This  command is to show the certificate request as per certificate
53       request ID.
54           It shows the Request ID, Type, Status and Request (in  Base64  for‐
55       mat).
56
57
58       pki-server [CLI-options] ca-clone-prepare [command-options]
59           This  command  exports  CA system certificates into a PKCS #12 file
60       with private keys.
61
62
63       pki-server [CLI-options] ca-audit-event-find [command-options]
64           This command list all the audit events which are enabled/disabled.
65
66
67       pki-server [CLI-options] ca-audit-event-enable [command-options] event-
68       ID
69           This command will enable audit events in the CA.
70
71
72       pki-server   [CLI-options]   ca-audit-event-disable   [command-options]
73       event-ID
74           This command will disable audit events in the CA.
75
76
77       pki-server [CLI-options] ca-audit-event-modify [command-options] event-
78       ID
79           This command will modify the event filter for audit events.
80
81
82       pki-server [CLI-options] ca-audit-file-find [command-options]
83           This command lists audit log files generated by the CA.
84
85
86       pki-server [CLI-options] ca-audit-file-verify [command-options]
87           This  command  will  verify whether the signatures in the audit log
88       files are valid.
89
90

AUDIT EVENTS

92       Logging audit events:
93
94
95              • AUDIT_LOG_STARTUP
96
97              • AUDIT_LOG_SHUTDOWN
98
99              • AUDIT_LOG_DELETE
100
101              • LOG_PATH_CHANGE
102
103              • LOG_EXPIRATION_CHANGE
104
105              • CONFIG_SIGNED_AUDIT
106
107
108
109       Authentication and authorization audit events:
110
111
112              • AUTHZ
113
114              • AUTH
115
116              • ROLE_ASSUME
117
118              • CONFIG_AUTH
119
120              • CONFIG_ROLE
121
122              • ACCESS_SESSION_ESTABLISH
123
124              • ACCESS_SESSION_TERMINATED
125
126
127
128       Key audit events:
129
130
131              • PRIVATE_KEY_ARCHIVE_REQUEST
132
133              • PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED
134
135              • PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS
136
137              • CONFIG_TRUSTED_PUBLIC_KEY
138
139              • PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE
140
141              • KEY_RECOVERY_REQUEST
142
143              • KEY_RECOVERY_REQUEST_ASYNC
144
145              • KEY_RECOVERY_AGENT_LOGIN
146
147              • KEY_RECOVERY_REQUEST_PROCESSED
148
149              • KEY_RECOVERY_REQUEST_PROCESSED_ASYNC
150
151              • KEY_GEN_ASYMMETRIC
152
153              • COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS
154
155              • COMPUTE_SESSION_KEY_REQUEST
156
157              • COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE
158
159              • DIVERSIFY_KEY_REQUEST
160
161              • DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS
162
163              • DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE
164
165              • SERVER_SIDE_KEYGEN_REQUEST
166
167              • SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS
168
169              • SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE
170
171
172
173       CMC audit events:
174
175
176              • CMC_RESPONSE_SENT
177
178              • CMC_ID_POP_LINK_WITNESS
179
180              • CMC_SIGNED_REQUEST_SIG_VERIFY
181
182              • CMC_PROOF_OF_IDENTIFICATION
183
184              • CMC_REQUEST_RECEIVED
185
186              • CMC_USER_SIGNED_REQUEST_SIG_VERIFY
187
188              • PROOF_OF_POSSESSION
189
190
191
192       Profile audit events:
193
194
195              • CONFIG_CERT_PROFILE
196
197              • CONFIG_CRL_PROFILE
198
199              • CONFIG_OCSP_PROFILE
200
201
202
203       Certificate audit events:
204
205
206              • CERT_SIGNING_INFO
207
208              • CERT_PROFILE_APPROVAL
209
210              • CERT_REQUEST_PROCESSED
211
212              • CERT_STATUS_CHANGE_REQUEST
213
214              • CERT_STATUS_CHANGE_REQUEST_PROCESSED
215
216              • CONFIG_CERT_POLICY
217
218              • PROFILE_CERT_REQUEST
219
220              • CIMC_CERT_VERIFICATION
221
222              • NON_PROFILE_CERT_REQUEST
223
224
225
226       ACL audit events:
227
228
229              • CONFIG_ACL
230
231
232
233       OCSP audit events:
234
235
236              • OCSP_SIGNING_INFO
237
238              • OCSP_GENERATION
239
240
241
242       CRL audit events:
243
244
245              • SCHEDULE_CRL_GENERATION
246
247              • DELTA_CRL_PUBLISHING
248
249              • CRL_VALIDATION
250
251              • CRL_RETRIEVAL
252
253              • CRL_SIGNING_INFO
254
255              • FULL_CRL_GENERATION
256
257              • DELTA_CRL_GENERATION
258
259
260
261       Authority audit events:
262
263
264              • AUTHORITY_CONFIG
265
266              • SECURITY_DOMAIN_UPDATE
267
268              • CONFIG_DRM
269
270
271
272       Selftest audit events:
273
274
275              • SELFTESTS_EXECUTION
276
277
278
279       Encryption data audit events:
280
281
282              • CONFIG_ENCRYPTION
283
284              • ENCRYPT_DATA_REQUEST
285
286              • ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS
287
288              • ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE
289
290              • COMPUTE_RANDOM_DATA_REQUEST
291
292              • COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE
293
294              • COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS
295
296              • SECURITY_DATA_ARCHIVAL_REQUEST
297
298
299
300       Serial/random number audit events:
301
302
303              • INTER_BOUNDARY
304
305              • CONFIG_SERIAL_NUMBER
306
307              • RANDOM_GENERATION
308
309
310

SEE ALSO

312       pki-server(8)
313           PKI server management commands
314
315

AUTHORS

317       Amol Kahat <akahat@redhat.com>.
318
319

321       Copyright (c) 2018 Red Hat, Inc.  This is licensed under the  GNU  Gen‐
322       eral  Public  License,  version  2  (GPLv2).  A copy of this license is
323       available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
324
325
326
327PKI                              Mar 21, 2018                 pki-server-ca(8)
Impressum