ipa-kra-install(1)

📦 version 4.13.4, in centos-stream 10, centos-stream 9, fedora 43, fedora 44

💖 ipa-kra-install — bestie edition 💖

okay so this one lives in the IPA Manual Pages family, and it's literally the glow-up ritual for adding a KRA to your server. sit down, grab a boba, we're doing this 🧋✨

✨ NAME ✨

ipa-kra-install — Install a KRA on a server

🌸 SYNOPSIS 🌸

ipa-kra-install [OPTION]...

like. that's it. that's the whole vibe. a command and some options 💅

🦋 DESCRIPTION 🦋

So what is this actually doing? It adds a KRA as an IPA-managed service. And before you even think about running it, know this: your IPA server has to already be installed and configured, including a CA. No CA, no KRA, no exceptions, periodt.

Now, the KRA — that's the Key Recovery Authority — is the component that securely stores secrets. And by secrets I mean passwords, symmetric keys, and private asymmetric keys. It's the back-end repository for the IPA Password Vault. Basically it's the vault's vault. iconic behavior honestly 🔐👑

⚠️ Domain level 0 is not supported anymore. not "discouraged", not "meh", just not supported. moving on bestie.

You can use ipa-kra-install to add a KRA to the existing CA, or to install the KRA service on a replica. Both valid. Both cute.

💀 KRA can only be removed along with the entire server using ipa-server-install --uninstall. so there's no little "just take the KRA off" button. it's all or nothing, iykyk. choose wisely.

🎀 OPTIONS 🎀

  • -p DM_PASSWORD, --password=DM_PASSWORD — the Directory Manager password (existing master). yes, that Directory Manager. the big one.
  • --no-host-dns — don't use DNS for hostname lookup during installation. sometimes DNS is not the moment 🙈
  • -U, --unattended — an unattended installation that will never prompt for user input. hands-off, fully autonomous, main character energy ✨
  • -v, --verbose — enable debug output when more verbose output is needed. for when you simply must know everything 👀
  • -q, --quiet — output only errors. minimal. restrained. a whole aesthetic 🎀
  • --log-file=FILE — log to the given file. receipts, but make them a file 💾
  • --pki-config-override=FILE — file containing overrides for KRA installation. your custom settings go here, bestie.

🔥 HSM OPTIONS 🔥

heads up: the token name and library path are retrieved from the existing installation. you don't pass those, they're already known. slay.

  • --token-password=TOKEN_PASSWORD — the PKCS#11 token password for the HSM. 🔑
  • --token-password-file=TOKEN_PASSWORD_FILE — the full path to a file containing the PKCS#11 token password. same password, but living in a file instead of on the command line. very discreet of you 💅

🌈 EXIT STATUS 🌈

  • 0 — if the command was successful 🎉 ate, no crumbs
  • 1 — if an error occurred 😭 we've all been there

okay and that's the whole page, you're so welcome 🫶

sign-off szn: this beauty is brought to you by the fine folks at IPA, and it's dated May 10 2017 — yes, she's been serving this hard since 2017 and she has not missed a day since. kra install supremacy, no cap, bye bestie 💖✨🎀

📦 where this page comes from