PKI-CA-KRACONNECTOR(1)

💅 pki-ca-kraconnector — the CA-KRA Connector Management commands, bestie edition ✨

okay so real talk: this is the man page for pki-ca-kraconnector, the command-line interface for managing CA-KRA connectors. (The manual name is pki-ca...nnector and the title is pki-ca-kraconnector — the truncation is the page's whole thing, iykyk.)

---

🌸 NAME 🌸

pki-ca-kraconnector — the command-line interface for managing CA-KRA connectors 🫶

---

⭐ SYNOPSIS ⭐

pki [CLI-options] ca-kraconnector
pki [CLI-options] ca-kraconnector-show
pki [CLI-options] ca-kraconnector-add --input-file input-file
pki [CLI-options] ca-kraconnector-add --host KRA-host --port KRA-port
pki [CLI-options] ca-kraconnector-del --host KRA-host --port KRA-port

---

🦋 DESCRIPTION 🦋

So the pki-ca-kraconnector commands give you command-line interfaces to manage CA-KRA connectors, and this command should be applied against CAs only — like, CAs and nothing else, periodt.

When keys get archived, the CA talks to the KRA through authenticated persistent connections called Connectors. Because the CA initiates the communication, the connector configuration is performed on the CA only. And here's the slay bit: a Connector is automatically configured on the issuing CA whenever a KRA is set up by pkispawn. ✨

A CA may have only one KRA connector. That one connector can be configured to talk to multiple KRAs (for high availability) — but only if the KRAs are clones. No cap.

---

👑 pki [CLI-options] ca-kraconnector

This one lists the available KRA connector commands. It's giving menu energy 🎀

---

👑 pki [CLI-options] ca-kraconnector-show

This is the one to view the configuration settings for the CA-KRA connector configured on the CA.

And here's the cute part: those details can be redirected to a file, modified as needed, and used as the input file for the ca-kraconnector-add command. Reuse icon behaviour 💅

---

👑 pki [CLI-options] ca-kraconnector-add --input-file input-file

This command configures the CA-KRA connector on the CA subsystem.

The input-file is an XML document as provided by the pki ca-kraconnector-show command.

⚠️ Listen bestie: a CA-KRA connector can only be created from an input file if a connector does not already exist. If one already exists, it should be removed first. Fr fr, no skipping this.

---

👑 pki [CLI-options] ca-kraconnector-add --host KRA-host --port KRA-port

This one adds a host to an existing CA-KRA connector. Simple, clean, iconic 🌟

---

👑 pki [CLI-options] ca-kraconnector-del --host KRA-host --port KRA-port

This deletes a host from the CA-KRA connector on a CA.

💀 Heads up: if the last KRA host is removed, the connector configuration is removed from the CA. Like, gone-gone. The whole thing dips.

---

🎀 OPTIONS 🎀

The CLI options are described in pki(1). That's it — that's the whole section, go read the other page bestie 🫶

---

🌈 OPERATIONS 🌈

To view available CA-KRA connector commands, type pki ca-kraconnector. To view each command's usage, type pki ca-kraconnector-<command> --help.

✨ Reminder: all CA-KRA connector commands must be executed as the CA administrator.

To retrieve the CA-KRA connector configuration from the CA:

$ pki <CA admin authentication> ca-kraconnector-show

One of the most common use cases for these commands is to add a KRA clone to an existing CA-KRA connector for high availability. This can be done using the pki ca-kraconnector-add command as shown:

$ pki <CA admin authentication> ca-kraconnector-add --host kra2.example.com --port 8443

To delete a KRA clone from the connector:

$ pki <CA admin authentication> ca-kraconnector-del --host kra2.example.com --port 8443

---

💖 AUTHOR 💖

Ade Lee <alee@redhat.com>. Shoutout to Ade, absolute main character 🫡

---

🍓 COPYRIGHT 🍓

Copyright (c) 2016 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.

---

okay that's the whole page bestie, you ate that 💅✨ The PKI source and version, dated June 10, 2016 (the same date as that footer on pki-ca...nnector(1)) — that's the sign-off, mwah 🎀🦋💜