pki-ca-profile(1)

📦
version 11.7.1 · 3 versions
, in centos-stream 9, ubuntu jammy

💅 pki-ca-profile(1) — PKI CA Profile Management Commands

Okay so bestie, welcome to the pki-ca-profile manual page — it lives in the PKI family and it's literally your command-line bestie for managing profiles on the CA. Let's get into it. ✨

🎀 NAME 🎀

pki-profile — Command-line interface for managing PKI CA profiles. Periodt. 💖

🌸 SYNOPSIS 🌸

pki [CLI-options] ca-profile
pki [CLI-options] ca-profile-find [command-options]
pki [CLI-options] ca-profile-show profile-ID [command-options]
pki [CLI-options] ca-profile-add input-file [command-options]
pki [CLI-options] ca-profile-mod input-file [command-options]
pki [CLI-options] ca-profile-del profile-ID [command-options]
pki [CLI-options] ca-profile-enable profile-ID [command-options]
pki [CLI-options] ca-profile-disable profile-ID [command-options]

🦋 DESCRIPTION 🦋

The pki ca-profile commands give you a command-line interface to manage profiles on the CA. It's giving main character energy for your certificate profiles, no cap. 👑

  • pki [CLI-options] ca-profile-find [command-options] — This command is to list the profiles. Slay, a whole list of them. 📋
  • pki [CLI-options] ca-profile-show profile-ID [command-options] — This command is to view the details of a profile. Peek behind the curtain. 👀
  • pki [CLI-options] ca-profile-add input-file [command-options] — This command is to create a new profile. New profile just dropped. 🔥
  • pki [CLI-options] ca-profile-mod input-file [command-options] — This command is to modify an existing profile. Glow-up era. 💅
  • pki [CLI-options] ca-profile-del profile-ID [command-options] — This command is to delete a profile. It's giving bye bestie. 💀
  • pki [CLI-options] ca-profile-enable profile-ID [command-options] — This command is to enable a profile. Wake it up, make it active. ⭐
  • pki [CLI-options] ca-profile-disable profile-ID [command-options] — This command is to disable a profile. Time for a lil nap. 😴

💜 OPTIONS 💜

The CLI options are described in pki(1). Go check that bestie for all the deets — this page isn't the one carrying the CLI options lore. 🫶

🌈 OPERATIONS 🌈

To view available profile commands, type pki ca-profile. To view each command's usage, type pki ca-profile-lt;commandgt; --help. No cap, that's how you learn the moves. 📖

Important vibes: All the pki ca-profile commands require CA agent authentication. Don't forget your badge, bestie. 🎟️

✨ Viewing the profiles

$ pki <CA agent authentication> ca-profile-find

The results can be paged using the --start and --size options described in pki(1). So if the list is long, page it out — we love organized scrolling. 📜

To view the contents of a profile: a set of profile inputs, profile outputs, authenticators, policies and constraints are defined in a profile. These contents can be viewed using the following command:

$ pki <CA agent authentication> ca-profile-show <profile ID>

To store the output of the above operation, the output option must be specified.

$ pki <CA agent authentication> ca-profile-show <profile ID> --output <file path>

This output file can be used for modifying the profile. It can be used as a template for certificate enrollment as well but, a more suitable template can be fetched using the pki cert-request-profile-show command. The pki cert-request-profile-show command does not require an agent/administrator level authentication and contains only the profile inputs section (which is required for certificate enrollment). So that's the lowkey better template for enrollment — noted. 🧚

🌟 Add/Modify/Delete a profile

$ pki <CA admin authentication> ca-profile-add <input file>

The contents of the input file must be in an XML format returned by the ca-profile-show command. This data will be marshaled by the CLI client to create a new profile in the CA. The profile must be disabled before it is modified. It must be enabled after modification to be used for certificate enrollment. Yes, that's the whole shebang — disable, modify, enable. Don't skip steps. ⚠️

To modify an existing profile:

$ pki <CA admin authentication> ca-profile-mod <input file>

The profile data can be retrieved using the ca-profile-show command and after editing the file, it can be provided to the profile-mod command to modify an existing profile. Edit, then mod — it's the workflow, bestie. ✏️

To delete a profile in the CA:

$ pki <CA admin authentication> ca-profile-del <profile ID>

🦋 Enabling/Disabling a profile in the CA

To enable a profile in the CA:

$ pki <CA agent authenticaton> ca-profile-enable <profile ID>

A profile must be enabled before it can be used. (Also bestie, yes, the original says "authenticaton" right there — we don't fix typos in manpages, we just vibe. 🙈)

To disable a profile in the CA:

$ pki <CA agent authentication> ca-profile-disable <profile ID>

A profile must be disabled before it can be modified. It's giving "nap time before glow-up." 😌

Note: Modifying or deleting a profile requires user(s) that have two roles (admin and agent). The same user may be in both roles. An agent is needed to first disable the profile. Once the profile is disabled, it can be modified/deleted by an admin user. Then, an agent is needed to enable the profile for use by the CA. So basically: agent to disable, admin to modify/delete, agent to enable. Two icons doing their thing — one person can hold both roles, but the sequence matters. 💅

👑 SEE ALSO 👑

🍓 AUTHORS 🍓

Abhishek Koneru lt;akoneru@redhat.comgt;. Big up to Abhishek. 🫶

Copyright (c) 2014 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt. Respect the license, bestie — it's literally iconic. ⚖️

And that's a wrap! This page came from the PKI suite, and the footer vibes are: version PKI, dated Sep 30, 2014, under the name pki-ca-profile(1). So cute, so official, so done. 💜✨🎀

📦 where this page comes from