pki-tps-connector(5)

✨ pki-tps-connector(5) — PKI TPS Connector Configuration ✨

okay bestie, sit down, hydrate, because this is the manual page for pki-tps-connector and it is genuinely iconic 🫶 it's section 5 of the PKI manual, and it's all about how TPS talks to its little friends.

---

📍 LOCATION

/var/lib/pki/instance/conf/tps/CS.cfg

that's where the tea lives. that file. that one right there. 💅

---

💖 DESCRIPTION

so the TPS connector is basically the group chat between TPS and the other PKI subsystems. it's the mechanism that lets TPS communicate with them. no cap.

there are three supported connector types, and yes they're all getting their own section because they all deserve it:

• CA
• KRA
• TKS

and you define these connectors using properties in the TPS configuration file. that's it. that's the whole vibe. ✨

---

👑 CA CONNECTOR

a CA connector is defined using properties that begin with tps.connector.ca<n> — where n is a positive integer that's basically the connector's ID. like a little name tag. 🎀

• tps.connector.ca<n>.enable — this one holds a boolean value, and it tells you whether the connector is enabled or not. on or off, bestie. that's it.
• tps.connector.ca<n>.host — okay so this one depends on your setup:
  • in no-failover configuration, it holds the hostname of the CA.
  • in failover configuration, it holds a list of hostnames and port numbers of the CA subsystems. the format is hostname:port, and they're separated by spaces.
• tps.connector.ca<n>.port — in no-failover configuration, this holds the port number of the CA. (yes, just the no-failover one. that's what it says. don't @ me.)
• tps.connector.ca<n>.nickName — holds the nickname of the TPS subsystem certificate, used for SSL client authentication to the CA. your little ID badge 🪪
• tps.connector.ca<n>.minHttpConns — holds the minimum number of HTTP connections.
• tps.connector.ca<n>.maxHttpConns — holds the maximum number of HTTP connections. min and max, the classic duo 💅
• tps.connector.ca<n>.uri.<op> — holds the URI to contact CA for the operation <op>. example ops: enrollment, renewal, revoke, unrevoke, getcert.
• tps.connector.ca<n>.timeout — holds the connection timeout.
• tps.connCAList — this one is for Revocation Routing. it holds a list of ordered ca id's separated by , that the revocation attempt should be made to. example: tps.connCAList=ca1,ca2
• tps.connector.ca<n>.caNickname — also for Revocation Routing. it holds the nickname of the CA signing certificate that represents this ca<n>.
• tps.connector.ca<n>.caSKI — again for Revocation Routing. it holds the Subject Key Identifier of the CA signing certificate of this ca<n>. and listen — this value is automatically calculated by TPS once and should not need handling by the administrator. so like. hands off, bestie 🙈 it handles itself.

---

💜 KRA CONNECTOR

a KRA connector is defined using properties that begin with tps.connector.kra<n> — n again being a positive integer indicating the ID of the KRA connector. 🌸

• tps.connector.kra<n>.enable — boolean value, tells you whether the connector is enabled.
• tps.connector.kra<n>.host — same deal as CA:
  • in no-failover configuration, it holds the hostname of the KRA.
  • in failover configuration, it holds a list of hostnames and port numbers of the KRA subsystems. format is hostname:port, separated by spaces.
• tps.connector.kra<n>.port — in no-failover configuration, it holds the port number of the KRA.
• tps.connector.kra<n>.nickName — holds the nickname of the TPS subsystem certificate for SSL client authentication to the KRA.
• tps.connector.kra<n>.minHttpConns — holds the minimum number of HTTP connections.
• tps.connector.kra<n>.maxHttpConns — holds the maximum number of HTTP connections.
• tps.connector.kra<n>.uri.<op> — holds the URI to contact KRA for the operation <op>. example ops: GenerateKeyPair, TokenKeyRecovery.
• tps.connector.kra<n>.timeout — holds the connection timeout.

---

🦋 TKS CONNECTOR

a TKS connector is defined using properties that begin with tps.connector.tks<n> — and yeah, n is a positive integer indicating the ID of the TKS connector. 🧚

• tps.connector.tks<n>.enable — boolean value, whether the connector is enabled.
• tps.connector.tks<n>.host — you know the drill:
  • in no-failover configuration, it holds the hostname of the TKS.
  • in failover configuration, it holds a list of hostnames and port numbers of the TKS subsystems. format is hostname:port, separated by spaces.
• tps.connector.tks<n>.port — in no-failover configuration, it holds the port number of the TKS.
• tps.connector.tks<n>.nickName — holds the nickname of the TPS subsystem certificate for SSL client authentication to the TKS.
• tps.connector.tks<n>.minHttpConns — holds the minimum number of HTTP connections.
• tps.connector.tks<n>.maxHttpConns — holds the maximum number of HTTP connections.
• tps.connector.tks<n>.uri.<op> — holds the URI to contact TKS for the operation <op>. example ops: computeRandomData, computeSessionKey, createKeySetData, encryptData.
• tps.connector.tks<n>.timeout — holds the connection timeout.
• tps.connector.tks<n>.generateHostChallenge — boolean value, indicating whether to generate host challenge.
• tps.connector.tks<n>.serverKeygen — boolean value, indicating whether to generate keys on server side.
• tps.connector.tks<n>.keySet — holds the key set to be used on TKS.
• tps.connector.tks<n>.tksSharedSymKeyName — holds the shared secret key name.

---

🌈 EXAMPLE

here's the whole thing in action, and yes it's giving main character energy 🔥

tps.connector.ca1.enable=true
tps.connector.ca1.host=pki.example.com
tps.connector.ca1.port=8443
tps.connector.ca1.minHttpConns=1
tps.connector.ca1.maxHttpConns=15
tps.connector.ca1.nickName=subsystemCert cert-pki-tomcat TPS
tps.connector.ca1.timeout=30
tps.connector.ca1.uri.enrollment=/ca/ee/ca/profileSubmitSSLClient
tps.connector.ca1.uri.renewal=/ca/ee/ca/profileSubmitSSLClient
tps.connector.ca1.uri.revoke=/ca/ee/subsystem/ca/doRevoke
tps.connector.ca1.uri.unrevoke=/ca/ee/subsystem/ca/doUnrevoke
# in case of Revocation Routing
# note that caSKI is automatically calculated by TPS
tps.connCAList=ca1,ca2
tps.connector.ca1.caNickname=caSigningCert cert-pki-tomcat CA
tps.connector.ca1.caSKI=hAzNarQMlzit4BymAlbduZMwVCc
# ca2 connector in case of Revocation Routing
tps.connector.ca2.<etc.>

tps.connector.kra1.enable=true
tps.connector.kra1.host=pki.example.com
tps.connector.kra1.port=8443
tps.connector.kra1.minHttpConns=1
tps.connector.kra1.maxHttpConns=15
tps.connector.kra1.nickName=subsystemCert cert-pki-tomcat TPS
tps.connector.kra1.timeout=30
tps.connector.kra1.uri.GenerateKeyPair=/kra/agent/kra/GenerateKeyPair
tps.connector.kra1.uri.TokenKeyRecovery=/kra/agent/kra/TokenKeyRecovery

tps.connector.tks1.enable=true
tps.connector.tks1.host=pki.example.com
tps.connector.tks1.port=8443
tps.connector.tks1.minHttpConns=1
tps.connector.tks1.maxHttpConns=15
tps.connector.tks1.nickName=subsystemCert cert-pki-tomcat TPS
tps.connector.tks1.timeout=30
tps.connector.tks1.generateHostChallenge=true
tps.connector.tks1.serverKeygen=false
tps.connector.tks1.keySet=defKeySet
tps.connector.tks1.tksSharedSymKeyName=sharedSecret
tps.connector.tks1.uri.computeRandomData=/tks/agent/tks/computeRandomData
tps.connector.tks1.uri.computeSessionKey=/tks/agent/tks/computeSessionKey
tps.connector.tks1.uri.createKeySetData=/tks/agent/tks/createKeySetData
tps.connector.tks1.uri.encryptData=/tks/agent/tks/encryptData

---

🫶 AUTHORS

Dogtag PKI Team <devel@lists.dogtagpki.org>. absolute legends, fr fr.

---

⭐ COPYRIGHT

Copyright (c) 2014 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). a copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.

---

and that's the whole page, bestie 💖 this was the PKI manual page for pki-tps-connector(5), dated April 22, 2014 — a true classic, a little vintage, still slaying. go configure something iconic. periodt. 💅✨🌈