COROSYNC-QNETD-CERTUTIL(8)

💖 COROSYNC-QNETD-CERTUTIL 💖

okay bestie, welcome to corosync-qnetd-certutil, straight out of the System Manager's Manual (section 8, the big-girl system administration section, we love her). She's the tool that makes your QNetd TLS certificates happen, and honestly? she's carrying the whole 'net' model on her back. 💅

✨ NAME ✨

corosync-qnetd-certutil — the tool that generates qnetd TLS certificates 🎀

🦋 SYNOPSIS 🦋

corosync-qnetd-certutil [-i|-s] [-c certificate] [-n cluster_name]

🌸 DESCRIPTION 🌸

So corosync-qnetd-certutil is basically a frontend for the NSS certutil — like, she's the cute face, certutil is the muscle behind the curtain. 🫶

She's here to generate the QNetd CA (that's Certificate Authority, iykyk), the server certificate, and to sign the cluster certificate that corosync-qdevice uses when it's running the model 'net'. No cap, that's her whole job and she does it flawlessly. ✨

👑 OPTIONS 👑

• -i — Initialize the QNetd NSS certificate database and generate the QNetd CA and server certificates. The default directory for the database is /etc/corosync/qnetd, and heads up: this directory must be writeable by the current user. The QNetd CA certificate also gets exported into the file /etc/corosync/qnetd/nssdb/qnetd-cacert.crt. 💖
• -s — Sign the cluster certificate. You absolutely need to pass the cluster name (as configured in corosync.conf) and the certificate request file — see the options below, bestie, don't skip them. The signed certificate gets written to the file /etc/corosync/qnetd/nssdb/cluster-$ClusterName.crt. 🎀
• -c — Certificate request file to sign. That's it, that's the vibe. 📄
• -G — Do not set the group write bit for new files. This one only does anything when you use it together with the -i option, periodt. It's useful when you need that extended security and it's actually viable to prohibit the daemon from changing its own configuration. Expected usage is: first set the owner of the /etc/corosync/qnetd directory to root:$COROQNETD with permissions 0750, and then create the database (as root):

# corosync-qnetd-certutil -i -G

• -n — Name of the cluster. 🏷️

🌈 NOTES 🌈

If qnetd is executed by a non root user, /etc/corosync/qnetd and all its subdirectories must be owned by (or have group access for) that given user. 🔐

And if corosync-qnetd-certutil is executed as root, she tries to copy the owner and group of /etc/corosync/qnetd onto all of the files she creates. Such a considerate icon. 👑

💜 SEE ALSO 💜

• corosync-qnetd(8)
• corosync-qdevice(8)

⭐ AUTHOR ⭐

Jan Friesse — thank you for your service, legend 🫡💖

and that's the whole page, babe ✨ this beauty is from 2016-06-28, and she lives in the COROSYNC-QNETD-CERTUTIL(8) era of the System Manager's Manual. go forth and generate those certificates, main character 🦋💅