KEYLIME_REGISTRAR(8)

📦
version 7.14.3 · 3 versions
, in centos-stream 10

💅 KEYLIME_REGISTRAR — the registrar service, explained

okay so bestie, welcome to keylime_registrar(8) from the System Manager's Manual ✨ this is the whole page, nothing skipped, let's go 🎀

🌸 NAME 🌸

keylime_registrar — the Keylime registrar service, aka the thing that handles agent registration 🫶

✨ SYNOPSIS ✨

keylime_registrar
heads up bestie: most operations need root privileges, so run it with sudo okay? 💅

💖 DESCRIPTION 💖

So the registrar is a long-running service that agents talk to. That's its whole deal, it just vibes there, running, forever, being useful 💜

It keeps its own database where it stores the data of all the registered agents — like a little scrapbook of everyone who signed up 🎀

And here's the thing: the service does not accept command-line options. Not a single flag. Zero. It does not want your CLI energy. Instead:

  • behavior is configured via configuration files and environment variables
  • and it's managed by keylime tenant

periodt 💅

🦋 CONFIGURATION 🦋

Primary config lives at /etc/keylime/registrar.conf (or you can override it via env — more on that below 👀). All the options live under the [registrar] section.

🌟 Essential configuration options 🌟

  • ip — bind address, aka where it's listening from
  • port — the HTTP port
  • tls_port — the HTTPS port
  • tls_dir — where the TLS material lives. Value generate means auto-generate the CA, keys and certs under $KEYLIME_DIR/reg_ca; value default means the shared verifier CA under $KEYLIME_DIR/cv_ca
  • server_key, server_key_password, server_cert, trusted_client_ca — the TLS files, that's the whole vibe
  • database_url — a SQLAlchemy URL. Fun fact: the value sqlite maps to $KEYLIME_DIR/reg_data.sqlite 🍓
  • database_pool_sz_ovfl — pool size and overflow (non-sqlite only, iykyk)
  • max_workers — maximum worker processes. The actual count is min(cpu_count, max_workers), and 0 means no limit, default is 16 ✨
  • auto_migrate_db — apply DB migrations on startup
  • max_upload_size — request body limit, in bytes
  • tpm_identity — the allowed identity. Options are default, ek_cert_or_iak_idevid, ek_cert, iak_idevid 👑
  • malformed_cert_action — warn (the default), reject, or ignore. lowkey dramatic but okay
  • durable_attestation_import (optional) — a Python import path to enable Durable Attestation

🌈 ENVIRONMENT 🌈

  • KEYLIME_REGISTRAR_CONFIG — path to registrar.conf, and it's got the highest priority 👑
  • KEYLIME_LOGGING_CONFIG — path to logging.conf
  • KEYLIME_DIR — working directory, default is /var/lib/keylime
  • KEYLIME_TEST — on/true/1 enables testing mode (looser checks, and WORK_DIR becomes CWD) 🙈

🎀 FILES 🎀

  • /etc/keylime/registrar.conf — the registrar configuration file
  • /etc/keylime/logging.conf — logging configuration
  • $KEYLIME_DIR/reg_data.sqlite — the database file when database_url = sqlite
  • $KEYLIME_DIR/reg_ca — TLS certificates when tls_dir = generate
  • $KEYLIME_DIR/cv_ca — shared verifier certificates when tls_dir = default

🔥 RUNTIME 🔥

Starting it from a system install, iconic behavior only:

sudo keylime_registrar

Starting it as a systemd service, main character energy:

systemctl enable --now keylime_registrar

Opening the firewall ports (adjust these if you changed your ports, bestie, don't come for me):

firewall-cmd --add-port=8890/tcp --add-port=8891/tcp
firewall-cmd --runtime-to-permanent

⭐ NOTES ⭐

  • HTTPS is required for routes unless it's explicitly allowed insecure by the service. no cap 🔒
  • With tls_dir = default, start the verifier before the registrar so the shared CA/certs exist in $KEYLIME_DIR/cv_ca — otherwise you're gonna have a bad time 😭
  • The service forks worker processes (default: CPU count, capped by max_workers)
  • Registrar and verifier may run on the same host or on separate hosts — flexible queen behavior 💅

💜 SEE ALSO 💜

keylime_verifier(8), keylime_tenant(1), keylime_agent(8)

🐛 BUGS 🐛

Found a bug? Report it at https://github.com/keylime/keylime/issues — they wanna hear from you fr fr 🫶

👑 AUTHOR 👑

Keylime Developers — the legends behind all of this 🌟

and that's the whole page bestie, no crumbs left 🍓 this edition dropped September 2025, it's KEYLIME_REGISTRAR(8) and it ate, periodt 💖✨

📦 where this page comes from