KEYLIME_VERIFIER(8)

📦
version 7.14.3 · 4 versions
, in centos-stream 10

💖 KEYLIME_VERIFIER(8) — System Manager's Manual 💖

okay so bestie, gather round, because we're talking about keylime_verifier — the Keylime verifier service for agent attestation, and honestly? she's the main character of this whole operation. this page lives in section 8 of the System Manager's Manual, so it's a proper admin-level baddie. let's get into it 🎀

✨ NAME ✨

keylime_verifier — the Keylime verifier service, aka the one who does agent attestation. periodt. 💅

🌸 SYNOPSIS 🌸

keylime_verifier

(Most operations require root privileges, use with sudo)

ngl bestie, if you forget the sudo you're gonna have a bad time 😭

🦋 DESCRIPTION 🦋

The verifier is a long-running service that attests registered agents. that's the whole vibe — she's always on, always checking, never not attesting. 🔥

She accesses the registrar database to obtain agent data, and optionally performs measured boot evaluation and durable attestation. like, she's got range.

The way that this service does not accept command-line options — at all, zero, none — is so real of her. Its behavior is configured via configuration files and environment variables, and it is managed by keylime_tenant. so like, don't try to pass her flags, she's not that kind of girl. 🙈

🎀 CONFIGURATION 🎀

Primary configuration is read from /etc/keylime/verifier.conf (or an override via env). every single option lives under the [verifier] section, no exceptions, we stay organized in this house ✨

💜 Essentials

  • mode — the attestation mode, either pull or push. default: pull 🫶
  • uuid — a unique identifier for this verifier instance, so she never gets confused with her sisters
  • ip, port — bind address and HTTP port. use a concrete address to limit the verifier to one interface, 0.0.0.0 to listen on all IPv4 interfaces, or :: to listen on all IPv6 interfaces (which also accepts IPv4 on dual-stack hosts). very demure, very mindful of your network topology 🌈
ok so a lil moment of transparency: the original docs have a formatting oopsie right here, and we are preserving it because we don't erase history. it literally says: System Message: ERROR/3 (docs/man/keylime_verifier.8.rst:, line 38) Unexpected indentation. and then System Message: WARNING/2 (docs/man/keylime_verifier.8.rst:, line 41) Block quote ends without a blank line; unexpected unindent. the docs are lowkey fighting for their life in reStructuredText but the info is still iconic 💀

🧚 Everything Else (the full menu)

  • registrar_ip, registrar_port — the Registrar endpoint. that's where the tea comes from 🍓
  • enable_agent_mtls — enable mTLS with agents and tenant 🔥
  • tls_dir — where the TLS material lives
    • generate — auto-generate CA, client and server keys/certs under $KEYLIME_DIR/cv_ca ✨
    • default — use existing materials under $KEYLIME_DIR/cv_ca
  • server_key, server_key_password, server_cert — the server TLS files 👑
  • client_key, client_key_password, client_cert — the client TLS files
  • trusted_client_ca, trusted_server_ca — CA lists, trust but verify bestie
  • database_url — SQLAlchemy URL; the value sqlite maps to $KEYLIME_DIR/cv_data.sqlite 💖
  • database_pool_sz_ovfl — pool size, overflow (non-sqlite only, sqlite girlies sit this one out)
  • auto_migrate_db — apply DB migrations on startup, no manual labour required
  • num_workers — number of worker processes (0 = CPU count)
  • max_workers — maximum worker processes; the actual count is min(cpu_count, max_workers) (0 = no limit, default 16) 🫶
  • exponential_backoff, retry_interval, max_retries — retry behavior for agent comm, because sometimes you gotta try again
  • quote_interval — time between integrity checks, in seconds ⏱️
  • max_upload_size — upload size limit, in bytes
  • request_timeout — agent request timeout, in seconds
  • shutdown_drain_timeout — max time (seconds) to wait for in-flight operations during shutdown. she doesn't ghost mid-task 💅
  • measured_boot_policy_name, measured_boot_imports, measured_boot_evaluate — measured boot policy settings 🌸
  • severity_labels, severity_policy — revocation severity config, very serious business
  • ignore_tomtou_errors — handle ToMToU IMA entries (bool). yes it's spelled like that. no we're not changing it. 🦋
  • durable_attestation_import and related persistent_store_url, transparency_log_url, time_stamp_authority_url, time_stamp_authority_certs_path, persistent_store_format, persistent_store_encoding, transparency_log_sign_algo, signed_attributes — durable attestation, the whole extended universe 🌈
  • require_allow_list_signatures — require signed allowlists (bool) ✍️

⭐ ENVIRONMENT ⭐

  • KEYLIME_VERIFIER_CONFIG — path to verifier.conf (highest priority, she goes first in line 👑)
  • KEYLIME_LOGGING_CONFIG — path to logging.conf
  • KEYLIME_DIR — working directory (default: /var/lib/keylime) 🏠
  • KEYLIME_TEST — on/true/1 enables testing mode (looser checks; WORK_DIR becomes CWD). careful bestie, that's the vibes-off setting 😭

🌷 FILES 🌷

  • /etc/keylime/verifier.conf
  • /etc/keylime/logging.conf
  • $KEYLIME_DIR/cv_data.sqlite (when database_url = sqlite)
  • $KEYLIME_DIR/cv_ca (when tls_dir = default or generate)
  • systemd unit: keylime_verifier.service 🧚

💫 RUNTIME 💫

Start from system install:

sudo keylime_verifier

Start as a systemd service:

systemctl enable --now keylime_verifier

Open firewall ports (adjust if you changed ports):

firewall-cmd --add-port 8881/tcp
firewall-cmd --runtime-to-permanent
🔥 yes bestie, 8881/tcp — that's the port, and --runtime-to-permanent is you making it stick. don't skip the second line, i'm begging 🫶

👑 NOTES 👑

  • Verifier initializes measured boot components on startup. she's up early doing her skincare routine ✨
  • With tls_dir = generate, the verifier creates CA/keys/certs in $KEYLIME_DIR/cv_ca used by other components. sharing is caring 💖

🦄 SEE ALSO 🦄

keylime_registrar(8), keylime_tenant(1), keylime_agent(8), keylime_push_model_agent(8)

the whole friend group, honestly. iykyk 🌸

💀 BUGS 💀

Report bugs at https://github.com/keylime/keylime/issues

not me telling you to file a bug but like… if you found one, say something 🙈

🍓 AUTHOR 🍓

Keylime Developers

aaand that's the page, bestie! 💅 this manual page was dated September 2025, and it came to you from the System Manager's Manual — so go forth, attest some agents, and remember: keylime_verifier(8) ate and left no crumbs. no cap. 🎀✨🫶

📦 where this page comes from