pki-healthcheck(8)

💅 pki-healthcheck(8) — the pki-healthcheck CLI, but make it make sense

okay bestie, so you know how a PKI installation is basically a whole ecosystem of moving parts? yeah. this is the pki-healthcheck command-line interface, and it's here to check the health of your PKI installation before things go full chaos-mode. 🩺✨

✨ SYNOPSIS ✨

pki-healthcheck [CLI-options]

🦋 DESCRIPTION 🦋

A PKI installation can be complex — like, genuinely complex — so spotting a real or potential issue can be super difficult and take a lot of analysis. 😭 This tool is here to reduce that burden: it goes out and tries to identify issues in advance so you can correct them, ideally before the issue becomes critical. no cap, that's the whole vibe. 💖

🎀 ORGANIZATION 🎀

The areas of the system to check are logically grouped together. The way they group it? It's called a source. A source consists of one or more checks. 💅

A check is as atomic as possible — that's on purpose, to limit the scope and complexity. keep it cute, keep it small. 🧚

Each check returns a result, and that result is one of WARNING, ERROR, CRITICAL or SUCCESS. Returning SUCCESS tells you the check was done and was deemed correct. slay. ✅

Upon failure, the output will include the name of the source and the name of the check that detected the failure, along with a message and name/value pairs indicating the problem. And if a check can't make a final determination? It throws WARNING so it can be examined. 🙈

---

👑 OPTIONS 👑

🌸 COMMANDS 🌸

• --list-sources — Display a list of the available sources and the checks associated with those sources. literally the map of what's checkable. 🗺️

💜 OPTIONAL ARGUMENTS 💜

• --source=SOURCE — Execute one or more checks within this given source.
• --check=CHECK — Execute this particular check within a source. Bestie, a source must be supplied as well with this option. both or nothing. 🫶
• --output-type=[json|human] — Set the output type. Defaults to JSON.
• --failures-only — Exclude SUCCESS results on output. only the drama, please. 💀
• --severity=SEVERITY — Only report errors in the requested severity of SUCCESS, WARNING, ERROR or CRITICAL. This can be provided multiple times to search on multiple levels. stack 'em. 🔥
• --debug — Generate additional debugging output.

⭐ JSON OUTPUT ⭐

The output is displayed as a list of result messages for each check executed in JSON format. This could be input for a monitoring system. very main character energy for your dashboards. 📊

• --output-file=FILENAME — Write the output to this filename rather than stdout.
• --indent=INDENT — Pretty-print the JSON with this indention level. This can make the output more human-readable. ✨

🌈 HUMAN-READABLE OUTPUT 🌈

The results are displayed in a more human-readable format.

• --input-file=FILENAME — Take as input a JSON results output and convert it to a more human-readable form.

---

💀 EXIT STATUS 💀

• 0 — if all checks were successful ✅
• 1 — if any one check failed or the command failed to execute properly 😭

🍓 FILES 🍓

/etc/pki/healthcheck.conf

🧚 NOTES 🧚

🎀 CHECKS INCLUDED 🎀

• Certificate sync between CS.cfg and NSS database — Checks whether the system certificates in CS.cfg and NSS database are the same. 👀
• System certificate expiry — Checks the expiry status of the installed system certificates. ⏳
• System certificate trust flags — Checks whether the installed system certificates carry the correct Trust flags. 🚩
• Subsystem connectivity check — Checks whether a subsystem is running and able to respond to requests. 📡

---

🔥 EXAMPLES 🔥

Execute healthcheck with the default JSON output:

pki-healthcheck

Execute healthcheck with a prettier JSON output:

pki-healthcheck --indent 2

Execute healthcheck and only display errors:

pki-healthcheck --failures-only

Execute healthcheck and display results in human-readable format:

pki-healthcheck --output-format human

Execute healthcheck and write results to a file:

pki-healthcheck --output-file /var/log/pki/healthcheck/results.json

Display in the previous report in a human-readable format:

pki-healthcheck --output-format human --input-file /var/log/pki/healthcheck/results.json

side note, bestie: yes, the examples literally say --output-format — that's exactly how it's written in the manual, so I'm keeping it character for character. not me changing it. 💅

---

🫶 AUTHORS 🫶

Dinesh Prasanth M K <dmoluguw@redhat.com>

💖 COPYRIGHT 💖

Copyright (c) 2020 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.

---

and that's the whole page, bestie 🎀 — brought to you by PKI, the January 16, 2020 edition of pki-healthcheck(8). go check your health (your PKI's health, specifically). mwah 💋✨