pki-server-ca(8)

📦
version 11.9.0 · 3 versions
, in fedora 43, fedora 44

💖 pki-server-ca — the CA management command line, bestie edition 💖

okay so you found pki-server-ca(8), the section-8 manual page for the PKI CA Management Commands, and honestly? it's giving "I run the whole certificate authority and I'm not even stressed." Let's get into it 🎀

✨ NAME ✨

pki-server-ca — the command-line interface for managing a PKI CA. that's it, that's the whole vibe 💅

🌸 SYNOPSIS 🌸

pki-server [CLI-options] ca-cert-chain-export [command-options]
pki-server [CLI-options] ca-cert-request-find [command-options]
pki-server [CLI-options] ca-cert-request-show [command-options] request-ID
pki-server [CLI-options] ca-clone-prepare [command-options]
pki-server [CLI-options] ca-audit-event-find [command-options]
pki-server [CLI-options] ca-audit-event-enable [command-options] event-ID
pki-server [CLI-options] ca-audit-event-disable [command-options] event-ID
pki-server [CLI-options] ca-audit-event-modify [command-options] event-ID
pki-server [CLI-options] ca-audit-file-find [command-options]
pki-server [CLI-options] ca-audit-file-verify [command-options]

🦋 DESCRIPTION 🦋

the pki-server ca commands are the whole command-line interface for managing your PKI CA. think of them as the group chat where you can actually get stuff done. 💖

  • pki-server [CLI-options] ca [command-options] — this one just lists all the available PKI CA management commands, like a little menu of possibilities. it's the "hey what's everyone up to" of commands.
  • pki-server [CLI-options] ca-cert-chain-export [command-options] — this exports CA certificates with chain and keys into a PKCS #12 file. you gotta give it the output filename AND either a password or a password file. no password, no export, periodt.
  • pki-server [CLI-options] ca-cert-request-find [command-options] — this lists all the certificate requests in the CA. once you specify the certificate file, it goes searching for that certificate request in the database. and here's the cute part: it accepts a certificate without any BEGIN/END CERTIFICATE header/footer. lowkey convenient.
  • pki-server [CLI-options] ca-cert-request-show [command-options] request-ID — shows you the certificate request matching that certificate request ID. it reveals the Request ID, Type, Status, and the Request itself (in Base64 format). the full tea ☕
  • pki-server [CLI-options] ca-clone-prepare [command-options] — this one exports the CA system certificates into a PKCS #12 file together with private keys. clone prep, slay.
  • pki-server [CLI-options] ca-audit-event-find [command-options] — lists every audit event that's enabled or disabled. the full roster 📋
  • pki-server [CLI-options] ca-audit-event-enable [command-options] event-ID — turns audit events ON in the CA. let there be light ✨
  • pki-server [CLI-options] ca-audit-event-disable [command-options] event-ID — turns audit events OFF in the CA. bye bestie 👋
  • pki-server [CLI-options] ca-audit-event-modify [command-options] event-ID — modifies the event filter for audit events. a little glow-up for your filters 💅
  • pki-server [CLI-options] ca-audit-file-find [command-options] — lists the audit log files generated by the CA.
  • pki-server [CLI-options] ca-audit-file-verify [command-options] — verifies whether the signatures in the audit log files are actually valid. trust but verify, fr fr 🔍

👑 AUDIT EVENTS 👑

here's the full guest list. every single event, no gatekeeping 💜

📝 Logging audit events

  • AUDIT_LOG_STARTUP
  • AUDIT_LOG_SHUTDOWN
  • AUDIT_LOG_DELETE
  • LOG_PATH_CHANGE
  • LOG_EXPIRATION_CHANGE
  • CONFIG_SIGNED_AUDIT

🔐 Authentication and authorization audit events

  • AUTHZ
  • AUTH
  • ROLE_ASSUME
  • CONFIG_AUTH
  • CONFIG_ROLE
  • ACCESS_SESSION_ESTABLISH
  • ACCESS_SESSION_TERMINATED

🗝️ Key audit events

  • PRIVATE_KEY_ARCHIVE_REQUEST
  • PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED
  • PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS
  • CONFIG_TRUSTED_PUBLIC_KEY
  • PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE
  • KEY_RECOVERY_REQUEST
  • KEY_RECOVERY_REQUEST_ASYNC
  • KEY_RECOVERY_AGENT_LOGIN
  • KEY_RECOVERY_REQUEST_PROCESSED
  • KEY_RECOVERY_REQUEST_PROCESSED_ASYNC
  • KEY_GEN_ASYMMETRIC
  • COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS
  • COMPUTE_SESSION_KEY_REQUEST
  • COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE
  • DIVERSIFY_KEY_REQUEST
  • DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS
  • DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE
  • SERVER_SIDE_KEYGEN_REQUEST
  • SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS
  • SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE

📨 CMC audit events

  • CMC_RESPONSE_SENT
  • CMC_ID_POP_LINK_WITNESS
  • CMC_SIGNED_REQUEST_SIG_VERIFY
  • CMC_PROOF_OF_IDENTIFICATION
  • CMC_REQUEST_RECEIVED
  • CMC_USER_SIGNED_REQUEST_SIG_VERIFY
  • PROOF_OF_POSSESSION

🎀 Profile audit events

  • CONFIG_CERT_PROFILE
  • CONFIG_CRL_PROFILE
  • CONFIG_OCSP_PROFILE

📜 Certificate audit events

  • CERT_SIGNING_INFO
  • CERT_PROFILE_APPROVAL
  • CERT_REQUEST_PROCESSED
  • CERT_STATUS_CHANGE_REQUEST
  • CERT_STATUS_CHANGE_REQUEST_PROCESSED
  • CONFIG_CERT_POLICY
  • PROFILE_CERT_REQUEST
  • CIMC_CERT_VERIFICATION
  • NON_PROFILE_CERT_REQUEST

🚪 ACL audit events

  • CONFIG_ACL

🌈 OCSP audit events

  • OCSP_SIGNING_INFO
  • OCSP_GENERATION

🧾 CRL audit events

  • SCHEDULE_CRL_GENERATION
  • DELTA_CRL_PUBLISHING
  • CRL_VALIDATION
  • CRL_RETRIEVAL
  • CRL_SIGNING_INFO
  • FULL_CRL_GENERATION
  • DELTA_CRL_GENERATION

🏛️ Authority audit events

  • AUTHORITY_CONFIG
  • SECURITY_DOMAIN_UPDATE
  • CONFIG_DRM

🧪 Selftest audit events

  • SELFTESTS_EXECUTION

🔒 Encryption data audit events

  • CONFIG_ENCRYPTION
  • ENCRYPT_DATA_REQUEST
  • ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS
  • ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE
  • COMPUTE_RANDOM_DATA_REQUEST
  • COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE
  • COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS
  • SECURITY_DATA_ARCHIVAL_REQUEST

🔢 Serial/random number audit events

  • INTER_BOUNDARY
  • CONFIG_SERIAL_NUMBER
  • RANDOM_GENERATION

🫶 SEE ALSO 🫶

  • pki-server(8) — PKI server management commands. your other bestie, go say hi.

💜 AUTHORS 💜

Amol Kahat <akahat@redhat.com>. iconic of them, honestly.

Copyright (c) 2018 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.

that's the whole page bestie, no skips, no cuts 💖

and that's a wrap! this page came to you from PKI, dated Mar 21, 2018 — yes she's a 2018 baby and she still ate 💅✨ go manage that CA, you main character 🎀🦋

📦 where this page comes from