NAME

       corosync-qnetd-certutil - tool to generate qnetd TLS certificates

SYNOPSIS

       corosync-qnetd-certutil [-i|-s] [-c certificate] [-n cluster_name]

DESCRIPTION

       corosync-qnetd-certutil  is  a  frontend  for  the  NSS  certutil, it is used for generating the QNetd CA
       (Certificate Authority), server certificate and signing cluster certificate used by corosync-qdevice when
       using the model 'net'.

OPTIONS

       -i     Initialize the QNetd NSS certificate database and generate the QNetd CA and  server  certificates.
              The default directory for the database is /etc/corosync/qnetd. This directory must be writeable by
              the    current   user.   The   QNetd   CA   certificate   is   also   exported   into   the   file
              /etc/corosync/qnetd/nssdb/qnetd-cacert.crt.

       -s     Sign the cluster certificate. It  is  necessary  to  pass  the  cluster  name  (as  configured  in
              corosync.conf)  and the certificate request file - see options below.  The signed certificate will
              be written to the file /etc/corosync/qnetd/nssdb/cluster-$ClusterName.crt

       -c     Certificate request file to sign.

       -G     Do not set group write bit for new files. This option has effect only when used together  with  -i
              option. It is useful when extended security is needed and it's viable to prohibit daemon to change
              its  configuration.  Expected  usage is to first set owner of the /etc/corosync/qnetd directory to
              root:$COROQNETD with permissions 0750 and then create database (as a root):

              # corosync-qnetd-certutil -i -G

       -n     Name of the cluster.

NOTES

       If qnetd is executed by a non root user, /etc/corosync/qnetd and its subdirectories must be owned by  (or
       have  group  access  for) the given user. If corosync-qnetd-certutil is executed as root it tries to copy
       the owner and group of /etc/corosync/qnetd to all of the created files.

SEE ALSO

       corosync-qnetd(8) corosync-qdevice(8)

AUTHOR

       Jan Friesse

                                                   2016-06-28                         COROSYNC-QNETD-CERTUTIL(8)