NAME

       pki-server-ca - Command-line interface for managing PKI CA.

SYNOPSIS

       pki-server [CLI-options] ca-cert-chain-export [command-options]
       pki-server [CLI-options] ca-cert-request-find [command-options]
       pki-server [CLI-options] ca-cert-request-show [command-options] request-ID
       pki-server [CLI-options] ca-clone-prepare [command-options]
       pki-server [CLI-options] ca-audit-event-find [command-options]
       pki-server [CLI-options] ca-audit-event-enable [command-options] event-ID
       pki-server [CLI-options] ca-audit-event-disable [command-options] event-ID
       pki-server [CLI-options] ca-audit-event-modify [command-options] event-ID
       pki-server [CLI-options] ca-audit-file-find [command-options]
       pki-server [CLI-options] ca-audit-file-verify [command-options]

DESCRIPTION

       The pki-server ca commands provide command-line interfaces to manage PKI CA.

       pki-server [CLI-options] ca [command-options]
           This command is to list available PKI CA management commands.

       pki-server [CLI-options] ca-cert-chain-export [command-options]
           This command is to export CA certificates with chain and keys to PKCS #12 file.
           The output filename and either password or password file are required.

       pki-server [CLI-options] ca-cert-request-find [command-options]
           This command will list all the certificate request in the CA.
           After  specifying  the  certificate file it will search for certificate request in the
       database.
           It accepts certificate without any BEGIN/END CERTIFICATE header/footer.

       pki-server [CLI-options] ca-cert-request-show [command-options] request-ID
           This command is to show the certificate request as per certificate request ID.
           It shows the Request ID, Type, Status and Request (in Base64 format).

       pki-server [CLI-options] ca-clone-prepare [command-options]
           This command exports CA system certificates into a PKCS #12 file with private keys.

       pki-server [CLI-options] ca-audit-event-find [command-options]
           This command list all the audit events which are enabled/disabled.

       pki-server [CLI-options] ca-audit-event-enable [command-options] event-ID
           This command will enable audit events in the CA.

       pki-server [CLI-options] ca-audit-event-disable [command-options] event-ID
           This command will disable audit events in the CA.

       pki-server [CLI-options] ca-audit-event-modify [command-options] event-ID
           This command will modify the event filter for audit events.

       pki-server [CLI-options] ca-audit-file-find [command-options]
           This command lists audit log files generated by the CA.

       pki-server [CLI-options] ca-audit-file-verify [command-options]
           This command will verify whether the signatures in the audit log files are valid.

AUDIT EVENTS

       Logging audit events:

              • AUDIT_LOG_STARTUP

              • AUDIT_LOG_SHUTDOWN

              • AUDIT_LOG_DELETE

              • LOG_PATH_CHANGE

              • LOG_EXPIRATION_CHANGE

              • CONFIG_SIGNED_AUDIT

       Authentication and authorization audit events:

              • AUTHZ

              • AUTH

              • ROLE_ASSUME

              • CONFIG_AUTH

              • CONFIG_ROLE

              • ACCESS_SESSION_ESTABLISH

              • ACCESS_SESSION_TERMINATED

       Key audit events:

              • PRIVATE_KEY_ARCHIVE_REQUEST

              • PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED

              • PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS

              • CONFIG_TRUSTED_PUBLIC_KEY

              • PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE

              • KEY_RECOVERY_REQUEST

              • KEY_RECOVERY_REQUEST_ASYNC

              • KEY_RECOVERY_AGENT_LOGIN

              • KEY_RECOVERY_REQUEST_PROCESSED

              • KEY_RECOVERY_REQUEST_PROCESSED_ASYNC

              • KEY_GEN_ASYMMETRIC

              • COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS

              • COMPUTE_SESSION_KEY_REQUEST

              • COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE

              • DIVERSIFY_KEY_REQUEST

              • DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS

              • DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE

              • SERVER_SIDE_KEYGEN_REQUEST

              • SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS

              • SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE

       CMC audit events:

              • CMC_RESPONSE_SENT

              • CMC_ID_POP_LINK_WITNESS

              • CMC_SIGNED_REQUEST_SIG_VERIFY

              • CMC_PROOF_OF_IDENTIFICATION

              • CMC_REQUEST_RECEIVED

              • CMC_USER_SIGNED_REQUEST_SIG_VERIFY

              • PROOF_OF_POSSESSION

       Profile audit events:

              • CONFIG_CERT_PROFILE

              • CONFIG_CRL_PROFILE

              • CONFIG_OCSP_PROFILE

       Certificate audit events:

              • CERT_SIGNING_INFO

              • CERT_PROFILE_APPROVAL

              • CERT_REQUEST_PROCESSED

              • CERT_STATUS_CHANGE_REQUEST

              • CERT_STATUS_CHANGE_REQUEST_PROCESSED

              • CONFIG_CERT_POLICY

              • PROFILE_CERT_REQUEST

              • CIMC_CERT_VERIFICATION

              • NON_PROFILE_CERT_REQUEST

       ACL audit events:

              • CONFIG_ACL

       OCSP audit events:

              • OCSP_SIGNING_INFO

              • OCSP_GENERATION

       CRL audit events:

              • SCHEDULE_CRL_GENERATION

              • DELTA_CRL_PUBLISHING

              • CRL_VALIDATION

              • CRL_RETRIEVAL

              • CRL_SIGNING_INFO

              • FULL_CRL_GENERATION

              • DELTA_CRL_GENERATION

       Authority audit events:

              • AUTHORITY_CONFIG

              • SECURITY_DOMAIN_UPDATE

              • CONFIG_DRM

       Selftest audit events:

              • SELFTESTS_EXECUTION

       Encryption data audit events:

              • CONFIG_ENCRYPTION

              • ENCRYPT_DATA_REQUEST

              • ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS

              • ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE

              • COMPUTE_RANDOM_DATA_REQUEST

              • COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE

              • COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS

              • SECURITY_DATA_ARCHIVAL_REQUEST

       Serial/random number audit events:

              • INTER_BOUNDARY

              • CONFIG_SERIAL_NUMBER

              • RANDOM_GENERATION

SEE ALSO

       pki-server(8)
           PKI server management commands

AUTHORS

       Amol Kahat <akahat@redhat.com>.

COPYRIGHT

       Copyright (c) 2018 Red Hat, Inc.  This is licensed under the GNU General  Public  License,
       version     2     (GPLv2).     A    copy    of    this    license    is    available    at
       http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.