title: php-fpm8.0.30(8)

summary: PHP FastCGI Process Manager 'PHP-FPM'

text:
# php-fpm8.0.30(8)

## NAME
php7-fpm - PHP FastCGI Process Manager 'PHP-FPM'

## SYNOPSIS
php8.0-fpm [options]

## DESCRIPTION
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. This is a variant of PHP that will run in the background as a daemon, listening for CGI requests. Output is logged to /var/log/php8.0-fpm.log.

Most options are set in the configuration file. The configuration file is /etc/php-fpm.conf. By default, php8.0-fpm will respond to CGI requests listening on localhost http port 9000. Therefore php7-fpm expects your webserver to forward all requests for '.php' files to port 9000 and you should edit your webserver configuration file appropriately.

## OPTIONS
-C

Do not chdir to the script's directory

--php-ini path|file

-c path|file

Look for php.ini file in the directory path or use the specified file

--no-php-ini

-n

No php.ini file will be used

--define foo[=bar]

-d foo[=bar]

Define INI entry foo with value bar

-e

Generate extended information for debugger/profiler

--help

-h

This help

--info

-i

PHP information and configuration

--modules

-m

Show compiled in modules

--version

-v

Version number --prefix path

-p

Specify alternative prefix path (the default is /usr)

--pid file

-g

Specify the PID file location.

--fpm-config file

-y

Specify alternative path to FastCGI process manager configuration file (the default is /etc/fpm/php8.0-fpm.conf)

--test

-t

Test FPM configuration file and exit If called twice (-tt), the configuration is dumped before exiting.

--daemonize

-D

Force to run in background and ignore daemonize option from configuration file.

--nodaemonize

-F

Force to stay in foreground and ignore daemonize option from configuration file.

--force-stderr

-O

Force output to stderr in nodaemonize even if stderr is not a TTY.

--allow-to-run-as-root

-R

Allow pool to run as root (disabled by default)

## FILES
php8.0-fpm.conf

The configuration file for the php7-fpm daemon.

php.ini

The standard php configuration file.

## EXAMPLES
For any unix systems which use init.d for their main process manager, you should use the init script provided to start and stop the php8.0-fpm daemon.

sudo /etc/init.d/php8.0-fpm start

For any unix systems which use systemd for their main process manager, you should use the unit file provided to start and stop the php8.0-fpm daemon.

sudo systemctl start php8.0-fpm.service

If your installation has no appropriate init script, launch php8.0-fpm with no arguments. It will launch as a daemon (background process) by default. The file /var/run/php8.0-fpm.pid determines whether php8.0-fpm is already up and running. Once started, php8.0-fpm then responds to several POSIX signals:

SIGINT,SIGTERM immediate termination SIGQUIT graceful stop

SIGUSR1 re-open log file

SIGUSR2 graceful reload of all workers + reload of fpm conf/binary

## TIPS
The php8.0-fpm CGI daemon will work well with most popular webservers, including Apache2, lighttpd and nginx.

## SEE ALSO
The php8.0-fpm website:

http://php-fpm.org

For a more or less complete description of PHP look here:

http://www.php.net/manual/

A nice introduction to PHP by Stig Bakken can be found here:

http://www.zend.com/zend/art/intro.php

## BUGS
You can view the list of known bugs or report any new bug you found at:

http://bugs.php.net

## AUTHORS
PHP-FPM SAPI was written by Andrei Nigmatulin. The mailing-lists are highload-php-en (English) and highload-php-ru (Russian).

The PHP Group: Thies C. Arntzen, Stig Bakken, Andi Gutmans, Rasmus Lerdorf, Sam Ruby, Sascha Schumann, Zeev Suraski, Jim Winstead, Andrei Zmievski.

A List of active developers can be found here:

http://www.php.net/credits.php

And last but not least PHP was developed with the help of a huge amount of contributors all around the world.

## VERSION INFORMATION
This manpage describes php8.0-fpm, version @PHP_VERSION@.

## COPYRIGHT
Copyright © The PHP Group

Copyright (c) 2007-2009, Andrei Nigmatulin

This source file is subject to version 3.01 of the PHP license, that is bundled with this package in the file LICENSE, and is available through the world-wide-web at the following url:

http://www.php.net/license/3_01.txt

If you did not receive a copy of the PHP license and are unable to obtain it through the world-wide-web, please send a note to license@php.net so we can mail you a copy immediately.


title: php-fpm8.1.34(8)

summary: PHP FastCGI Process Manager 'PHP-FPM'

text:
# php-fpm8.1.34(8)

## NAME
php7-fpm - PHP FastCGI Process Manager 'PHP-FPM'

## SYNOPSIS
php8.1-fpm [options]

## DESCRIPTION
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. This is a variant of PHP that will run in the background as a daemon, listening for CGI requests. Output is logged to /var/log/php8.1-fpm.log.

Most options are set in the configuration file. The configuration file is /etc/php-fpm.conf. By default, php8.1-fpm will respond to CGI requests listening on localhost http port 9000. Therefore php7-fpm expects your webserver to forward all requests for '.php' files to port 9000 and you should edit your webserver configuration file appropriately.

## OPTIONS
-C

Do not chdir to the script's directory

--php-ini path|file

-c path|file

Look for php.ini file in the directory path or use the specified file

--no-php-ini

-n

No php.ini file will be used

--define foo[=bar]

-d foo[=bar]

Define INI entry foo with value bar

-e

Generate extended information for debugger/profiler

--help

-h

This help

--info

-i

PHP information and configuration

--modules

-m

Show compiled in modules

--version

-v

Version number --prefix path

-p

Specify alternative prefix path (the default is /usr)

--pid file

-g

Specify the PID file location.

--fpm-config file

-y

Specify alternative path to FastCGI process manager configuration file (the default is /etc/fpm/php8.1-fpm.conf)

--test

-t

Test FPM configuration file and exit If called twice (-tt), the configuration is dumped before exiting.

--daemonize

-D

Force to run in background and ignore daemonize option from configuration file.

--nodaemonize

-F

Force to stay in foreground and ignore daemonize option from configuration file.

--force-stderr

-O

Force output to stderr in nodaemonize even if stderr is not a TTY.

--allow-to-run-as-root

-R

Allow pool to run as root (disabled by default)

## FILES
php8.1-fpm.conf

The configuration file for the php7-fpm daemon.

php.ini

The standard php configuration file.

## EXAMPLES
For any unix systems which use init.d for their main process manager, you should use the init script provided to start and stop the php8.1-fpm daemon.

sudo /etc/init.d/php8.1-fpm start

For any unix systems which use systemd for their main process manager, you should use the unit file provided to start and stop the php8.1-fpm daemon.

sudo systemctl start php8.1-fpm.service

If your installation has no appropriate init script, launch php8.1-fpm with no arguments. It will launch as a daemon (background process) by default. The file /var/run/php8.1-fpm.pid determines whether php8.1-fpm is already up and running. Once started, php8.1-fpm then responds to several POSIX signals:

SIGINT,SIGTERM immediate termination SIGQUIT graceful stop

SIGUSR1 re-open log file

SIGUSR2 graceful reload of all workers + reload of fpm conf/binary

## TIPS
The PHP-FPM CGI daemon will work well with most popular webservers, including Apache2, lighttpd and nginx.

## SEE ALSO
The PHP-FPM website:

http://php-fpm.org

For a more or less complete description of PHP look here:

http://www.php.net/manual/

A nice introduction to PHP by Stig Bakken can be found here:

http://www.zend.com/zend/art/intro.php

## BUGS
You can view the list of known bugs or report any new bug you found at:

http://bugs.php.net

## AUTHORS
PHP-FPM SAPI was written by Andrei Nigmatulin. The mailing-lists are highload-php-en (English) and highload-php-ru (Russian).

The PHP Group: Thies C. Arntzen, Stig Bakken, Andi Gutmans, Rasmus Lerdorf, Sam Ruby, Sascha Schumann, Zeev Suraski, Jim Winstead, Andrei Zmievski.

A List of active developers can be found here:

http://www.php.net/credits.php

And last but not least PHP was developed with the help of a huge amount of contributors all around the world.

## VERSION INFORMATION
This manpage describes php8.1-fpm, version @PHP_VERSION@.

## COPYRIGHT
Copyright © The PHP Group

Copyright (c) 2007-2009, Andrei Nigmatulin

This source file is subject to version 3.01 of the PHP license, that is bundled with this package in the file LICENSE, and is available through the world-wide-web at the following url:

https://www.php.net/license/3_01.txt

If you did not receive a copy of the PHP license and are unable to obtain it through the world-wide-web, please send a note to license@php.net so we can mail you a copy immediately.


title: php-fpm8.2.31(8)

summary: PHP FastCGI Process Manager 'PHP-FPM'

text:
# php-fpm8.2.31(8)

## NAME
php7-fpm - PHP FastCGI Process Manager 'PHP-FPM'

## SYNOPSIS
php8.2-fpm [options]

## DESCRIPTION
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. This is a variant of PHP that will run in the background as a daemon, listening for CGI requests. Output is logged to /var/log/php8.2-fpm.log.

Most options are set in the configuration file. The configuration file is /etc/php-fpm.conf. By default, php8.2-fpm will respond to CGI requests listening on localhost http port 9000. Therefore php7-fpm expects your webserver to forward all requests for '.php' files to port 9000 and you should edit your webserver configuration file appropriately.

## OPTIONS
-C

Do not chdir to the script's directory

--php-ini path|file

-c path|file

Look for php.ini file in the directory path or use the specified file

--no-php-ini

-n

No php.ini file will be used

--define foo[=bar]

-d foo[=bar]

Define INI entry foo with value bar

-e

Generate extended information for debugger/profiler

--help

-h

This help

--info

-i

PHP information and configuration

--modules

-m

Show compiled in modules

--version

-v

Version number

--prefix path

-p

Specify alternative prefix path (the default is /usr)

--pid file

-g

Specify the PID file location.

--fpm-config file

-y

Specify alternative path to FastCGI process manager configuration file (the default is /etc/fpm/php8.2-fpm.conf)

--test

-t

Test FPM configuration file and exit If called twice (-tt), the configuration is dumped before exiting.

--daemonize

-D

Force to run in background and ignore daemonize option from configuration file.

--nodaemonize

-F

Force to stay in foreground and ignore daemonize option from configuration file.

--force-stderr

-O

Force output to stderr in nodaemonize even if stderr is not a TTY.

--allow-to-run-as-root

-R

Allow pool to run as root (disabled by default)

## FILES
php8.2-fpm.conf

The configuration file for the php7-fpm daemon.

php.ini

The standard php configuration file.

## EXAMPLES
For any unix systems which use init.d for their main process manager, you should use the init script provided to start and stop the php8.2-fpm daemon.

sudo /etc/init.d/php8.2-fpm start

For any unix systems which use systemd for their main process manager, you should use the unit file provided to start and stop the php8.2-fpm daemon.

sudo systemctl start php8.2-fpm.service

If your installation has no appropriate init script, launch php8.2-fpm with no arguments. It will launch as a daemon (background process) by default. The file /var/run/php8.2-fpm.pid determines whether php8.2-fpm is already up and running. Once started, php8.2-fpm then responds to several POSIX signals:

SIGINT,SIGTERM immediate termination SIGQUIT graceful stop

SIGUSR1 re-open log file

SIGUSR2 graceful reload of all workers + reload of fpm conf/binary

## TIPS
The PHP-FPM CGI daemon will work well with most popular webservers, including Apache2, lighttpd and nginx.

## SEE ALSO
The PHP-FPM website:

http://php-fpm.org

For a more or less complete description of PHP look here:

http://www.php.net/manual/

A nice introduction to PHP by Stig Bakken can be found here:

http://www.zend.com/zend/art/intro.php

## BUGS
You can view the list of known bugs or report any new bug you found at:

https://github.com/php/php-src/issues

## AUTHORS
PHP-FPM SAPI was written by Andrei Nigmatulin. The mailing-lists are highload-php-en (English) and highload-php-ru (Russian).

The PHP Group: Thies C. Arntzen, Stig Bakken, Andi Gutmans, Rasmus Lerdorf, Sam Ruby, Sascha Schumann, Zeev Suraski, Jim Winstead, Andrei Zmievski.

A List of active developers can be found here:

http://www.php.net/credits.php

And last but not least PHP was developed with the help of a huge amount of contributors all around the world.

## VERSION INFORMATION
This manpage describes php8.2-fpm, version @PHP_VERSION@.

## COPYRIGHT
Copyright © The PHP Group

Copyright (c) 2007-2009, Andrei Nigmatulin

This source file is subject to version 3.01 of the PHP license, that is bundled with this package in the file LICENSE, and is available through the world-wide-web at the following url:

https://www.php.net/license/3_01.txt

If you did not receive a copy of the PHP license and are unable to obtain it through the world-wide-web, please send a note to license@php.net so we can mail you a copy immediately.


title: php-fpm8.3.31(8)

summary: PHP FastCGI Process Manager 'PHP-FPM'

text:
# php-fpm8.3.31(8)

## NAME
php7-fpm - PHP FastCGI Process Manager 'PHP-FPM'

## SYNOPSIS
php8.3-fpm [options]

## DESCRIPTION
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. This is a variant of PHP that will run in the background as a daemon, listening for CGI requests. Output is logged to /var/log/php8.3-fpm.log.

Most options are set in the configuration file. The configuration file is /etc/php-fpm.conf. By default, php8.3-fpm will respond to CGI requests listening on localhost http port 9000. Therefore php7-fpm expects your webserver to forward all requests for '.php' files to port 9000 and you should edit your webserver configuration file appropriately.

## OPTIONS
-C

Do not chdir to the script's directory

--php-ini path|file

-c path|file

Look for php.ini file in the directory path or use the specified file

--no-php-ini

-n

No php.ini file will be used

--define foo[=bar]

-d foo[=bar]

Define INI entry foo with value bar

-e

Generate extended information for debugger/profiler

--help

-h

This help

--info

-i

PHP information and configuration

--modules

-m

Show compiled in modules

--version

-v

Version number

--prefix path

-p

Specify alternative prefix path (the default is /usr)

--pid file

-g

Specify the PID file location.

--fpm-config file

-y

Specify alternative path to FastCGI process manager configuration file (the default is /etc/fpm/php8.3-fpm.conf)

--test

-t

Test FPM configuration file and exit If called twice (-tt), the configuration is dumped before exiting.

--daemonize

-D

Force to run in background and ignore daemonize option from configuration file.

--nodaemonize

-F

Force to stay in foreground and ignore daemonize option from configuration file.

--force-stderr

-O

Force output to stderr in nodaemonize even if stderr is not a TTY.

--allow-to-run-as-root

-R

Allow pool to run as root (disabled by default)

## FILES
php8.3-fpm.conf

The configuration file for the php7-fpm daemon.

php.ini

The standard php configuration file.

## EXAMPLES
For any unix systems which use init.d for their main process manager, you should use the init script provided to start and stop the php8.3-fpm daemon.

sudo /etc/init.d/php8.3-fpm start

For any unix systems which use systemd for their main process manager, you should use the unit file provided to start and stop the php8.3-fpm daemon.

sudo systemctl start php8.3-fpm.service

If your installation has no appropriate init script, launch php8.3-fpm with no arguments. It will launch as a daemon (background process) by default. The file /var/run/php8.3-fpm.pid determines whether php8.3-fpm is already up and running. Once started, php8.3-fpm then responds to several POSIX signals:

SIGINT,SIGTERM immediate termination SIGQUIT graceful stop

SIGUSR1 re-open log file

SIGUSR2 graceful reload of all workers + reload of fpm conf/binary

## TIPS
The PHP-FPM CGI daemon will work well with most popular webservers, including Apache2, lighttpd and nginx.

## SEE ALSO
The PHP-FPM website:

http://php-fpm.org

For a more or less complete description of PHP look here:

http://www.php.net/manual/

A nice introduction to PHP by Stig Bakken can be found here:

http://www.zend.com/zend/art/intro.php

## BUGS
You can view the list of known bugs or report any new bug you found at:

https://github.com/php/php-src/issues

## AUTHORS
PHP-FPM SAPI was written by Andrei Nigmatulin. The mailing-lists are highload-php-en (English) and highload-php-ru (Russian).

The PHP Group: Thies C. Arntzen, Stig Bakken, Andi Gutmans, Rasmus Lerdorf, Sam Ruby, Sascha Schumann, Zeev Suraski, Jim Winstead, Andrei Zmievski.

A List of active developers can be found here:

http://www.php.net/credits.php

And last but not least PHP was developed with the help of a huge amount of contributors all around the world.

## VERSION INFORMATION
This manpage describes php8.3-fpm, version @PHP_VERSION@.

## COPYRIGHT
Copyright © The PHP Group

Copyright (c) 2007-2009, Andrei Nigmatulin

This source file is subject to version 3.01 of the PHP license, that is bundled with this package in the file LICENSE, and is available through the world-wide-web at the following url:

https://www.php.net/license/3_01.txt

If you did not receive a copy of the PHP license and are unable to obtain it through the world-wide-web, please send a note to license@php.net so we can mail you a copy immediately.


identd

package: pidentd

title: identd(8)

summary: TCP/IP IDENT protocol server

text:
# identd(8)

## NAME
identd, in.identd - TCP/IP IDENT protocol server

## SYNOPSIS
[in.]identd [options]

## DESCRIPTION
Identd is a server which implements the TCP/IP proposed standard IDENT user identification protocol as specified in the RFC 1413 document.

identd operates by looking up specific TCP/IP connections and returning the user name of the process owning the connection. It can optionally return other information instead of a user name.

## OPTIONS
-h

Display the available command line options.

-V

Displays the version and OS version it was compiled for, and then exit.

-d

Enables extra debugging messages.

-C<file>

Directs identd to parse additional configuration options from the file specified.

-i

May be used when starting the daemon by inetd with the "nowait" option (see below).

-w

May be used when starting the daemon by inetd with the "wait" option (see below).

-I

May be used when the daemon is started by init (see below).

-b

flag may be used to make the daemon run in standalone mode (see below).

-u<user>

Used to specify a user number or name to which the server should switch to after binding itself to the TCP/IP port and opening the kernel devices.

-g<group>

Used to specify a group number or name which the server should switch to after binding itself to the TCP/IP port and opening the kernel devices.

-p<port>

Used to specify an alternative TCP port to bind to, if running as a standalone daemon or started by init Can be specified by name or by number. Defaults to the IDENT port (113).

-t<limit>

Used to specify the request timeout limit. This is the maximum number of seconds a server will allow a client connection to be active before terminating it. It defaults to 120 seconds.

-P<pidfile>

Specify the location of a file to store the process number of the Identd daemon.

-K<nthreads>

Control the number of threads to use for kernel lookups

-L<facility>

Set the syslog facility to use instead of 'daemon'.

-o

Directs identd to return OTHER instead of UNIX as the "operating system".

-E

Enables DES encryption of the returned data (see below for more information).

-n

Directs identd to always return user numbers instead of user names (for example if you wish to keep the user names a secret).

-N

Directs identd to check for a file ".noident" in each home directory for the user which the daemon is about to return the user name for. It that file exists then the daemon will give the error HIDDEN-USER instead of the normal USERID response.

-e

Enables certain non-standard protocol extensions. Currently defined extensions include the requests VERSION to return the Ident daemon version and QUIT to terminate a session (useful in conjunction with the -m option).

-m

Enables identd to use a mode of operation that will allow multiple requests to be processed per session. Each request is specified one per line and the responses will be returned one per line. The connection will not be closed until the connecting part closes it's end of the line.

## INSTALLATION
The prefered way to start identd depends on how it was built.

If it was built with support for multithreading then it should be started either from init , as a standalone daemon or from inetd using the "wait" mode (if your inetd supports it!)

If it was built without support for multithreading then it should be started from inetd using the normal "nowait" mode for "stream tcp" services. (The main reason being that it will be single-threaded, so it will only serve one client connection at a time).

identd normally will autodetect how it was invoked so there normally is no need to use the four command line switches (-i, -w, -I, -b).

## ENCRYPTION
DES encryption is only available if the daemon was built with support for it enabled.

An encryption key (1024 bytes long) should be stored in the key file ( /etc/identd.key ) and it should be generated using a cryptographically safe random generator in order to be really safe. It should not contain any NUL (0x00) characters since this is used as a string to generate the real binary DES key.

This file may contain multiple 1024 byte long keys, and the server will use the last key stored in that file.

The returned token will contain the local and remote IP addresses and TCP port numbers, the local user's uid number, a timestamp, a random number, and a checksum - all encrypted using DES. The encrypted binary information is then encoded in a BASE64 string (32 characters long) and enclosed in square brackets to produce a token that is transmitted to the remote client.

The encrypted token can later be decrypted by the idecrypt command. This program will attempt to decrypt a token with all the keys stored in the key file until it succeeds (or have tried all the keys).

## CONFIGURATION FILE
The configuration file contains a list of option=value pairs.

syslog:facility = FACILITY

Set which facility to use when sending syslog messages.

server:user = USER

Set what user (and group, from the passwd database) the daemon should run as after it has opened all the kernel handles. (Default: nobody)

server:group = GROUP

Override the group id (as set by the server:user option).

server:port = PORT

Set what TCP/IP port the daemon should listen to. (Default: 113)

server:backlog = LIMIT

Set the size of the server listen() backlog limit.

server:pid-file = PATH

Set the path to the file where the server will store it's process id.

server:max-request = LIMIT

Max number of concurrent requests allowed. Default is 0 (zero) which means "no limit".

protocol:extensions = ON/OFF

Enable/disable the nonstandard protocol extensions ( VERSION and QUIT currently). Default: off

protocol:multiquery = ON/OFF

Enable/disable the multiple queries per connection feature. Default: off

protocol:timeout = SECONDS

Max number of seconds since connection or last request. If set to 0 (zero), no timeout will be used. Default: 120 seconds.

kernel:threads = LIMIT

Max number of threads doing kernel lookups concurrently. Default: 8

kernel:buffers = LIMIT

Max number of queued kernel lookup requests. Default: 32

kernel:attempts = LIMIT

Max number of times to retry a kernel lookup in case of failure. Default: 5

result:uid-only = YES/NO

Disable uid->username lookups (only return uid numbers). Default: no

result:noident = ON/OFF

Enable/disable checking for the ".noident" file in users home directories.

result:charset = CHARSET

Define the character set returned in replies. Default: "US-ASCII"

result:opsys = OPSYS

Define the operating system returned in replies. Default: "UNIX"

result:syslog-level = LEVEL

If set to anything other than "none", all request replies till be sent to the syslog service with the specificed severity level. Default: none

result:encrypt = YES/NO

Enable encryption of replies. Only available if Identd was built with a DES encryption library.

encrypt:key-file = PATH

Path to the file containing the encryption keys.

include = PATH

Include (and parse) the contents of another configuration file.

## NOTES
The username (or UID) returned ought to be the login name. However it (probably, for most architecture implementations) is the "real user ID" as stored with the process. Thus the UID returned may be different from the login name for setuid programs (or those running as root) which has done a setuid(3) call and their children. For example, it may (should?) be wrong for an incoming ftpd ; and we are probably interested in the running shell, not the telnetd for an incoming telnet session. (But of course identd returns info for outgoing connections, not incoming ones.)

## FILES
/etc/identd.conf

Contains the default configuration options for identd.

/etc/identd.pid

Contains (if enabled) the process number of the identd daemon.

/etc/identd.key

If compiled with DES encryption enabled, the 1024 first bytes of this file is used to specify the secret key for encrypting replies.

## AVAILABILITY
The daemon is free software. You can redistribute it and/or modify it as you wish - as long as you don't claim that you wrote it.

The source code for the latest version of the daemon can always be FTP'd from one of the following addresses:

Main site:

ftp://ftp.lysator.liu.se/pub/ident/servers/

Mirror:

ftp://ftp.uu.net/networking/ident/servers/

The author can be contacted at:

Email:

Peter Eriksson <pen@lysator.liu.se>

## SEE ALSO
idecrypt(8) , ikeygen(8) , authuser(3) , inetd.conf(5) ,


pki-upgrade

package: pki-base

title: pki-upgrade(8)

summary: Tool for upgrading system\-wide PKI configuration.

text:
# pki-upgrade(8)

## NAME
pki-upgrade - Tool for upgrading system-wide PKI configuration.

## SYNOPSIS
pki-upgrade [OPTIONS]

## DESCRIPTION
There are two parts to upgrading PKI system: upgrading the system configuration files used by both the client and the server processes and upgrading the server configuration files.

When upgrading PKI system, the existing system configuration files (e.g. /etc/pki/pki.conf) may need to be upgraded because the content may have changed from one version to another. The configuration upgrade is executed automatically during RPM upgrade. However, in case there is a problem, the process can also be run manually using pki-upgrade.

The system upgrade process is done incrementally using upgrade scriptlets. The upgrade process and scriptlet execution is monitored in upgrade trackers. A counter shows the latest index number for the most recently executed scriptlet; when all scriptlets have run, the component tracker shows the updated version number.

The upgrade scriptlets are stored in /usr/share/pki/upgrade/version/index-name. The version is the system version to be upgraded. The index is the script execution order. The name is the scriptlet name.

During upgrade, the scriptlets will back up all changes to the filesystem into /var/log/pki/upgrade/version/index. The version and index values indicate the scriptlet being executed. A copy of the files and folders that are being modified or removed will be stored in oldfiles. The names of the newly-added files and folders will be stored in newfiles.

The system upgrade process is tracked in /etc/pki/pki.version. The file stores the current configuration version and the last successful scriptlet index.

## OPTIONS

### General options
--silent

Upgrade in silent mode.

--status

Show upgrade status only without performing the upgrade.

--revert

Revert the last version.

-X

Show advanced options.

-v, --verbose

Run in verbose mode.

-h, --help

Show this help message.

### Advanced options
The advanced options circumvent the normal component tracking process by changing the scriptlet order or changing the tracker information.

WARNING: These options may render the system unusable.

--scriptlet-version version

Run scriptlets for a specific version only.

--scriptlet-index index

Run a specific scriptlet only.

--remove-tracker

Remove the tracker.

--reset-tracker

Reset the tracker to match the package version.

--set-tracker version

Set the tracker to a specific version.

## OPERATIONS

### Interactive mode
By default, pki-upgrade will run interactively. It will ask for a confirmation before executing each scriptlet.

```
$ pki-upgrade
```

If there is an error, it will stop and show the error.

### Silent mode
The upgrade process can also be done silently without user interaction:

```
$ pki-upgrade --silent
```

If there is an error, it will stop and show the error.

### Checking upgrade status
It is possible to check the status of a running upgrade process.

```
$ pki-upgrade --status
```

### Troubleshooting
If there is an error, rerun the upgrade in verbose mode:

```
$ pki-upgrade --verbose
```

Check the scriptlet to see which operations are being executed. Once the error is identified and corrected, the upgrade can be resumed by re-running pki-upgrade.

It is possible to rerun a failed script by itself, specifying the instance and subsystem, version, and scriptlet index:

```
$ pki-upgrade --scriptlet-version 10.0.1 --scriptlet-index 1
```

### Reverting an upgrade
If necessary, the upgrade can be reverted:

```
$ pki-upgrade --revert
```

Files and folders that were created by the scriptlet will be removed. Files and folders that were modified or removed by the scriptlet will be restored.

## FILES
/usr/sbin/pki-upgrade

## AUTHORS
Ade Lee <alee@redhat.com>, Ella Deon Lackey <dlackey@redhat.com>, and Endi S. Dewata <edewata@redhat.com>.

## COPYRIGHT
Copyright (c) 2013 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.


pki-healthcheck

package: pki-healthcheck

title: pki-healthcheck(8)

summary: Command\-Line Interface to check health of a PKI installation

text:
# pki-healthcheck(8)

## NAME
pki-healthcheck - Command-Line Interface to check health of a PKI installation

## SYNOPSIS
pki-healthcheck [CLI-options]

## DESCRIPTION
A PKI installation can be complex, therefore identifying real or potential issues can be difficult and require a lot of analysis. This tool aims to reduce the burden by attempting to identify issues in advance so that they can be corrected, ideally before the issue becomes critical.

### ORGANIZATION
The areas of the system to check are logically grouped together. This grouping is called a source. A source consists of one or more checks.

A check is as atomic as possible to limit the scope and complexity.

Each check will return a result, either a result of WARNING, ERROR, CRITICAL or SUCCESS. Returning SUCCESS tells you that the check was done and was deemed correct.

Upon failure, the output will include name of the source and name of the check that detected the failure along with a message and name/value pairs indicating the problem. If a check can't make a final determination, it throws WARNING so that it can be examined.

## OPTIONS

### COMMANDS
--list-sources

Display a list of the available sources and the checks associated with those sources.

### OPTIONAL ARGUMENTS
--source=SOURCE

Execute one or more checks within this given source.

--check=CHECK

Execute this particular check within a source. A source must be supplied as well with this option.

--output-type=[json|human]

Set the output type. Defaults to JSON.

--failures-only

Exclude SUCCESS results on output.

--severity=SEVERITY

Only report errors in the requested severity of SUCCESS, WARNING, ERROR or CRITICAL. This can be provided multiple times to search on multiple levels.

--debug

Generate additional debugging output.

### JSON OUTPUT
The output is displayed as a list of result messages for each check executed in JSON format. This could be input for a monitoring system.

--output-file=FILENAME

Write the output to this filename rather than stdout.

--indent=INDENT

Pretty-print the JSON with this indention level. This can make the output more human-readable.

### HUMAN-READABLE OUTPUT
The results are displayed in a more human-readable format.

--input-file=FILENAME

Take as input a JSON results output and convert it to a more human-readable form.

## EXIT STATUS
0 if all checks were successful

1 if any one check failed or the command failed to execute properly

## FILES
/etc/pki/healthcheck.conf

## NOTES

### CHECKS INCLUDED
Certificate sync between CS.cfg and NSS database

Checks whether the system certificates in CS.cfg and NSS database are the same

System certificate expiry

Checks the expiry status of the installed system certificates

System certificate trust flags

Checks whether the installed system certificates carry the correct Trust flags

Subsystem connectivity check

Checks whether a subsystem is running and able to respond to requests

## EXAMPLES
Execute healthcheck with the default JSON output:

pki-healthcheck

Execute healthcheck with a prettier JSON output:

pki-healthcheck --indent 2

Execute healthcheck and only display errors:

pki-healthcheck --failures-only

Execute healthcheck and display results in human-readable format:

pki-healthcheck --output-format human

Execute healthcheck and write results to a file:

pki-healthcheck --output-file /var/log/pki/healthcheck/results.json

Display in the previous report in a human-readable format:

pki-healthcheck --output-format human --input-file /var/log/pki/healthcheck/results.json

## AUTHORS
Dinesh Prasanth M K <dmoluguw@redhat.com>

## COPYRIGHT
Copyright (c) 2020 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.


pki-server

package: pki-server

title: pki-server(8)

summary: Command\-line interface for managing PKI server.

text:
# pki-server(8)

## NAME
pki-server - Command-line interface for managing PKI server.

## SYNOPSIS
pki-server [CLI-options] command [command-arguments]

## DESCRIPTION
The pki-server command provides a command-line interface allowing administrators to perform various administrative operations on PKI server. These services include starting/stopping instances, enabling/disabling subsystems, performing certain migrations and enabling/disabling startup using nuxwdog.

Operations are performed using file system utilities, and can only be performed by an administrative user on the local host. This utility does not connect to any of the server's Web interfaces.

## CLI OPTIONS
--help

Prints additional help information.

-d

Displays debug information.

-v

Displays verbose information.

## OPERATIONS
To view available commands and options, simply type pki-server.

Some commands have sub-commands. To view the sub-commands, type pki-server command. To view each command's usage, type pki-server command --help.

## FILES
/usr/sbin/pki-server

## SEE ALSO
pki-server-instance(8)

PKI instance management commands.

pki-server-subsystem(8)

PKI subsystem management commands.

pki-server-migrate(8)

PKI server migration script management commands.

pki-server-nuxwdog(8)

Commands to enable/disable startup using nuxwdog.

pki-server-cert(8)

System certificate management commands.

## AUTHORS
Ade Lee <alee@redhat.com>, and Dinesh Prasanth M K <dmoluguw@redhat.com>

## COPYRIGHT
Copyright (c) 2019 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.


pki-server-acme

title: pki-server-acme(8)

summary: Command\-line interface for managing PKI ACME responder.

text:
# pki-server-acme(8)

## NAME
pki-server-acme - Command-line interface for managing PKI ACME responder.

## SYNOPSIS
pki-server [CLI-options] acme-create [command-options]

pki-server [CLI-options] acme-remove [command-options]

pki-server [CLI-options] acme-deploy [command-options]

pki-server [CLI-options] acme-undeploy [command-options]

## DESCRIPTION
The pki-server acme commands provide command-line interfaces to manage PKI ACME responder.

pki-server [CLI-options] acme [command-options]

This command is to list available PKI ACME responder management commands.

pki-server [CLI-options] acme-create [command-options]

This command is to create the initial PKI ACME responder configuration files in PKI server.

The configuration files will be stored in in /var/lib/pki/<instance>/conf/acme folder.

The files can be customized before deployment.

pki-server [CLI-options] acme-remove [command-options]

This command is to remove PKI ACME responder configuration files from PKI server.

The /var/lib/pki/<instance>/conf/acme folder and its contents will be removed.

pki-server [CLI-options] acme-deploy [command-options]

This command is to deploy and start PKI ACME responder in PKI server.

It will create a deployment descriptor at /var/lib/pki/<instance>/conf/Catalina/localhost/acme.xml.

pki-server [CLI-options] acme-undeploy [command-options]

This command is to shutdown and undeploy PKI ACME responder from PKI server.

It will remove the deployment descriptor at /var/lib/pki/<instance>/conf/Catalina/localhost/acme.xml.

## SEE ALSO
pki-server(8)

PKI server management commands

## AUTHORS
Endi S. Dewata <endisd@redhat.com>

## COPYRIGHT
Copyright (c) 2020 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.


pki-server-ca

title: pki-server-ca(8)

summary: Command\-line interface for managing PKI CA.

text:
# pki-server-ca(8)

## NAME
pki-server-ca - Command-line interface for managing PKI CA.

## SYNOPSIS
pki-server [CLI-options] ca-cert-chain-export [command-options]

pki-server [CLI-options] ca-cert-request-find [command-options]

pki-server [CLI-options] ca-cert-request-show [command-options] request-ID

pki-server [CLI-options] ca-clone-prepare [command-options]

pki-server [CLI-options] ca-audit-event-find [command-options]

pki-server [CLI-options] ca-audit-event-enable [command-options] event-ID

pki-server [CLI-options] ca-audit-event-disable [command-options] event-ID

pki-server [CLI-options] ca-audit-event-modify [command-options] event-ID

pki-server [CLI-options] ca-audit-file-find [command-options]

pki-server [CLI-options] ca-audit-file-verify [command-options]

## DESCRIPTION
The pki-server ca commands provide command-line interfaces to manage PKI CA.

pki-server [CLI-options] ca [command-options]

This command is to list available PKI CA management commands.

pki-server [CLI-options] ca-cert-chain-export [command-options]

This command is to export CA certificates with chain and keys to PKCS #12 file.

The output filename and either password or password file are required.

pki-server [CLI-options] ca-cert-request-find [command-options]

This command will list all the certificate request in the CA.

After specifying the certificate file it will search for certificate request in the database.

It accepts certificate without any BEGIN/END CERTIFICATE header/footer.

pki-server [CLI-options] ca-cert-request-show [command-options] request-ID

This command is to show the certificate request as per certificate request ID.

It shows the Request ID, Type, Status and Request (in Base64 format).

pki-server [CLI-options] ca-clone-prepare [command-options]

This command exports CA system certificates into a PKCS #12 file with private keys.

pki-server [CLI-options] ca-audit-event-find [command-options]

This command list all the audit events which are enabled/disabled.

pki-server [CLI-options] ca-audit-event-enable [command-options] event-ID

This command will enable audit events in the CA.

pki-server [CLI-options] ca-audit-event-disable [command-options] event-ID

This command will disable audit events in the CA.

pki-server [CLI-options] ca-audit-event-modify [command-options] event-ID

This command will modify the event filter for audit events.

pki-server [CLI-options] ca-audit-file-find [command-options]

This command lists audit log files generated by the CA.

pki-server [CLI-options] ca-audit-file-verify [command-options]

This command will verify whether the signatures in the audit log files are valid.

## AUDIT EVENTS
Logging audit events:

- AUDIT_LOG_STARTUP

- AUDIT_LOG_SHUTDOWN

- AUDIT_LOG_DELETE

- LOG_PATH_CHANGE

- LOG_EXPIRATION_CHANGE

- CONFIG_SIGNED_AUDIT

Authentication and authorization audit events:

- AUTHZ

- AUTH

- ROLE_ASSUME

- CONFIG_AUTH

- CONFIG_ROLE

- ACCESS_SESSION_ESTABLISH

- ACCESS_SESSION_TERMINATED

Key audit events:

- PRIVATE_KEY_ARCHIVE_REQUEST

- PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED

- PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS

- CONFIG_TRUSTED_PUBLIC_KEY

- PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE

- KEY_RECOVERY_REQUEST

- KEY_RECOVERY_REQUEST_ASYNC

- KEY_RECOVERY_AGENT_LOGIN

- KEY_RECOVERY_REQUEST_PROCESSED

- KEY_RECOVERY_REQUEST_PROCESSED_ASYNC

- KEY_GEN_ASYMMETRIC

- COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS

- COMPUTE_SESSION_KEY_REQUEST

- COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE

- DIVERSIFY_KEY_REQUEST

- DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS

- DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE

- SERVER_SIDE_KEYGEN_REQUEST

- SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS

- SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE

CMC audit events:

- CMC_RESPONSE_SENT

- CMC_ID_POP_LINK_WITNESS

- CMC_SIGNED_REQUEST_SIG_VERIFY

- CMC_PROOF_OF_IDENTIFICATION

- CMC_REQUEST_RECEIVED

- CMC_USER_SIGNED_REQUEST_SIG_VERIFY

- PROOF_OF_POSSESSION

Profile audit events:

- CONFIG_CERT_PROFILE

- CONFIG_CRL_PROFILE

- CONFIG_OCSP_PROFILE

Certificate audit events:

- CERT_SIGNING_INFO

- CERT_PROFILE_APPROVAL

- CERT_REQUEST_PROCESSED

- CERT_STATUS_CHANGE_REQUEST

- CERT_STATUS_CHANGE_REQUEST_PROCESSED

- CONFIG_CERT_POLICY

- PROFILE_CERT_REQUEST

- CIMC_CERT_VERIFICATION

- NON_PROFILE_CERT_REQUEST

ACL audit events:

•

CONFIG_ACL

OCSP audit events:

- OCSP_SIGNING_INFO

- OCSP_GENERATION

CRL audit events:

- SCHEDULE_CRL_GENERATION

- DELTA_CRL_PUBLISHING

- CRL_VALIDATION

- CRL_RETRIEVAL

- CRL_SIGNING_INFO

- FULL_CRL_GENERATION

- DELTA_CRL_GENERATION

Authority audit events:

- AUTHORITY_CONFIG

- SECURITY_DOMAIN_UPDATE

- CONFIG_DRM

Selftest audit events:

•

SELFTESTS_EXECUTION

Encryption data audit events:

- CONFIG_ENCRYPTION

- ENCRYPT_DATA_REQUEST

- ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS

- ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE

- COMPUTE_RANDOM_DATA_REQUEST

- COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE

- COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS

- SECURITY_DATA_ARCHIVAL_REQUEST

Serial/random number audit events:

- INTER_BOUNDARY

- CONFIG_SERIAL_NUMBER

- RANDOM_GENERATION

## SEE ALSO
pki-server(8)

PKI server management commands

## AUTHORS
Amol Kahat <akahat@redhat.com>.

## COPYRIGHT
Copyright (c) 2018 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.


pki-server-cert

title: pki-server-cert(8)

summary: Command\-Line Interface for managing System Certificates.

text:
# pki-server-cert(8)

## NAME
pki-server-cert - Command-Line Interface for managing System Certificates.

## SYNOPSIS
pki-server [CLI-options] cert

pki-server [CLI-options] cert-find

pki-server [CLI-options] cert-show cert-ID

pki-server [CLI-options] cert-update cert-ID

pki-server [CLI-options] cert-create cert-ID

pki-server [CLI-options] cert-import cert-ID

pki-server [CLI-options] cert-export cert-ID

pki-server [CLI-options] cert-del cert-ID

pki-server [CLI-options] cert-fix

## DESCRIPTION
The pki-server cert commands provide command-line interfaces to manage system certificates.

pki-server cert commands perform system certificate related operations on a specific CS instance. All pki-server cert commands require specification of the cert-ID to identify the target certificate.

pki-server [CLI-options] cert

List all available cert commands.

pki-server [CLI-options] cert-find

List all available system certificates.

pki-server [CLI-options] cert-show cert-ID

Display details of a system certificate.

pki-server [CLI-options] cert-update cert-ID

Update corresponding subsystem's CS.cfg with the system certificate data and CSR from NSS db

pki-server [CLI-options] cert-create cert-ID

Create a new system certificate.

pki-server [CLI-options] cert-import cert-ID

Import a system certificate into NSS database and update the corresponding subsystem's CS.cfg.

pki-server [CLI-options] cert-export cert-ID

Export a system certificate or its CSR or its PKCS #12 to a file.

pki-server [CLI-options] cert-del cert-ID

Remove a system certificate from NSS db.

pki-server [CLI-options] cert-fix

Fix all expired certs in the PKI instance.

To view each command's usage, type pki-server cert-<command> --help.

All pki-server commands must be executed as the system administrator.

## OPTIONS
The other CLI options are described in pki-server(8).

## SEE ALSO
offline-cert-renewal(7)

## AUTHORS
Dinesh Prasanth M K <dmoluguw@redhat.com> and Endi S Dewata <edewata@redhat.com>

## COPYRIGHT
Copyright (c) 2018 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.


pki-server-instance

title: pki-server-instance(8)

summary: Command\-line interface for managing PKI server instances.

text:
# pki-server-instance(8)

## NAME
pki-server-instance - Command-line interface for managing PKI server instances.

## SYNOPSIS
pki-server [CLI-options] instance

pki-server [CLI-options] instance-cert

pki-server [CLI-options] instance-cert-export

pki-server [CLI-options] instance-find

pki-server [CLI-options] instance-show instance-ID

pki-server [CLI-options] instance-start instance-ID

pki-server [CLI-options] instance-stop instance-ID

pki-server [CLI-options] instance-migrate --tomcat version instance-ID

pki-server [CLI-options] instance-nuxwdog-enable instance-ID

pki-server [CLI-options] instance-nuxwdog-disable instance-ID

pki-server [CLI-options] instance-externalcert-add -i instance-ID --cert-file path --trust-args args --nickname nickname --token token

pki-server [CLI-options] instance-externalcert-del -i instance-ID --nickname nickname --token token

## DESCRIPTION
The pki-server instance commands provide command-line interfaces to manage PKI server instances. A PKI server instance consists of a single Apache Tomcat instance that contains one or more subsystems.

Operations that are available include: listing and showing details about local instances; starting and stopping instances; performing instance migrations; and enabling or disabling password prompted instance startup using nuxwdog.

pki-server [CLI-options] instance

This command is to list available instance commands.

pki-server [CLI-options] instance-cert

This command is to list available instance certificate commands.

pki-server [CLI-options] instance-cert-export

This command is to export system certificates and keys to a PKCS #12 file.

The output filename and either a password or a password file are required.

If no nicknames are specified, all the system certificates will be exported.

Otherwise, it is possible to extract individual certificates (with or without their keys and trust arguments),

and to append to an existing PKCS #12 file.

pki-server [CLI-options] instance-find

This command is to list local PKI server instances.

pki-server [CLI-options] instance-show instance-ID

This command is to view a details about a particular instance.

pki-server [CLI-options] instance-start instance-ID

This command is to start a PKI server instance.

Note that currently this command cannot be used to start nuxwdog-enabled instances.

pki-server [CLI-options] instance-stop instance-ID

This command is to stop a PKI server instance.

Note that currently this command cannot be used to stop nuxwdog-enabled instances.

pki-server [CLI-options] instance-migrate --tomcat version instance-ID

There are differences in configuration between Apache Tomcat 7 and Apache Tomcat 8.

This command reconfigures a PKI server instance to match the specified Tomcat version.

This command can be used to migrate initially created under Tomcat 7 when Tomcat is upgraded.

See pki-server migrate(8) for further details.

pki-server [CLI-options] instance-nuxwdog-enable instance-ID

This command is to convert a PKI server instance to start without access to a password file,

using the nuxwdog daemon. See pki-server nuxwdog(8) for further details.

pki-server [CLI-options] instance-nuxwdog-disable instance-ID

This command is to convert a PKI server instance to start with access to a password file,

rather than using the nuxwdog daemon. See pki-server nuxwdog(8) for further details.

pki-server [CLI-options] instance-externalcert-add -i instance-ID --cert-file path --trust-args args --nickname nickname --token token

This command is to add a certificate to the certificate database for a PKI server instance.

The certificate will be kept track of in the configuration file external_certs.conf,

and will automatically be exported when the system certificates are exported.

To update a certificate, the old one needs to be removed first using the delete command below.

The trust arguments are those defined for NSS databases, e.g. "CT,C,C".

See certutil(1) for more details.

pki-server [CLI-options] instance-externalcert-del -i instance-ID --nickname nickname --token token

This command is to remove a certificate from the certificate database for a PKI server instance.

## OPTIONS
The CLI options are described in pki-server(8).

## OPERATIONS
To view available instance management commands, type pki-server instance. To view each command's usage, type pki-server instance-<command> --help.

## AUTHORS
Ade Lee <alee@redhat.com>.

## COPYRIGHT
Copyright (c) 2015 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.


pki-server-kra

title: pki-server-kra(8)

summary: Command\-line interface for managing PKI KRA.

text:
# pki-server-kra(8)

## NAME
pki-server-kra - Command-line interface for managing PKI KRA.

## SYNOPSIS
pki-server [CLI-options] kra-clone-prepare [command-options]

pki-server [CLI-options] kra-audit-event-find [command-options]

pki-server [CLI-options] kra-audit-event-enable [command-options] event-ID

pki-server [CLI-options] kra-audit-event-disable [command-options] event-ID

pki-server [CLI-options] kra-audit-event-modify [command-options] event-ID

pki-server [CLI-options] kra-audit-file-find [command-options]

pki-server [CLI-options] kra-audit-file-verify [command-options]

## DESCRIPTION
The pki-server kra commands provide command-line interfaces to manage PKI KRA.

pki-server [CLI-options] kra [command-options]

This command is to list available PKI KRA management commands.

pki-server [CLI-options] kra-clone-prepare [command-options]

This command export KRA system certificates into a PKCS #12 file with private keys.

pki-server [CLI-options] kra-audit-event-find [command-options]

This command list all the audit events which are enabled/disabled.

pki-server [CLI-options] kra-audit-event-enable [command-options] event-ID

This command will enable audit events in the KRA.

pki-server [CLI-options] kra-audit-event-disable [command-options] event-ID

This command will disable audit events in the KRA.

pki-server [CLI-options] kra-audit-event-modify [command-options] event-ID

This command will modify the event filter for audit events.

pki-server [CLI-options] kra-audit-file-find [command-options]

This command lists audit logs generated by the KRA.

pki-server [CLI-options] kra-audit-file-verify [command-options]

This command will verify whether the signatures in the audit log files are valid.

## AUDIT EVENTS
Logging audit events:

- AUDIT_LOG_STARTUP

- AUDIT_LOG_SHUTDOWN

- AUDIT_LOG_DELETE

- LOG_PATH_CHANGE

- LOG_EXPIRATION_CHANGE

- CONFIG_SIGNED_AUDIT

Authentication and authorization audit events:

- AUTHZ

- AUTH

- ROLE_ASSUME

- CONFIG_AUTH

- CONFIG_ROLE

- ACCESS_SESSION_ESTABLISH

- ACCESS_SESSION_TERMINATED

Key audit events:

- PRIVATE_KEY_ARCHIVE_REQUEST

- PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED

- PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS

- CONFIG_TRUSTED_PUBLIC_KEY

- PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE

- KEY_RECOVERY_REQUEST

- KEY_RECOVERY_REQUEST_ASYNC

- KEY_RECOVERY_AGENT_LOGIN

- KEY_RECOVERY_REQUEST_PROCESSED

- KEY_RECOVERY_REQUEST_PROCESSED_ASYNC

- KEY_GEN_ASYMMETRIC

- COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS

- COMPUTE_SESSION_KEY_REQUEST

- COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE

- DIVERSIFY_KEY_REQUEST

- DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS

- DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE

- SERVER_SIDE_KEYGEN_REQUEST

- SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS

- SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE

CMC audit events:

- CMC_RESPONSE_SENT

- CMC_ID_POP_LINK_WITNESS

- CMC_SIGNED_REQUEST_SIG_VERIFY

- CMC_PROOF_OF_IDENTIFICATION

- CMC_REQUEST_RECEIVED

- CMC_USER_SIGNED_REQUEST_SIG_VERIFY

- PROOF_OF_POSSESSION

Profile audit events:

- CONFIG_CERT_PROFILE

- CONFIG_CRL_PROFILE

- CONFIG_OCSP_PROFILE

Certificate audit events:

- CERT_SIGNING_INFO

- CERT_PROFILE_APPROVAL

- CERT_REQUEST_PROCESSED

- CERT_STATUS_CHANGE_REQUEST

- CERT_STATUS_CHANGE_REQUEST_PROCESSED

- CONFIG_CERT_POLICY

- PROFILE_CERT_REQUEST

- CIMC_CERT_VERIFICATION

- NON_PROFILE_CERT_REQUEST

ACL audit events:

•

CONFIG_ACL

OCSP audit events:

- OCSP_SIGNING_INFO

- OCSP_GENERATION

CRL audit events:

- SCHEDULE_CRL_GENERATION

- DELTA_CRL_PUBLISHING

- CRL_VALIDATION

- CRL_RETRIEVAL

- CRL_SIGNING_INFO

- FULL_CRL_GENERATION

- DELTA_CRL_GENERATION

Authority audit events:

- AUTHORITY_CONFIG

- SECURITY_DOMAIN_UPDATE

- CONFIG_DRM

Selftest audit events:

•

SELFTESTS_EXECUTION

Encryption data audit events:

- CONFIG_ENCRYPTION

- ENCRYPT_DATA_REQUEST

- ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS

- ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE

- COMPUTE_RANDOM_DATA_REQUEST

- COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE

- COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS

- SECURITY_DATA_ARCHIVAL_REQUEST

Serial/random number audit events:

- INTER_BOUNDARY

- CONFIG_SERIAL_NUMBER

- RANDOM_GENERATION

## SEE ALSO
pki-server(8)

PKI server management commands

## AUTHORS
Amol Kahat <akahat@redhat.com>.

## COPYRIGHT
Copyright (c) 2018 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.


pki-server-migrate

title: pki-server-migrate(8)

summary: Command\-Line Interface to run migration scripts on PKI servers.

text:
# pki-server-migrate(8)

## NAME
pki-server-migrate - Command-Line Interface to run migration scripts on PKI servers.

## SYNOPSIS
pki-server [CLI-options] migrate [command-options]

## DESCRIPTION
Apache Tomcat instances are configured differently in Tomcat 7 and 8. pki-server migrate makes the necessary changes in the instance configuration files and symbolic links so that the instance will work with the target Tomcat version.

This command will migrate all instances to the target Apache Tomcat version. To migrate a specific instance only, use pki-server instance-migrate.

## OPTIONS
The CLI options are described in pki-server(8).

--tomcat version

Tomcat version.

## OPERATIONS
All pki-server commands must be executed as the system administrator.

## AUTHORS
Ade Lee <alee@redhat.com>.

## COPYRIGHT
Copyright (c) 2015 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.


pki-server-nuxwdog

title: pki-server-nuxwdog(8)

summary: Command\-line interface for enabling PKI server instances to start using nuxwdog.

text:
# pki-server-nuxwdog(8)

## NAME
pki-server-nuxwdog - Command-line interface for enabling PKI server instances to start using nuxwdog.

## SYNOPSIS
pki-server [CLI-options] nuxwdog

pki-server [CLI-options] nuxwdog-enable

pki-server [CLI-options] nuxwdog-disable

## DESCRIPTION
When a PKI server instance starts, it reads a plain text configuration file (i.e. /etc/pki/instance_name/password.conf) to obtain passwords needed to initialize the server. This could include passwords needed to access server keys in hardware or software cryptographic modules, or passwords to establish database connections.

While this file is protected by file and SELinux permissions, it is even more secure to remove this file entirely, and have the server prompt for these passwords on startup. This means of course that it will not be possible to start the PKI server instance unattended, including on server reboots.

nuxwdog is a mechanism to start PKI server without storing passwords in file (i.e. password.conf); but prompt the administrator for the relevant passwords. These passwords will be cached securely in the kernel keyring. If the CS instance crashes unexpectedly, systemd will attempt to restart the instance using the cached passwords.

PKI server instances need to be reconfigured to use nuxwdog to start. Not only are changes required in instance configuration files, but instances need to use a different systemd unit file to start. See details in the Operations section.

pki-server nuxwdog commands provide a mechanism to reconfigure instances to either start or not start with nuxwdog.

pki-server [CLI-options] nuxwdog

This command is to list available nuxwdog commands.

pki-server [CLI-options] nuxwdog-enable

This command is to reconfigure ALL local PKI server instances to start using nuxwdog.

To reconfigure a particular PKI server instance only, use pki-server instance-nuxwdog-enable.

pki-server [CLI-options] nuxwdog-disable

This command is to reconfigure ALL local PKI server instances to start without using nuxwdog.

To reconfigure a particular PKI server instance only, use pki-server instance-nuxwdog-disable.

Once this operation is complete, instances will need to read a password.conf file in order to start up.

## OPTIONS
The CLI options are described in pki-server(8).

## OPERATIONS
Configuring a PKI server instance to start using nuxwdog requires changes to instance configuration files such as server.xml. These changes are performed by pki-server.

Once a subsystem has been converted to using nuxwdog, the password.conf file is no longer needed. It can be removed from the filesystem. Be sure, of course, to note all passwords contained therein - some of which may be randomly generated during the install.

Note: If a subsystem stores any of its system certificates in a cryptographic token other than the internal NSS database, it will have entries in password.conf that look like hardware-TOKEN_NAME=password. In this case, an additional parameter must be added to CS.cfg.

```
cms.tokenList=TOKEN_NAME
```

When this parameter is added, nuxwdog will prompt the password for hardware-TOKEN_NAME in addition to the other passwords.

An instance that is started by nuxwdog is started by a different systemd unit file (pki-tomcatd-nuxwdog). Therefore, to start/stop/restart an instance using the following:

```
$ systemctl <start/stop/restart> pki-tomcatd-nuxwdog@<instance_id>.service
```

If the PKI server instance is converted back to not using nuxwdog to start, then the usual systemd unit scripts can be invoked:

```
$ systemctl <start/stop/restart> pki-tomcatd@<instance_id>.service
```

## SEE ALSO
pki-server(8)

PKI server management commands

## AUTHORS
Ade Lee <alee@redhat.com> and Dinesh Prasanth M K <dmoluguw@redhat.com>

## COPYRIGHT
Copyright (c) 2018 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.


pki-server-ocsp

title: pki-server-ocsp(8)

summary: Command\-line interface for managing PKI OCSP.

text:
# pki-server-ocsp(8)

## NAME
pki-server-ocsp - Command-line interface for managing PKI OCSP.

## SYNOPSIS
pki-server [CLI-options] ocsp-clone-prepare [command-options]

pki-server [CLI-options] ocsp-audit-event-find [command-options]

pki-server [CLI-options] ocsp-audit-event-enable [command-options] event-ID

pki-server [CLI-options] ocsp-audit-event-modify [command-options] event-ID

pki-server [CLI-options] ocsp-audit-event-disable [command-options] event-ID

pki-server [CLI-options] ocsp-audit-file-find [command-options]

pki-server [CLI-options] ocsp-audit-file-verify [command-options]

## DESCRIPTION
The pki-server ocsp commands provide command-line interfaces to manage PKI OCSP.

pki-server [CLI-options] ocsp [command-options]

This command is to list available PKI OCSP management commands.

pki-server [CLI-options] ocsp-clone-prepare [command-options]

This command export OCSP subsystem certificates into a PKCS #12 file with private keys.

pki-server [CLI-options] ocsp-audit-event-find [command-options]

This command list all the audit events which are enabled/disabled.

pki-server [CLI-options] ocsp-audit-event-enable [command-options] event-ID

This command will enable audit events in the OCSP.

pki-server [CLI-options] ocsp-audit-event-disable [command-options] event-ID

This command will disable audit events in the OCSP.

pki-server [CLI-options] ocsp-audit-event-modify [command-options] event-ID

This command will modify the event filter for audit events.

pki-server [CLI-options] ocsp-audit-file-find [command-options]

This command lists the audit log files generated by the OCSP.

pki-server [CLI-options] ocsp-audit-file-verify [command-options]

This command will verify whether the signatures in the audit log files are valid.

## AUDIT EVENTS
Logging audit events:

- AUDIT_LOG_STARTUP

- AUDIT_LOG_SHUTDOWN

- AUDIT_LOG_DELETE

- LOG_PATH_CHANGE

- LOG_EXPIRATION_CHANGE

- CONFIG_SIGNED_AUDIT

Authentication and authorization audit events:

- AUTHZ

- AUTH

- ROLE_ASSUME

- CONFIG_AUTH

- CONFIG_ROLE

- ACCESS_SESSION_ESTABLISH

- ACCESS_SESSION_TERMINATED

Key audit events:

- PRIVATE_KEY_ARCHIVE_REQUEST

- PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED

- PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS

- CONFIG_TRUSTED_PUBLIC_KEY

- PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE

- KEY_RECOVERY_REQUEST

- KEY_RECOVERY_REQUEST_ASYNC

- KEY_RECOVERY_AGENT_LOGIN

- KEY_RECOVERY_REQUEST_PROCESSED

- KEY_RECOVERY_REQUEST_PROCESSED_ASYNC

- KEY_GEN_ASYMMETRIC

- COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS

- COMPUTE_SESSION_KEY_REQUEST

- COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE

- DIVERSIFY_KEY_REQUEST

- DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS

- DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE

- SERVER_SIDE_KEYGEN_REQUEST

- SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS

- SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE

CMC audit events:

- CMC_RESPONSE_SENT

- CMC_ID_POP_LINK_WITNESS

- CMC_SIGNED_REQUEST_SIG_VERIFY

- CMC_PROOF_OF_IDENTIFICATION

- CMC_REQUEST_RECEIVED

- CMC_USER_SIGNED_REQUEST_SIG_VERIFY

- PROOF_OF_POSSESSION

Profile audit events:

- CONFIG_CERT_PROFILE

- CONFIG_CRL_PROFILE

- CONFIG_OCSP_PROFILE

Certificate audit events:

- CERT_SIGNING_INFO

- CERT_PROFILE_APPROVAL

- CERT_REQUEST_PROCESSED

- CERT_STATUS_CHANGE_REQUEST

- CERT_STATUS_CHANGE_REQUEST_PROCESSED

- CONFIG_CERT_POLICY

- PROFILE_CERT_REQUEST

- CIMC_CERT_VERIFICATION

- NON_PROFILE_CERT_REQUEST

ACL audit events:

•

CONFIG_ACL

OCSP audit events:

- OCSP_SIGNING_INFO

- OCSP_GENERATION

CRL audit events:

- SCHEDULE_CRL_GENERATION

- DELTA_CRL_PUBLISHING

- CRL_VALIDATION

- CRL_RETRIEVAL

- CRL_SIGNING_INFO

- FULL_CRL_GENERATION

- DELTA_CRL_GENERATION

Authority audit events:

- AUTHORITY_CONFIG

- SECURITY_DOMAIN_UPDATE

- CONFIG_DRM

Selftest audit events:

•

SELFTESTS_EXECUTION

Encryption data audit events:

- CONFIG_ENCRYPTION

- ENCRYPT_DATA_REQUEST

- ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS

- ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE

- COMPUTE_RANDOM_DATA_REQUEST

- COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE

- COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS

- SECURITY_DATA_ARCHIVAL_REQUEST

Serial/random number audit event:

- INTER_BOUNDARY

- CONFIG_SERIAL_NUMBER

- RANDOM_GENERATION

## SEE ALSO
pki-server(8)

PKI server management commands

## AUTHORS
Amol Kahat <akahat@redhat.com>.

## COPYRIGHT
Copyright (c) 2018 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.


pki-server-subsystem

title: pki-server-subsystem(8)

summary: Command\-line interface for managing PKI subsystems.

text:
# pki-server-subsystem(8)

## NAME
pki-server-subsystem - Command-line interface for managing PKI subsystems.

## SYNOPSIS
pki-server [CLI-options] subsystem

pki-server [CLI-options] subsystem-find

pki-server [CLI-options] subsystem-show subsystem-ID

pki-server [CLI-options] subsystem-enable subsystem-ID

pki-server [CLI-options] subsystem-disable subsystem-ID

pki-server [CLI-options] subsystem-cert-find subsystem-ID

pki-server [CLI-options] subsystem-cert-show subsystem-ID cert-ID

pki-server [CLI-options] subsystem-cert-export subsystem-ID cert-ID

pki-server [CLI-options] subsystem-cert-update subsystem-ID cert-ID

## DESCRIPTION
The pki-server subsystem commands provide command-line interfaces to manage PKI subsystems. A PKI server instance consists of a single Apache Tomcat instance that contains one or more PKI subsystems. Valid subsystem identifiers are ca, kra, tks, ocsp and tps. No instance may have more than one of each type of subsystem.

pki-server subsystem commands perform operations on a specific subsystem within a PKI server instance. Consequently, all pki-server subsystem commands require specification of the instance ID to completely identify the target subsystem.

Operations that are available include: listing subsystems in an instance; showing details about a subsystem; and enabling and disabling subsystems.

pki-server [CLI-options] subsystem

This command is to list available subsystem commands.

pki-server [CLI-options] subsystem-find

This command is to list subsystems within a specific instance.

pki-server [CLI-options] subsystem-show subsystem-ID

This command is to view the details about a particular subsystem.

pki-server [CLI-options] subsystem-enable subsystem-ID

This command is to enable a particular subsystem.

Each subsystem consists of a web application within the Apache Tomcat instance.

Enabling a subsystem means deploying the web application so that the application initializes

and is accessible via the HTTP and HTTPS ports for the Apache Tomcat instance.

Note: Each subsystem runs a set of self-tests on startup. If these self-tests fail, the subsystem will be disabled by undeploying the web application. The deployment status (enabled/disabled) of the subsystem can be determined from the output of pki-server subsystem-show. Once the underlying problem is fixed, the subsystem should be re-enabled using pki-server subsystem-enable.

pki-server [CLI-options] subsystem-disable subsystem-ID

This command is to disable a subsystem by undeploying the web application corresponding to the subsystem.

The subsystem will no longer be accessible through the web interfaces.

This is useful when specific subsystems need to be made inaccessible for maintenance

as Apache Tomcat allows web applications to be deployed/undeployed while the instance is still running (hot deployment).

pki-server [CLI-options] subsystem-cert-find subsystem-ID

This command is to list system certificates in a particular subsystem.

pki-server [CLI-options] subsystem-cert-show subsystem-ID cert-ID

This command is to view the details about a system certificate in a particular subsystem.

pki-server [CLI-options] subsystem-cert-export subsystem-ID cert-ID

This command is to export a system certificate in a particular subsystem.

pki-server [CLI-options] subsystem-cert-update subsystem-ID cert-ID

This command is to update a system certificate in a particular subsystem.

## OPTIONS
The CLI options are described in pki-server(8).

## OPERATIONS
To view available subsystem management commands, type pki-server subsystem. To view each command's usage, type pki-server subsystem-<command> --help.

## AUTHORS
Ade Lee <alee@redhat.com>

## COPYRIGHT
Copyright (c) 2015 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.


pki-server-tks

title: pki-server-tks(8)

summary: Command\-line interface for managing PKI TKS.

text:
# pki-server-tks(8)

## NAME
pki-server-tks - Command-line interface for managing PKI TKS.

## SYNOPSIS
pki-server [CLI-options] tks-clone-prepare [command-options]

pki-server [CLI-options] tks-audit-event-find [command-options]

pki-server [CLI-options] tks-audit-event-enable [command-options] event-ID

pki-server [CLI-options] tks-audit-event-modify [command-options] event-ID

pki-server [CLI-options] tks-audit-event-disable [command-options] event-ID

pki-server [CLI-options] tks-audit-file-find [command-options]

pki-server [CLI-options] tks-audit-file-verify [command-options]

## DESCRIPTION
The pki-server tks commands provide command-line interfaces to manage PKI TKS.

pki-server [CLI-options] tks [command-options]

This command is to list available PKI TKS management commands.

pki-server [CLI-options] tks-clone-prepare [command-options]

This command export TKS system certificates into a PKCS #12 file with private keys.

pki-server [CLI-options] tks-audit-event-find [command-options]

This command list all the audit events which are enabled/disabled.

pki-server [CLI-options] tks-audit-event-enable [command-options] event-ID

This command will enable audit events in the TKS.

pki-server [CLI-options] tks-audit-event-disable [command-options] event-ID

This command will disable audit events in the TKS.

pki-server [CLI-options] tks-audit-event-modify [command-options] event-ID

This command will modify the event filter for audit events.

pki-server [CLI-options] tks-audit-file-find [command-options]

This command lists audit log file generated by the TKS.

pki-server [CLI-options] tks-audit-file-verify [command-options]

This command will verify whether the signatures in the audit log files are valid.

## AUDIT EVENTS
Logging audit events:

- AUDIT_LOG_STARTUP

- AUDIT_LOG_SHUTDOWN

- AUDIT_LOG_DELETE

- LOG_PATH_CHANGE

- LOG_EXPIRATION_CHANGE

- CONFIG_SIGNED_AUDIT

Authentication and authorization audit events:

- AUTHZ

- AUTH

- ROLE_ASSUME

- CONFIG_AUTH

- CONFIG_ROLE

- ACCESS_SESSION_ESTABLISH

- ACCESS_SESSION_TERMINATED

Key audit events:

- PRIVATE_KEY_ARCHIVE_REQUEST

- PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED

- PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS

- CONFIG_TRUSTED_PUBLIC_KEY

- PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE

- KEY_RECOVERY_REQUEST

- KEY_RECOVERY_REQUEST_ASYNC

- KEY_RECOVERY_AGENT_LOGIN

- KEY_RECOVERY_REQUEST_PROCESSED

- KEY_RECOVERY_REQUEST_PROCESSED_ASYNC

- KEY_GEN_ASYMMETRIC

- COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS

- COMPUTE_SESSION_KEY_REQUEST

- COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE

- DIVERSIFY_KEY_REQUEST

- DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS

- DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE

- SERVER_SIDE_KEYGEN_REQUEST

- SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS

- SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE

CMC audit events:

- CMC_RESPONSE_SENT

- CMC_ID_POP_LINK_WITNESS

- CMC_SIGNED_REQUEST_SIG_VERIFY

- CMC_PROOF_OF_IDENTIFICATION

- CMC_REQUEST_RECEIVED

- CMC_USER_SIGNED_REQUEST_SIG_VERIFY

- PROOF_OF_POSSESSION

Profile audit events:

- CONFIG_CERT_PROFILE

- CONFIG_CRL_PROFILE

- CONFIG_OCSP_PROFILE

Certificate audit events:

- CERT_SIGNING_INFO

- CERT_PROFILE_APPROVAL

- CERT_REQUEST_PROCESSED

- CERT_STATUS_CHANGE_REQUEST

- CERT_STATUS_CHANGE_REQUEST_PROCESSED

- CONFIG_CERT_POLICY

- PROFILE_CERT_REQUEST

- CIMC_CERT_VERIFICATION

- NON_PROFILE_CERT_REQUEST

ACL audit events:

•

CONFIG_ACL

OCSP audit events:

- OCSP_SIGNING_INFO

- OCSP_GENERATION

CRL audit events:

- SCHEDULE_CRL_GENERATION

- DELTA_CRL_PUBLISHING

- CRL_VALIDATION

- CRL_RETRIEVAL

- CRL_SIGNING_INFO

- FULL_CRL_GENERATION

- DELTA_CRL_GENERATION

Authority audit events:

- AUTHORITY_CONFIG

- SECURITY_DOMAIN_UPDATE

- CONFIG_DRM

Selftest audit events:

•

SELFTESTS_EXECUTION

Encryption data audit events:

- CONFIG_ENCRYPTION

- ENCRYPT_DATA_REQUEST

- ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS

- ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE

- COMPUTE_RANDOM_DATA_REQUEST

- COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE

- COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS

- SECURITY_DATA_ARCHIVAL_REQUEST

Serial/random number audit events:

- INTER_BOUNDARY

- CONFIG_SERIAL_NUMBER

- RANDOM_GENERATION

## SEE ALSO
pki-server(8)

PKI server management commands

## AUTHORS
Amol Kahat <akahat@redhat.com>.

## COPYRIGHT
Copyright (c) 2018 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.


pki-server-tps

title: pki-server-tps(8)

summary: Command\-Line Interface for managing PKI TPS.

text:
# pki-server-tps(8)

## NAME
pki-server-tps - Command-Line Interface for managing PKI TPS.

## SYNOPSIS
pki-server [CLI-options] tps-clone-prepare [command-options]

pki-server [CLI-options] tps-db-vlv-find [command-options]

pki-server [CLI-options] tps-db-vlv-add [command-options]

pki-server [CLI-options] tps-db-vlv-del [command-options]

pki-server [CLI-options] tps-db-vlv-reindex [command-options]

pki-server [CLI-options] tps-audit-event-find [command-options]

pki-server [CLI-options] tps-audit-event-enable [command-options] event-ID

pki-server [CLI-options] tps-audit-event-modify [command-options] event-ID

pki-server [CLI-options] tps-audit-event-disable [command-options] event-ID

pki-server [CLI-options] tps-audit-file-find [command-options]

pki-server [CLI-options] tps-audit-file-verify [command-options]

.SH DESCRIPTION

The pki-server tps commands provide command-line interfaces to manage PKI TPS.

pki-server [CLI-options] tps [command-options]

This command is to list available PKI TPS management commands.

pki-server [CLI-options] tps-clone-prepare [command-options]

This command export TPS system certificates into a PKCS #12 file with private keys.

pki-server [CLI-options] tps-db-vlv-find [command-options]

This command will list VLV records for TPS.

pki-server [CLI-options] tps-db-vlv-add [command-options]

This command will add VLV records for TPS.

pki-server [CLI-options] tps-db-vlv-del [command-options]

This command will delete VLV records for TPS.

pki-server [CLI-options] tps-db-vlv-reindex [command-options]

This command will reindex VLV records for TPS.

pki-server [CLI-options] tps-audit-event-find [command-options]

This command list all the audit events which are enabled/disabled.

pki-server [CLI-options] tps-audit-event-enable [command-options] event-ID

This command will enable audit events in the TPS.

pki-server [CLI-options] tps-audit-event-disable [command-options] event-ID

This command will disable audit events in the TPS.

pki-server [CLI-options] tps-audit-event-modify [command-options] event-ID

This command will modify the event filter for audit events.

pki-server [CLI-options] tps-audit-file-find [command-options]

This command lists audit log files generated by the TPS.

pki-server [CLI-options] tps-audit-file-verify [command-options]

This command will verify whether the signatures in the audit log files are valid.

## AUDIT EVENTS
Logging audit events:

- AUDIT_LOG_STARTUP

- AUDIT_LOG_SHUTDOWN

- AUDIT_LOG_DELETE

- LOG_PATH_CHANGE

- LOG_EXPIRATION_CHANGE

- CONFIG_SIGNED_AUDIT

Authentication and authorization audit events:

- AUTHZ

- AUTH

- ROLE_ASSUME

- CONFIG_AUTH

- CONFIG_ROLE

- ACCESS_SESSION_ESTABLISH

- ACCESS_SESSION_TERMINATED

Key audit events:

- PRIVATE_KEY_ARCHIVE_REQUEST

- PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED

- PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS

- CONFIG_TRUSTED_PUBLIC_KEY

- PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE

- KEY_RECOVERY_REQUEST

- KEY_RECOVERY_REQUEST_ASYNC

- KEY_RECOVERY_AGENT_LOGIN

- KEY_RECOVERY_REQUEST_PROCESSED

- KEY_RECOVERY_REQUEST_PROCESSED_ASYNC

- KEY_GEN_ASYMMETRIC

- COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS

- COMPUTE_SESSION_KEY_REQUEST

- COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE

- DIVERSIFY_KEY_REQUEST

- DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS

- DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE

- SERVER_SIDE_KEYGEN_REQUEST

- SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS

- SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE

CMC audit events:

- CMC_RESPONSE_SENT

- CMC_ID_POP_LINK_WITNESS

- CMC_SIGNED_REQUEST_SIG_VERIFY

- CMC_PROOF_OF_IDENTIFICATION

- CMC_REQUEST_RECEIVED

- CMC_USER_SIGNED_REQUEST_SIG_VERIFY

- PROOF_OF_POSSESSION

Profile audit events:

- CONFIG_CERT_PROFILE

- CONFIG_CRL_PROFILE

- CONFIG_OCSP_PROFILE

Certificate audit events:

- CERT_SIGNING_INFO

- CERT_PROFILE_APPROVAL

- CERT_REQUEST_PROCESSED

- CERT_STATUS_CHANGE_REQUEST

- CERT_STATUS_CHANGE_REQUEST_PROCESSED

- CONFIG_CERT_POLICY

- PROFILE_CERT_REQUEST

- CIMC_CERT_VERIFICATION

- NON_PROFILE_CERT_REQUEST

ACL audit events:

•

CONFIG_ACL

OCSP audit events:

- OCSP_SIGNING_INFO

- OCSP_GENERATION

CRL audit events:

- SCHEDULE_CRL_GENERATION

- DELTA_CRL_PUBLISHING

- CRL_VALIDATION

- CRL_RETRIEVAL

- CRL_SIGNING_INFO

- FULL_CRL_GENERATION

- DELTA_CRL_GENERATION

Authority audit events:

- AUTHORITY_CONFIG

- SECURITY_DOMAIN_UPDATE

- CONFIG_DRM

Selftest audit events:

•

SELFTESTS_EXECUTION

Encryption data audit events:

- CONFIG_ENCRYPTION

- ENCRYPT_DATA_REQUEST

- ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS

- ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE

- COMPUTE_RANDOM_DATA_REQUEST

- COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE

- COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS

- SECURITY_DATA_ARCHIVAL_REQUEST

Serial/random number audit events:

- INTER_BOUNDARY

- CONFIG_SERIAL_NUMBER

- RANDOM_GENERATION

## AUTHORS
Amol Kahat <akahat@redhat.com>.

## COPYRIGHT
Copyright (c) 2018 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.


pki-server-upgrade

title: pki-server-upgrade(8)

text:
# pki-server-upgrade(8)

## NAME
pki-server-upgrade - Tool for upgrading PKI server configuration.

## SYNOPSIS
pki-server [CLI-options] upgrade [OPTIONS]

## DESCRIPTION
There are two parts to upgrading PKI server: upgrading the system configuration files used by both the client and the server processes and upgrading the server configuration files.

When upgrading PKI server, the existing server configuration files (e.g. server.xml, web.xml) may need to be upgraded because the content may have changed from one version to another. The configuration upgrade is executed automatically during RPM upgrade. However, in case there is a problem, the process can also be run manually using pki-server upgrade.

The server upgrade process is done incrementally using upgrade scriptlets. A server consists of the server instance itself and the subsystems running in that instance. The upgrade process executes one scriptlet at a time, running through each component (server instance and subsystem) in parallel and completing before executing the next scriptlet. If one component encounters an error, that component is skipped in the subsequent upgrade scriptlets. The upgrade process and scriptlet execution for each component is monitored in upgrade trackers. A counter shows the latest index number for the most recently executed scriptlet; when all scriptlets have run, the component tracker shows the updated version number.

The scriptlets are stored in the upgrade directory:

```
/usr/share/pki/server/upgrade/<version>/<index>-<name>
```

The version is the server version to be upgraded. The index is the script execution order. The name is the scriptlet name.

During upgrade, the scriptlets will back up all changes to the file system into the following folder:

```
/var/log/pki/server/upgrade/<version>/<index>
```

The version and index values indicate the scriptlet being executed. A copy of the files and folders that are being modified or removed will be stored in oldfiles. The names of the newly-added files and folders will be stored in newfiles.

The instance upgrade process is tracked using this file:

```
/var/lib/pki/<instance>/conf/tomcat.conf
```

The subsystem upgrade process is tracked using this file:

```
/var/lib/pki/<instance>/<subsystem>/conf/CS.cfg
```

The file stores the current configuration version and the last successful scriptlet index.

## OPTIONS

### General options
--status

Show upgrade status only without performing the upgrade.

--revert

Revert the last version.

-i, --instance instance

Upgrade a specific instance only.

-X

Show advanced options.

-v, --verbose

Run in verbose mode.

-h, --help

Show this help message.

### Advanced options
The advanced options circumvent the normal upgrade process by changing the tracker information.

WARNING: These options may render the system unusable.

--remove-tracker

Remove the tracker.

--reset-tracker

Reset the tracker to match the package version.

--set-tracker version

Set the tracker to a specific version.

## OPERATIONS

### Upgrade process
To start the upgrade process:

```
$ pki-server upgrade
```

### Upgrade status
To check the upgrade status:

```
$ pki-server upgrade --status
```

### Troubleshooting
Check the scriptlet to see which operations are being executed. Once the error is identified and corrected, the upgrade can be resumed by re-running pki-server upgrade.

If necessary, the upgrade can be run in verbose mode:

```
$ pki-server upgrade --verbose
```

It is possible to rerun a failed upgrade for a specific instance:

```
$ pki-server upgrade --instance pki-tomcat
```

### Reverting an upgrade
If necessary, the upgrade can be reverted:

```
$ pki-server upgrade --revert
```

Files and folders that were created by the scriptlet will be removed. Files and folders that were modified or removed by the scriptlet will be restored.

## AUTHORS
Ade Lee <alee@redhat.com>, Ella Deon Lackey <dlackey@redhat.com>, and Endi S. Dewata <edewata@redhat.com>.

## COPYRIGHT
Copyright (c) 2013 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.


pkidestroy

title: pkidestroy(8)

text:
# pkidestroy(8)

## NAME
pkidestroy - Removes a subsystem from an instance of PKI server.

## SYNOPSIS
pkidestroy -s subsystem -i instance [-u security_domain_username] [-W security_domain_password_file] [-h] [-v]

## DESCRIPTION
Removes a subsystem from an instance of PKI server. This utility removes any of the PKI subsystems (CA, KRA, OCSP, TKS, and TPS).

An instance can contain multiple subsystems, although it may contain at most one of each type of subsystem. So, for example, an instance could contain CA and KRA subsystems, but not two CA subsystems. If pkidestroy is invoked on the last subsystem in the instance, then that instance is removed. Typically, as subsystems need to contact the CA to update the security domain, the CA instance should be the last instance to be removed.

## OPTIONS
-s subsystem

Specifies the subsystem to be removed, where subsystem is CA, KRA, OCSP, TKS, or TPS.

If this option is not specified, pkidestroy will prompt for its value.

-i instance

Specifies the name of the instance from which the subsystem should be removed.

The instance is located at /var/log/pki/instance.

If this option is not specified, pkidestroy will prompt for its value.

-u security_domain_username

Specifies the username of the security domain of the subsystem.

This is an optional parameter.

-W security_domain_password_file

Specifies the file containing the password of the security domain of the subsystem.

This is an optional parameter.

-h, --help

Prints additional help information.

-v

Displays verbose information about the installation.

This flag can be provided multiple times to increase verbosity.

See pkidestroy -h for details.

## AUTHORS
Ade Lee <alee@redhat.com>.

## SEE ALSO
pkispawn(8)

## COPYRIGHT
Copyright (c) 2012 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.