PKI Server CLI

Overview

The pki-server command is a tool for managing PKI servers on the local machine. The command does not require an authentication, but it can only be run by the system administrator.

Server Management Commands

• PKI Server Create CLI

• PKI Server Remove CLI

• PKI Server Run CLI

• PKI Server Start CLI

• PKI Server Stop CLI

• PKI Server Restart CLI

• PKI Server Enable CLI

• PKI Server Disable CLI

• PKI Server Status CLI

• PKI Server Instance CLI

• PKI Server HTTP Connector CLI

• PKI Server Webapp CLI

NSS Management Commands

• PKI Server Password CLI

• PKI Server NSS CLI

• PKI Server JSS CLI

• PKI Server Certificate CLI

• PKI Server Nuxwdog CLI

Subsystem Management Commands

• PKI Server ACME CLI

• PKI Server CA CLI

• PKI Server KRA CLI

• PKI Server OCSP CLI

• PKI Server TKS CLI

• PKI Server TPS CLI

• PKI Server Subsystem CLI

Other Commands

• PKI Server Banner CLI

• PKI Server Migration CLI

• PKI Server Database CLI

• PKI Server Range CLI

Issues

Due to OpenLDAP changes in Fedora 29 Python is no longer able to use NSS database to establish an SSL LDAP connection. This issue might be affecting the following commands:

• pki-server ca-cert-request-find

• pki-server ca-cert-request-show

• pki-server subsystem-cert-request-find

• pki-server db-upgrade

• pki-server cert-update

• pki-server cert-fix

• pki-server cert-create

See also:

• OpenLDAP and MozNSS Compatibility Layer

• OpenLDAP: Drop MozNSS Compatibility Layer

• Bug 1557967 - OpenLDAP: Drop MozNSS Compatibility Layer

• Bug 1739124 - pki-server failed with self-signed certificates error

Workaround #1: Export CA Certificate Chain

Prior to executing the above commands export the CA signing certificate chain from the NSS database into individual certificate files, for example:

$ certutil -L -d /etc/pki/pki-tomcat/alias -n ca_signing -a > /etc/pki/pki-tomcat/alias/ca_signing.crt

Then execute the following command to generate the hash files for the certificate files:

$ openssl rehash /etc/pki/pki-tomcat/alias

Workaround #2: Disable SSL LDAP Connection

Prior to executing the above commands, disable the SSL LDAP connection first, then it can be reenabled again later.