---
name: "corosync-qnetd-certutil"
section: "8"
platform: "linux"
package: "corosync-qnetd"
version: "3.0.3-2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/corosync-qnetd-certutil"
---

# corosync-qnetd-certutil(8)

tool to generate qnetd TLS certificates

## NAME

corosync-qnetd-certutil - tool to generate qnetd TLS certificates

## SYNOPSIS

**corosync-qnetd-certutil \[-i\|-s\] \[-c certificate\] \[-n cluster\_name\]**

## DESCRIPTION

**corosync-qnetd-certutil** is a frontend for the NSS certutil, it is used for generating the QNetd CA (Certificate Authority),  server certificate and signing cluster certificate used by **corosync-qdevice** when using the model 'net'.

## OPTIONS

- **-i**

  Initialize the QNetd NSS certificate database and generate the QNetd CA and server certificates. The default directory for the database is /etc/corosync/qnetd. This directory must be writeable by the current user. The QNetd CA certificate is also exported into the file /etc/corosync/qnetd/nssdb/qnetd-cacert.crt.

- **-s**

  Sign the cluster certificate. It is necessary to pass the cluster name (as configured in corosync.conf) and the certificate request file - see options below. The signed certificate will be written to the  file /etc/corosync/qnetd/nssdb/cluster-$ClusterName.crt

- **-c**

  Certificate request file to sign.

- **-G**

  Do not set group write bit for new files. This option has effect only when used together with **-i** option. It is useful when extended security is needed and it's viable to prohibit daemon to change its configuration. Expected usage is to first set owner of the /etc/corosync/qnetd directory to root:$COROQNETD with permissions 0750 and then create database (as a root):

  ```
  # corosync-qnetd-certutil -i -G
  ```

- **-n**

  Name of the cluster.

## NOTES

If qnetd is executed by a non root user, /etc/corosync/qnetd and its subdirectories must be owned by (or have group access for) the given user. If **corosync-qnetd-certutil** is executed as root it tries to copy the owner and group of /etc/corosync/qnetd to all of the created files.

## SEE ALSO

[**corosync-qnetd**(8)](/corosync-qnetd/8.md) [**corosync-qdevice**(8)](/corosync-qdevice/8.md)

## AUTHOR

Jan Friesse