--- name: "pki-server-ca" section: "8" platform: "linux" package: "pki-ca" version: "10.10.2-3" release: "Debian 11 (Bullseye)" platforms: ["linux"] url: "https://new.carta.tech/pki-server-ca" --- # pki-server-ca(8) Command-line interface for managing PKI CA. ## NAME pki-server-ca - Command-line interface for managing PKI CA. ## SYNOPSIS **pki-server** \[*CLI-options*\] **ca-cert-chain-export** \[*command-options*\]\ **pki-server** \[*CLI-options*\] **ca-cert-request-find** \[*command-options*\]\ **pki-server** \[*CLI-options*\] **ca-cert-request-show** \[*command-options*\] *request-ID*\ **pki-server** \[*CLI-options*\] **ca-clone-prepare** \[*command-options*\]\ **pki-server** \[*CLI-options*\] **ca-audit-event-find** \[*command-options*\]\ **pki-server** \[*CLI-options*\] **ca-audit-event-enable** \[*command-options*\] *event-ID*\ **pki-server** \[*CLI-options*\] **ca-audit-event-disable** \[*command-options*\] *event-ID*\ **pki-server** \[*CLI-options*\] **ca-audit-event-modify** \[*command-options*\] *event-ID*\ **pki-server** \[*CLI-options*\] **ca-audit-file-find** \[*command-options*\]\ **pki-server** \[*CLI-options*\] **ca-audit-file-verify** \[*command-options*\] ## DESCRIPTION The **pki-server ca** commands provide command-line interfaces to manage PKI CA. **pki-server** \[*CLI-options*\] **ca** \[*command-options*\]\ \ This command is to list available PKI CA management commands. **pki-server** \[*CLI-options*\] **ca-cert-chain-export** \[*command-options*\]\ \ This command is to export CA certificates with chain and keys to PKCS #12 file.\ The output filename and either password or password file are required. **pki-server** \[*CLI-options*\] **ca-cert-request-find** \[*command-options*\]\ \ This command will list all the certificate request in the CA.\ After specifying the certificate file it will search for certificate request in the database.\ It accepts certificate without any BEGIN/END CERTIFICATE header/footer. **pki-server** \[*CLI-options*\] **ca-cert-request-show** \[*command-options*\] *request-ID*\ \ This command is to show the certificate request as per certificate request ID.\ It shows the Request ID, Type, Status and Request (in Base64 format). **pki-server** \[*CLI-options*\] **ca-clone-prepare** \[*command-options*\]\ \ This command exports CA system certificates into a PKCS #12 file with private keys. **pki-server** \[*CLI-options*\] **ca-audit-event-find** \[*command-options*\]\ \ This command list all the audit events which are enabled/disabled. **pki-server** \[*CLI-options*\] **ca-audit-event-enable** \[*command-options*\] *event-ID*\ \ This command will enable audit events in the CA. **pki-server** \[*CLI-options*\] **ca-audit-event-disable** \[*command-options*\] *event-ID*\ \ This command will disable audit events in the CA. **pki-server** \[*CLI-options*\] **ca-audit-event-modify** \[*command-options*\] *event-ID*\ \ This command will modify the event filter for audit events. **pki-server** \[*CLI-options*\] **ca-audit-file-find** \[*command-options*\]\ \ This command lists audit log files generated by the CA. **pki-server** \[*CLI-options*\] **ca-audit-file-verify** \[*command-options*\]\ \ This command will verify whether the signatures in the audit log files are valid. ## AUDIT EVENTS Logging audit events: - • AUDIT\_LOG\_STARTUP - • AUDIT\_LOG\_SHUTDOWN - • AUDIT\_LOG\_DELETE - • LOG\_PATH\_CHANGE - • LOG\_EXPIRATION\_CHANGE - • CONFIG\_SIGNED\_AUDIT Authentication and authorization audit events: - • AUTHZ - • AUTH - • ROLE\_ASSUME - • CONFIG\_AUTH - • CONFIG\_ROLE - • ACCESS\_SESSION\_ESTABLISH - • ACCESS\_SESSION\_TERMINATED Key audit events: - • PRIVATE\_KEY\_ARCHIVE\_REQUEST - • PRIVATE\_KEY\_ARCHIVE\_REQUEST\_PROCESSED - • PRIVATE\_KEY\_EXPORT\_REQUEST\_PROCESSED\_SUCCESS - • CONFIG\_TRUSTED\_PUBLIC\_KEY - • PRIVATE\_KEY\_EXPORT\_REQUEST\_PROCESSED\_FAILURE - • KEY\_RECOVERY\_REQUEST - • KEY\_RECOVERY\_REQUEST\_ASYNC - • KEY\_RECOVERY\_AGENT\_LOGIN - • KEY\_RECOVERY\_REQUEST\_PROCESSED - • KEY\_RECOVERY\_REQUEST\_PROCESSED\_ASYNC - • KEY\_GEN\_ASYMMETRIC - • COMPUTE\_SESSION\_KEY\_REQUEST\_PROCESSED\_SUCCESS - • COMPUTE\_SESSION\_KEY\_REQUEST - • COMPUTE\_SESSION\_KEY\_REQUEST\_PROCESSED\_FAILURE - • DIVERSIFY\_KEY\_REQUEST - • DIVERSIFY\_KEY\_REQUEST\_PROCESSED\_SUCCESS - • DIVERSIFY\_KEY\_REQUEST\_PROCESSED\_FAILURE - • SERVER\_SIDE\_KEYGEN\_REQUEST - • SERVER\_SIDE\_KEYGEN\_REQUEST\_PROCESSED\_SUCCESS - • SERVER\_SIDE\_KEYGEN\_REQUEST\_PROCESSED\_FAILURE CMC audit events: - • CMC\_RESPONSE\_SENT - • CMC\_ID\_POP\_LINK\_WITNESS - • CMC\_SIGNED\_REQUEST\_SIG\_VERIFY - • CMC\_PROOF\_OF\_IDENTIFICATION - • CMC\_REQUEST\_RECEIVED - • CMC\_USER\_SIGNED\_REQUEST\_SIG\_VERIFY - • PROOF\_OF\_POSSESSION Profile audit events: - • CONFIG\_CERT\_PROFILE - • CONFIG\_CRL\_PROFILE - • CONFIG\_OCSP\_PROFILE Certificate audit events: - • CERT\_SIGNING\_INFO - • CERT\_PROFILE\_APPROVAL - • CERT\_REQUEST\_PROCESSED - • CERT\_STATUS\_CHANGE\_REQUEST - • CERT\_STATUS\_CHANGE\_REQUEST\_PROCESSED - • CONFIG\_CERT\_POLICY - • PROFILE\_CERT\_REQUEST - • CIMC\_CERT\_VERIFICATION - • NON\_PROFILE\_CERT\_REQUEST ACL audit events: - • CONFIG\_ACL OCSP audit events: - • OCSP\_SIGNING\_INFO - • OCSP\_GENERATION CRL audit events: - • SCHEDULE\_CRL\_GENERATION - • DELTA\_CRL\_PUBLISHING - • CRL\_VALIDATION - • CRL\_RETRIEVAL - • CRL\_SIGNING\_INFO - • FULL\_CRL\_GENERATION - • DELTA\_CRL\_GENERATION Authority audit events: - • AUTHORITY\_CONFIG - • SECURITY\_DOMAIN\_UPDATE - • CONFIG\_DRM Selftest audit events: - • SELFTESTS\_EXECUTION Encryption data audit events: - • CONFIG\_ENCRYPTION - • ENCRYPT\_DATA\_REQUEST - • ENCRYPT\_DATA\_REQUEST\_PROCESSED\_SUCCESS - • ENCRYPT\_DATA\_REQUEST\_PROCESSED\_FAILURE - • COMPUTE\_RANDOM\_DATA\_REQUEST - • COMPUTE\_RANDOM\_DATA\_REQUEST\_PROCESSED\_FAILURE - • COMPUTE\_RANDOM\_DATA\_REQUEST\_PROCESSED\_SUCCESS - • SECURITY\_DATA\_ARCHIVAL\_REQUEST Serial/random number audit events: - • INTER\_BOUNDARY - • CONFIG\_SERIAL\_NUMBER - • RANDOM\_GENERATION ## SEE ALSO **[pki-server(8)](/pki-server/8.md)**\ \ PKI server management commands ## AUTHORS Amol Kahat lt;akahat@redhat.comgt;. ## COPYRIGHT Copyright (c) 2018 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.