---
name: "pki-server-kra"
section: "8"
platform: "linux"
package: "pki-kra"
version: "10.10.2-3"
release: "Debian 11 (Bullseye)"
platforms: ["linux"]
url: "https://new.carta.tech/pki-server-kra"
---

# pki-server-kra(8)

Command-line interface for managing PKI KRA.

## NAME

pki-server-kra - Command-line interface for managing PKI KRA.

## SYNOPSIS

**pki-server** \[*CLI-options*\] **kra-clone-prepare** \[*command-options*\]\
 **pki-server** \[*CLI-options*\] **kra-audit-event-find** \[*command-options*\]\
 **pki-server** \[*CLI-options*\] **kra-audit-event-enable** \[*command-options*\] *event-ID*\
 **pki-server** \[*CLI-options*\] **kra-audit-event-disable** \[*command-options*\] *event-ID*\
 **pki-server** \[*CLI-options*\] **kra-audit-event-modify** \[*command-options*\]  *event-ID*\
 **pki-server** \[*CLI-options*\] **kra-audit-file-find** \[*command-options*\]\
 **pki-server** \[*CLI-options*\] **kra-audit-file-verify** \[*command-options*\]

## DESCRIPTION

The **pki-server kra** commands provide command-line interfaces to manage PKI KRA.

**pki-server** \[*CLI-options*\] **kra** \[*command-options*\]\
\
     This command is to list available PKI KRA management commands.

**pki-server** \[*CLI-options*\] **kra-clone-prepare** \[*command-options*\]\
\
     This command export KRA system certificates into a PKCS #12 file with private keys.

**pki-server** \[*CLI-options*\] **kra-audit-event-find** \[*command-options*\]\
\
     This command list all the audit events which are enabled/disabled.

**pki-server** \[*CLI-options*\] **kra-audit-event-enable** \[*command-options*\] *event-ID*\
\
     This command will enable audit events in the KRA.

**pki-server** \[*CLI-options*\] **kra-audit-event-disable** \[*command-options*\] *event-ID*\
\
     This command will disable audit events in the KRA.

**pki-server** \[*CLI-options*\] **kra-audit-event-modify** \[*command-options*\] *event-ID*\
\
     This command will modify the event filter for audit events.

**pki-server** \[*CLI-options*\] **kra-audit-file-find** \[*command-options*\]\
\
     This command lists audit logs generated by the KRA.

**pki-server** \[*CLI-options*\] **kra-audit-file-verify** \[*command-options*\]\
\
     This command will verify whether the signatures in the audit log files are valid.

## AUDIT EVENTS

Logging audit events:

- •

  AUDIT\_LOG\_STARTUP

- •

  AUDIT\_LOG\_SHUTDOWN

- •

  AUDIT\_LOG\_DELETE

- •

  LOG\_PATH\_CHANGE

- •

  LOG\_EXPIRATION\_CHANGE

- •

  CONFIG\_SIGNED\_AUDIT

Authentication and authorization audit events:

- •

  AUTHZ

- •

  AUTH

- •

  ROLE\_ASSUME

- •

  CONFIG\_AUTH

- •

  CONFIG\_ROLE

- •

  ACCESS\_SESSION\_ESTABLISH

- •

  ACCESS\_SESSION\_TERMINATED

Key audit events:

- •

  PRIVATE\_KEY\_ARCHIVE\_REQUEST

- •

  PRIVATE\_KEY\_ARCHIVE\_REQUEST\_PROCESSED

- •

  PRIVATE\_KEY\_EXPORT\_REQUEST\_PROCESSED\_SUCCESS

- •

  CONFIG\_TRUSTED\_PUBLIC\_KEY

- •

  PRIVATE\_KEY\_EXPORT\_REQUEST\_PROCESSED\_FAILURE

- •

  KEY\_RECOVERY\_REQUEST

- •

  KEY\_RECOVERY\_REQUEST\_ASYNC

- •

  KEY\_RECOVERY\_AGENT\_LOGIN

- •

  KEY\_RECOVERY\_REQUEST\_PROCESSED

- •

  KEY\_RECOVERY\_REQUEST\_PROCESSED\_ASYNC

- •

  KEY\_GEN\_ASYMMETRIC

- •

  COMPUTE\_SESSION\_KEY\_REQUEST\_PROCESSED\_SUCCESS

- •

  COMPUTE\_SESSION\_KEY\_REQUEST

- •

  COMPUTE\_SESSION\_KEY\_REQUEST\_PROCESSED\_FAILURE

- •

  DIVERSIFY\_KEY\_REQUEST

- •

  DIVERSIFY\_KEY\_REQUEST\_PROCESSED\_SUCCESS

- •

  DIVERSIFY\_KEY\_REQUEST\_PROCESSED\_FAILURE

- •

  SERVER\_SIDE\_KEYGEN\_REQUEST

- •

  SERVER\_SIDE\_KEYGEN\_REQUEST\_PROCESSED\_SUCCESS

- •

  SERVER\_SIDE\_KEYGEN\_REQUEST\_PROCESSED\_FAILURE

CMC audit events:

- •

  CMC\_RESPONSE\_SENT

- •

  CMC\_ID\_POP\_LINK\_WITNESS

- •

  CMC\_SIGNED\_REQUEST\_SIG\_VERIFY

- •

  CMC\_PROOF\_OF\_IDENTIFICATION

- •

  CMC\_REQUEST\_RECEIVED

- •

  CMC\_USER\_SIGNED\_REQUEST\_SIG\_VERIFY

- •

  PROOF\_OF\_POSSESSION

Profile audit events:

- •

  CONFIG\_CERT\_PROFILE

- •

  CONFIG\_CRL\_PROFILE

- •

  CONFIG\_OCSP\_PROFILE

Certificate audit events:

- •

  CERT\_SIGNING\_INFO

- •

  CERT\_PROFILE\_APPROVAL

- •

  CERT\_REQUEST\_PROCESSED

- •

  CERT\_STATUS\_CHANGE\_REQUEST

- •

  CERT\_STATUS\_CHANGE\_REQUEST\_PROCESSED

- •

  CONFIG\_CERT\_POLICY

- •

  PROFILE\_CERT\_REQUEST

- •

  CIMC\_CERT\_VERIFICATION

- •

  NON\_PROFILE\_CERT\_REQUEST

ACL audit events:

- •

  CONFIG\_ACL

OCSP audit events:

- •

  OCSP\_SIGNING\_INFO

- •

  OCSP\_GENERATION

CRL audit events:

- •

  SCHEDULE\_CRL\_GENERATION

- •

  DELTA\_CRL\_PUBLISHING

- •

  CRL\_VALIDATION

- •

  CRL\_RETRIEVAL

- •

  CRL\_SIGNING\_INFO

- •

  FULL\_CRL\_GENERATION

- •

  DELTA\_CRL\_GENERATION

Authority audit events:

- •

  AUTHORITY\_CONFIG

- •

  SECURITY\_DOMAIN\_UPDATE

- •

  CONFIG\_DRM

Selftest audit events:

- •

  SELFTESTS\_EXECUTION

Encryption data audit events:

- •

  CONFIG\_ENCRYPTION

- •

  ENCRYPT\_DATA\_REQUEST

- •

  ENCRYPT\_DATA\_REQUEST\_PROCESSED\_SUCCESS

- •

  ENCRYPT\_DATA\_REQUEST\_PROCESSED\_FAILURE

- •

  COMPUTE\_RANDOM\_DATA\_REQUEST

- •

  COMPUTE\_RANDOM\_DATA\_REQUEST\_PROCESSED\_FAILURE

- •

  COMPUTE\_RANDOM\_DATA\_REQUEST\_PROCESSED\_SUCCESS

- •

  SECURITY\_DATA\_ARCHIVAL\_REQUEST

Serial/random number audit events:

- •

  INTER\_BOUNDARY

- •

  CONFIG\_SERIAL\_NUMBER

- •

  RANDOM\_GENERATION

## SEE ALSO

**[pki-server(8)](/pki-server/8.md)**\
\
     PKI server management commands

## AUTHORS

Amol Kahat lt;akahat@redhat.comgt;.

## COPYRIGHT

Copyright (c) 2018 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.