Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION Manual de usuario
Red Hat Certificate
System 7.3
Command-Line Tools Guide
Publication date: March 25, 2010 (updated)
Command-Line Tools Guide
Red Hat Certificate System 7.3 Command-Line Tools Guide
Copyright © 2009 Red Hat, Inc.
Copyright © 2009 Red Hat, Inc.
The text of and illustrations in this document are licensed by Red Hat under a Creative Commons
Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available
at http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute this
document or an adaptation of it, you must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert,
Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity
Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
All other trademarks are the property of their respective owners.
1801 Varsity Drive
Raleigh, NC 27606-2072 USA
Phone: +1 919 754 3700
Phone: 888 733 4281
Fax: +1 919 754 3701
PO Box 13588
Research Triangle Park, NC 27709 USA
This book covers important, Certificate System-specific, command-line tools that you can use to
create, remove, and manage subsystem instances and to create and manage keys and certificates.
iii
About This Guide vii
1. Required Information ..................................................................................................... vii
2. What Is in This Guide .................................................................................................... vii
3. Common Tool Information ............................................................................................... ix
4. Examples and Formatting ............................................................................................... ix
4.1. File Locations for Examples and Commands ......................................................... ix
4.2. Using Mozilla LDAP Tools .................................................................................... ix
4.3. Default Port Numbers .......................................................................................... ix
4.4. Guide Formatting .................................................................................................. x
5. Additional Reading ......................................................................................................... xi
6. Giving Feedback ............................................................................................................ xi
7. Document History .......................................................................................................... xii
1. Create and Remove Instance Tools 1
1.1. pkicreate ...................................................................................................................... 1
1.1.1. Syntax .............................................................................................................. 1
1.1.2. Usage ............................................................................................................... 3
1.2. pkiremove .................................................................................................................... 3
1.2.1. Syntax .............................................................................................................. 3
1.2.2. Usage ............................................................................................................... 4
2. Silent Installation 5
2.1. Syntax ......................................................................................................................... 5
2.2. Usage .......................................................................................................................... 9
3. TokenInfo 11
3.1. Syntax ....................................................................................................................... 11
4. SSLGet 13
4.1. Syntax ....................................................................................................................... 13
4.2. Usage ........................................................................................................................ 13
5. AuditVerify 15
5.1. About the AuditVerify Tool ........................................................................................... 15
5.2. Setting up the Auditor's Database ............................................................................... 15
5.3. Syntax ....................................................................................................................... 15
5.4. Return Values ............................................................................................................ 16
5.5. Usage ........................................................................................................................ 17
6. PIN Generator 19
6.1. The setpin Command ................................................................................................. 19
6.1.1. Editing the setpin.conf Configuration File ........................................................... 19
6.1.2. Syntax ............................................................................................................. 20
6.1.3. Usage ............................................................................................................. 22
6.2. How setpin Works ...................................................................................................... 22
6.2.1. Input File ......................................................................................................... 25
6.2.2. Output File ...................................................................................................... 26
6.2.3. How PINs Are Stored in the Directory ............................................................... 26
6.2.4. Exit Codes ...................................................................................................... 27
7. ASCII to Binary 29
7.1. Syntax ....................................................................................................................... 29
7.2. Usage ........................................................................................................................ 29
8. Binary to ASCII 31
Command-Line Tools Guide
iv
8.1. Syntax ....................................................................................................................... 31
8.2. Usage ........................................................................................................................ 31
9. Pretty Print Certificate 33
9.1. Syntax ....................................................................................................................... 33
9.2. Usage ........................................................................................................................ 33
10. Pretty Print CRL 37
10.1. Syntax ..................................................................................................................... 37
10.2. Usage ...................................................................................................................... 37
11. TKS Tool 39
11.1. Syntax ...................................................................................................................... 39
11.2. Usage ...................................................................................................................... 41
12. CMC Request 45
12.1. Syntax ..................................................................................................................... 45
12.2. Usage ...................................................................................................................... 48
13. CMC Enrollment 49
13.1. Syntax ..................................................................................................................... 49
13.2. Usage ...................................................................................................................... 49
14. CMC Response 51
14.1. Syntax ..................................................................................................................... 51
15. CMC Revocation 53
15.1. Syntax ..................................................................................................................... 53
15.2. Testing CMC Revocation ........................................................................................... 53
16. CRMF Pop Request 55
16.1. Syntax ..................................................................................................................... 55
16.2. Usage ...................................................................................................................... 56
17. Extension Joiner 57
17.1. Syntax ..................................................................................................................... 57
17.2. Usage ...................................................................................................................... 57
18. Key Usage Extension 59
18.1. Syntax ..................................................................................................................... 59
19. Issuer Alternative Name Extension 61
19.1. Syntax ..................................................................................................................... 61
19.2. Usage ...................................................................................................................... 62
20. Subject Alternative Name Extension 63
20.1. Syntax ..................................................................................................................... 63
20.2. Usage ...................................................................................................................... 64
21. HTTP Client 65
21.1. Syntax ..................................................................................................................... 65
22. OCSP Request 67
22.1. Syntax ..................................................................................................................... 67
23. PKCS #10 Client 69
23.1. Syntax ..................................................................................................................... 69
24. Bulk Issuance Tool 71
24.1. Syntax ..................................................................................................................... 71
v
25. Revocation Automation Utility 73
25.1. Syntax ..................................................................................................................... 73
26. tpsclient 75
26.1. Syntax ..................................................................................................................... 77
Index 79
vi
vii
About This Guide
The Certificate System Command-Line Tools Guide describes the command-line tools and utilities
bundled with Red Hat Certificate System and provides information such as command syntax and
usage examples to help use these tools.
This guide is intended for experienced system administrators who are planning to deploy the
Certificate System. Certificate System agents should use the Certificate System Agent's Guide
for information on how to perform agent tasks, such as handling certificate requests and revoking
certificates.
1. Required Information
This guide assumes familiarity with the following concepts:
• Public-key cryptography and the Secure Sockets Layer (SSL) protocol
• SSL cipher suites
• The purpose of and major steps in the SSL handshake
• Intranet, extranet, Internet security, and the role of digital certificates in a secure enterprise,
including the following topics:
• Encryption and decryption
• Public keys, private keys, and symmetric keys
• Significance of key lengths
• Digital signatures
• Digital certificates
• The role of digital certificates in a public-key infrastructure (PKI)
• Certificate hierarchies
2. What Is in This Guide
This guide contains the following topics:
Chapter 1, Create and Remove Instance Tools Describes the tools used to create and remove
subsystem instances.
Chapter 2, Silent Installation Describes the tool used for a silent instance
creation.
Chapter 3, TokenInfo Describes the utility which can be used to identify
tokens on a machine, which shows whether the
Certificate System can detect those tokens to
use for a subsystem.
Chapter 4, SSLGet Describes a tool used by the Certificate System
to help configure and use security domains.
Chapter 5, AuditVerify Describes how to use the tool used to verify
signed audit logs.
About This Guide
viii
Chapter 6, PIN Generator Describes how to use the tool for generating
unique PINs for end users and for populating
their directory entries with PINs.
Chapter 7, ASCII to Binary Describes how to use the tool for converting
ASCII data to its binary equivalent.
Chapter 8, Binary to ASCII Describes how to use the tool for converting
binary data to its ASCII equivalent.
Chapter 9, Pretty Print Certificate Describes how to use the tool for printing or
viewing the contents of a certificate stored
as ASCII base-64 encoded data in a human-
readable form.
Chapter 10, Pretty Print CRL Describes how to use the tool for printing or
viewing the contents of a CRL stored as ASCII
base-64 encoded data in a human-readable
form.
Chapter 11, TKS Tool Describes how to manipulate symmetric keys,
including keys stored on tokens, the TKS master
key, and related keys and databases.
Chapter 12, CMC Request Describes how to construct a Certificate
Management Messages over Cryptographic
Message Syntax (CMC) request.
Chapter 13, CMC Enrollment Describes how to sign a CMC certificate
enrollment request with an agent's certificate.
Chapter 14, CMC Response Describes how to parse a CMC response.
Chapter 15, CMC Revocation Describes how to sign a CMC revocation request
with an agent's certificate.
Chapter 16, CRMF Pop Request Describes how to generate Certificate Request
Message Format (CRMF) requests with proof of
possession (POP).
Chapter 17, Extension Joiner Describes how to use the tool for joining
MIME-64 encoded formats of certificate
extensions to create a single blob.
Chapter 18, Key Usage Extension Describes how to generate a distinguished
encoding rules (DER)-encoded Extended Key
Usage extension.
Chapter 19, Issuer Alternative Name Extension Describes how to generate an Issuer Alternative
Name extension in base-64 encoding.
Chapter 20, Subject Alternative Name Extension Describes how to generate a Subject Alternative
Name extension in base-64 encoding.
Chapter 21, HTTP Client Describes how to communicate with any HTTP/
HTTPS server.
Chapter 22, OCSP Request Describes how to verify certificate status by
submitting Online Certificate Status Protocol
(OCSP) requests to an instance of an OCSP
subsystem.
Common Tool Information
ix
Chapter 23, PKCS #10 Client Describes how to generate a Public-Key
Cryptography Standards (PKCS) #10 enrollment
request.
Chapter 24, Bulk Issuance Tool Describes how to send either a KEYGEN or
CRMF enrollment request to the bulk issuance
interface to create certificates automatically.
Chapter 25, Revocation Automation Utility Describes how to automate user management
scripts to revoke certificates.
Chapter 26, tpsclient Describes how to test the TPS configuration and
common operations.
Table 1. List of Contents
3. Common Tool Information
All of the tools in this guide are located in the /usr/bin directory, except for the Silent Install tool
which is downloaded separately and installed to any directory. These tools can be run from any
location without specifying the tool location.
4. Examples and Formatting
4.1. File Locations for Examples and Commands
All of the examples for Red Hat Certificate System commands, file locations, and other usage are
given for Red Hat Enterprise Linux 4 (32 bit) systems. Be certain to use the appropriate commands
and files for your platform.
To start the Red Hat Certificate System:
/etc/init.d/rhpki-ca start
Example 1. Example Command
All of the tools for Red Hat Certificate System are located in the /usr/bin directory. These tools can
be run from any location without specifying the tool location.
4.2. Using Mozilla LDAP Tools
There is another important consideration with the LDAP utilities. The LDAP tools referenced in
this guide are Mozilla LDAP, installed with Red Hat Certificate System in the /usr/dir/mozldap
directory on Red Hat Enterprise Linux.
However, Red Hat Enterprise Linux systems also include LDAP tools from OpenLDAP in the /usr/
bin directory. It is possible to use the OpenLDAP commands as shown in the examples, but you must
use the -x argument to disable SASL, which OpenLDAP tools use by default.
4.3. Default Port Numbers
After Errata RHSA-2009:0007, Certificate System 7.3 supports port separation. Port separation means
that the different subsystem services for administrators, agents, and end entities run on different, user-
defined ports.
About This Guide
x
The default subsystem instances, however, are configured to use a single secure port for all services.
Therefore, any example commands or files reference these default ports.
Susbsystem SSL Port Non-SSL Port
CA 9443 9080
RA 12889 12888
DRM 10443 10080
OCSP 11443 11080
TKS 13443 13080
TPS 7889 7888
Table 2. Default Subsystem Ports
4.4. Guide Formatting
Certain words are represented in different fonts, styles, and weights. Different character formatting is
used to indicate the function or purpose of the phrase being highlighted.
Formatting Style Purpose
Monospace font Monospace is used for commands, package names, files and
directory paths, and any text displayed in a prompt.
Monospace
with a
background
This type of formatting is used for anything entered or returned
in a command prompt.
Italicized text Any text which is italicized is a variable, such as
instance_name or hostname. Occasionally, this is also used to
emphasize a new term or other phrase.
Bolded text Most phrases which are in bold are application names, such as
Cygwin, or are fields or options in a user interface, such as a
User Name Here: field or Save button.
Other formatting styles draw attention to important text.
NOTE
A note provides additional information that can help illustrate the behavior of the system or
provide more detail for a specific issue.
IMPORTANT
Important information is necessary, but possibly unexpected, such as a configuration
change that will not persist after a reboot.
WARNING
A warning indicates potential data loss, as may happen when tuning hardware for
maximum performance.
Otros manuales para CERTIFICATE SYSTEM 7.3 - ADMINISTRATION
2
Tabla de contenidos
Otros manuales de Software de Red Hat
Red Hat
Red Hat CLUSTER SUITE FOR ENTERPRISE LINUX 4.7 Guía de instalación
Red Hat
Red Hat ENTERPRISE 5.4 RELEASE NOTES Manual de usuario
Red Hat
Red Hat SYSTEM 8.0 - MIGRATION GUIDE 7.X TO 8.0 Manual de usuario
Red Hat
Red Hat CERTIFICATE SYSTEM 7.0 - MIGRATION GUIDE Manual de usuario
Red Hat
Red Hat ENTERPRISE LINUX 3 - SECURITY GUIDE Manual de instrucciones
Red Hat
Red Hat ENTERPRISE 5.4 RELEASE NOTES Manual de usuario
Red Hat
Red Hat CERTIFICATE SYSTEM 7.2 - AGENT GUIDE Manual de usuario
Red Hat
Red Hat NETWORK - USER 1.3 Hoja de información del producto
Red Hat
Red Hat LINUX ADVANCED SERVER 2.1 - Manual de usuario
Red Hat
Red Hat NETWORK - USER 3.0 Hoja de información del producto
Red Hat
Red Hat NETWORK ENTERPRISE - USER 2.2 Hoja de información del producto
Red Hat
Red Hat ENTERPRISE LINUX 6 Manual de usuario
Red Hat
Red Hat CERTIFICATE 8.0 RELEASE NOTES Manual de instrucciones
Red Hat
Red Hat APPLICATION STACK 2.1 RELEASE Manual de instrucciones
Red Hat
Red Hat APPLICATION STACK 2.0 RELEASE Manual de instrucciones
Red Hat
Red Hat ENTERPRISE LINUX 3 - USING BINUTILS Manual
Red Hat
Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION... Manual de usuario
Red Hat
Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER... Manual de usuario
Red Hat
Red Hat ENTERPRISE LINUX 5.5 - S 2010 Manual de instrucciones
Red Hat
Red Hat CERTIFICATE 7.2 RELEASE NOTES Manual de instrucciones
Red Hat
Red Hat ENTERPRISE LINUX 5.1 - LVM ADMINISTRATION Manual de usuario
Red Hat
Red Hat ENTERPRISE LINUX 3 - FOR IBM ESERVER ISERIES AND IBM ESERVER... Manual de usuario
Red Hat
Red Hat DEVICE-MAPPER MULTIPATH 5.2 Manual de instrucciones
Red Hat
Red Hat ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE Manual de usuario
Manuales populares de Software de otras marcas
PS Audio
PS Audio PowerPlay Manual del propietario
Brady
Brady LOCKOUT PRO 3.0 Manual de servicio
Avaya
Avaya Interaction Center Manual de usuario
Texas Instruments
Texas Instruments TI-83 Plus Silver Edition Manual
Novell
Novell GROUPWISE 8 - INTERNET AGENT Manual de usuario
Oracle
Oracle Application 9i Manual de usuario
Acer
Acer RDM Manual de usuario
Canon
Canon Vixia HF21 Manual de usuario
Canon
Canon ZR950 Manual de usuario
Samsung
Samsung Auto Backup Manual de usuario
Polycom
Polycom Vortex EF2201 Instrucciones de instalación y funcionamiento
Brocade Communications Systems
Brocade Communications Systems Brocade 8/12c Manual de usuario