Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Bedienungsanleitung

Red Hat Certificate System 7.2

Command-Line Tools

Guide

7.2

ISBN: N/A

Publication date:

This book covers important, Certificate System-specific, command-line tools that you can use to

create, remove, and manage subsystem instances and to create and manage keys and

certificates.

Red Hat Certificate System 7.2

Red Hat Certificate System 7.2: Command-Line Tools Guide

the Open Publication License, V1.0 or later with the restrictions noted below (the latest version of the OPL is presently

available at http://www.opencontent.org/openpub/).

Distribution of substantively modified versions of this document is prohibited without the explicit permission of the

Distribution of the work or derivative of the work in any standard (paper) book form for commercial purposes is

prohibited unless prior permission is obtained from the copyright holder.

Red Hat and the Red Hat "Shadow Man" logo are registered trademarks of Red Hat, Inc. in the United States and other

countries.

All other trademarks referenced herein are the property of their respective owners.

The GPG fingerprint of the [email protected] key is:

CA 20 86 86 2B D6 9D FC 65 F6 EC C4 21 91 80 CD DB 42 A6 0E

1801 Varsity Drive

Raleigh, NC 27606-2072

USA

Phone: +1 919 754 3700

Phone: 888 733 4281

Fax: +1 919 754 3701

PO Box 13588

Research Triangle Park, NC 27709

USA

Red Hat Certificate System 7.2

About This Guide ......................................................................................................vii

1. Required Information .....................................................................................vii

2. What Is in This Guide ....................................................................................vii

3. Additional Reading .........................................................................................ix

4. Common Tool Information ...............................................................................x

5. Examples and Formatting ................................................................................x

6. Giving Feedback ............................................................................................xi

7. Revision History ............................................................................................xii

1. Create and Remove Instance Tools ........................................................................ 1

1. pkicreate ....................................................................................................... 1

1.1. Syntax ................................................................................................ 1

1.2. Usage ................................................................................................ 2

2. pkiremove ..................................................................................................... 3

2.1. Syntax ................................................................................................ 3

2.2. Usage ................................................................................................ 3

2. Silent Installation .................................................................................................... 5

1. Syntax ........................................................................................................... 5

2. Usage ........................................................................................................... 9

3. TokenInfo .............................................................................................................11

1. Syntax ..........................................................................................................11

4. SSLGet ................................................................................................................13

1. Syntax ..........................................................................................................13

2. Usage ..........................................................................................................13

5. AuditVerify ............................................................................................................15

1. Setting up the Auditor's Database ..................................................................15

2. Syntax ..........................................................................................................16

3. Return Values ...............................................................................................17

4. Usage ..........................................................................................................17

6. PIN Generator ......................................................................................................19

1. The setpin Command ....................................................................................19

1.1. Editing the setpin.conf Configuration File .............................................19

1.2. Syntax ...............................................................................................20

1.3. Usage ...............................................................................................23

2. How setpin Works .........................................................................................23

2.1. Input File ...........................................................................................25

2.2. Output File .........................................................................................26

2.3. How PINs Are Stored in the Directory ..................................................27

2.4. Exit Codes .........................................................................................27

7. ASCII to Binary .....................................................................................................29

1. Syntax ..........................................................................................................29

2. Usage ..........................................................................................................29

8. Binary to ASCII .....................................................................................................31

1. Syntax ..........................................................................................................31

2. Usage ..........................................................................................................31

9. Pretty Print Certificate ...........................................................................................33

1. Syntax ..........................................................................................................33

2. Usage ..........................................................................................................33

10. Pretty Print CRL ..................................................................................................37

1. Syntax ..........................................................................................................37

2. Usage ..........................................................................................................37

11. TKS Tool ............................................................................................................39

1. Syntax ..........................................................................................................39

2. Usage ..........................................................................................................42

12. CMC Request .....................................................................................................47

1. Syntax ..........................................................................................................47

2. Usage ..........................................................................................................51

13. CMC Enrollment ..................................................................................................53

1. Syntax ..........................................................................................................53

2. Usage ..........................................................................................................53

14. CMC Response ..................................................................................................57

1. Syntax ..........................................................................................................57

15. CMC Revocation .................................................................................................59

1. Syntax ..........................................................................................................59

2. Testing CMC Revocation ...............................................................................60

16. CRMF Pop Request ............................................................................................61

1. Syntax ..........................................................................................................61

2. Usage ..........................................................................................................62

17. Extension Joiner .................................................................................................65

1. Syntax ..........................................................................................................65

2. Usage ..........................................................................................................65

18. Key Usage Extension ..........................................................................................69

1. Syntax ..........................................................................................................69

19. Issuer Alternative Name Extension .......................................................................71

1. Syntax ..........................................................................................................71

2. Usage ..........................................................................................................73

20. Subject Alternative Name Extension .....................................................................75

1. Syntax ..........................................................................................................75

2. Usage ..........................................................................................................77

21. HTTP Client ........................................................................................................79

1. Syntax ..........................................................................................................79

22. OCSP Request ...................................................................................................81

1. Syntax ..........................................................................................................81

23. PKCS #10 Client .................................................................................................83

1. Syntax ..........................................................................................................83

24. Bulk Issuance Tool ..............................................................................................85

1. Syntax ..........................................................................................................85

25. Revocation Automation Utility ..............................................................................87

1. Syntax ..........................................................................................................87

26. tpsclient ..............................................................................................................89

1. Syntax ..........................................................................................................91

Index .......................................................................................................................95

Red Hat Certificate System 7.2

About This Guide

The Certificate System Command-Line Tools Guide describes the command-line tools and

utilities bundled with Red Hat Certificate System and provides information such as command

syntax and usage examples to help use these tools.

This guide is intended for experienced system administrators who are planning to deploy the

Certificate System. Certificate System agents should use the Certificate System Agent's Guide

for information on how to perform agent tasks, such as handling certificate requests and

revoking certificates.

1. Required Information

This guide assumes familiarity with the following concepts:

• Public-key cryptography and the Secure Sockets Layer (SSL) protocol

• SSL cipher suites

• The purpose of and major steps in the SSL handshake

• Intranet, extranet, Internet security, and the role of digital certificates in a secure enterprise,

including the following topics:

• Encryption and decryption

• Public keys, private keys, and symmetric keys

• Significance of key lengths

• Digital signatures

• Digital certificates

• The role of digital certificates in a public-key infrastructure (PKI)

• Certificate hierarchies

2. What Is in This Guide

This guide contains the following topics:

Chapter 1, Create and Remove Instance

Tools Describes the tools used to create and

remove subsystem instances.

Chapter 2, Silent Installation Describes the tool used for a silent instance

creation.

Chapter 3, TokenInfo Describes the utility which can be used to

identify tokens on a machine, which shows

vii

whether the Certificate System can detect

those tokens to use for a subsystem.

Chapter 4, SSLGet Describes a tool used by the Certificate

System to help configure and use security

domains.

Chapter 5, AuditVerify Describes how to use the tool used to verify

signed audit logs.

Chapter 6, PIN Generator Describes how to use the tool for generating

unique PINs for end users and for populating

their directory entries with PINs.

Chapter 7, ASCII to Binary Describes how to use the tool for converting

ASCII data to its binary equivalent.

Chapter 8, Binary to ASCII Describes how to use the tool for converting

binary data to its ASCII equivalent.

Chapter 9, Pretty Print Certificate Describes how to use the tool for printing or

viewing the contents of a certificate stored as

ASCII base-64 encoded data in a

human-readable form.

Chapter 10, Pretty Print CRL Describes how to use the tool for printing or

viewing the contents of a CRL stored as

ASCII base-64 encoded data in a

human-readable form.

Chapter 11, TKS Tool Describes how to manipulate symmetric keys,

including keys stored on tokens, the TKS

master key, and related keys and databases.

Chapter 12, CMC Request Describes how to construct a Certificate

Management Messages over Cryptographic

Message Syntax (CMC) request.

Chapter 13, CMC Enrollment Describes how to sign a CMC certificate

enrollment request with an agent's certificate.

Chapter 14, CMC Response Describes how to parse a CMC response.

Chapter 15, CMC Revocation Describes how to sign a CMC revocation

request with an agent's certificate.

Chapter 16, CRMF Pop Request Describes how to generate Certificate

Request Message Format (CRMF) requests

with proof of possession (POP).

Chapter 17, Extension Joiner Describes how to use the tool for joining

MIME-64 encoded formats of certificate

extensions to create a single blob.

Chapter 18, Key Usage Extension Describes how to generate a distinguished

encoding rules (DER)-encoded Extended Key

Usage extension.

About This Guide

viii

Chapter 19, Issuer Alternative Name

Extension Describes how to generate an Issuer

Alternative Name extension in base-64

encoding.

Chapter 20, Subject Alternative Name

Extension Describes how to generate a Subject

Alternative Name extension in base-64

encoding.

Chapter 21, HTTP Client Describes how to communicate with any

HTTP/HTTPS server.

Chapter 22, OCSP Request Describes how to verify certificate status by

submitting Online Certificate Status Protocol

(OCSP) requests to an instance of an OCSP

subsystem.

Chapter 23, PKCS #10 Client Describes how to generate a Public-Key

Cryptography Standards (PKCS) #10

enrollment request.

Chapter 24, Bulk Issuance Tool Describes how to send either a KEYGEN or

CRMF enrollment request to the bulk

issuance interface to create certificates

automatically.

Chapter 25, Revocation Automation Utility Describes how to automate user management

scripts to revoke certificates.

Chapter 26, tpsclient Describes how to test the TPS configuration

and common operations.

Table 1. List of Contents

3. Additional Reading

The documentation for the Certificate System also contains the following guides:

•Certificate System Administrator's Guide explains all administrative functions for the

Certificate System, such as adding users, creating and renewing certificates, managing smart

cards, publishing CRLs, and modifying subsystem settings like port numbers.

•Certificate System Agent's Guide details how to perform agent operations for the CA, DRM,

OCSP, and TPS subsystems through the Certificate System agent services interfaces.

•Certificate System Enterprise Security Client Guide explains how to install, configure, and use

the Enterprise Security Client, the user client application for managing smart cards, user

certificates, and user keys.

•Certificate System Migration Guide provides detailed migration information for migrating all

parts and subsystems of previous versions of Certificate System to Red Hat Certificate

Additional Reading

System 7.2.

Additional Certificate System information is provided in the Certificate System SDK, an online

reference to HTTP interfaces, javadocs, samples, and tutorials related to Certificate System; a

downloadable zip file of this material is available for user interaction with the tutorials.

For the latest information about Certificate System, including current release notes, complete

product documentation, technical notes, and deployment information, see the Red Hat

documentation page:

http://www.redhat.com/docs/manuals/cert-system/

4. Common Tool Information

All of the tools in this guide are located in the /usr/bin directory, except for the Silent Install

tool which is downloaded separately and installed to any directory. These tools can be run from

any location without specifying the tool location.

5. Examples and Formatting

All of the examples for Red Hat Certificate System commands, file locations, and other usage

are given for Red Hat Enterprise Linux 5 systems. Be certain to use the appropriate commands

and files for your platform. For example:

To start the Red Hat Directory Server:

service dir-server start

Example 1. Example Command

Certain words are represented in different fonts, styles, and weights. Different character

formatting is used to indicate the function or purpose of the phrase being highlighted.

Formatting Style Purpose

Monospace font Monospace is used for commands, package names, files and

directory paths, and any text displayed in a prompt.

Monospace

with a

background

This type of formatting is used for anything entered or returned

in a command prompt.

Italicized text Any text which is italicized is a variable, such as

instance_name or hostname. Occasionally, this is also used to

emphasize a new term or other phrase.

About This Guide

Andere Handbücher für CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE

Inhaltsverzeichnis

Andere Red Hat Software Handbücher

Red Hat

Red Hat GNBD WITH GLOBAL FILE SYSTEM IN RHEL 4.5 Bedienungsanleitung

Red Hat

Red Hat NETWORK 2.6 - BASIC Produktinformationsblatt

Red Hat

Red Hat ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE Bedienungsanleitung

Red Hat

Red Hat NETWORK - USER REFERENCE GUIDE 2.0 Produktinformationsblatt

Red Hat

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION... Bedienungsanleitung

Red Hat

Red Hat ENTERPRISE LINUX 3 - USING BINUTILS Handbuch

Red Hat

Red Hat ENTERPRISE LINUX 3 - FOR X86-ITANIUMTM-AMD64 AND INTEL EXTENDED MEMORY 64... Bedienungsanleitung

Red Hat

Red Hat NETWORK 3.5 - PROVISIONING Bedienungsanleitung

Red Hat

Red Hat DIRECTORY SERVER 8.0 Bedienungsanleitung

Red Hat

Red Hat ENTERPRISE LINUX 3 - STEP BY STEP GUIDE Bedienungsanleitung

Red Hat

Red Hat CERTIFICATE SYSTEM 8.0 - MANAGING SMART CARDS WITH THE ENTERPRISE SECURITY CLIENT... Bedienungsanleitung

Red Hat

Red Hat GLOBAL FILE SYSTEM 5.0 Bedienungsanleitung

Red Hat

Red Hat NETWORK PROXY 5.3.0 - Bedienungsanleitung

Red Hat

Red Hat ENTERPRISE LINUX 3 - SECURITY GUIDE Bedienungsanleitung

Red Hat

Red Hat ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE Bedienungsanleitung

Red Hat

Red Hat NETWORK SATELLITE SERVER 4.0 Bedienungsanleitung

Red Hat

Red Hat ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE Bedienungsanleitung

Red Hat

Red Hat CLUSTER FOR ENTERPRISE LINUX 5.0 Bedienungsanleitung

Red Hat

Red Hat NETWORK 4.0.5 - Bedienungsanleitung

Red Hat

Red Hat GNBD WITH GLOBAL FILE SYSTEM 4.7 Bedienungsanleitung

Red Hat

Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION Bedienungsanleitung

Red Hat

Red Hat NETWORK - USER 3.0 Produktinformationsblatt

Red Hat

Red Hat ENTERPRISE LINUX 3 - SECURITY GUIDE Bedienungsanleitung

Red Hat

Red Hat NETWORK - USER 1.2 Produktinformationsblatt

Beliebte Software Handbücher anderer Marken

COMPRO

COMPRO COMPROFM Bedienungsanleitung

Muratec

Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung

Oracle

Oracle Contact Center Anywhere 8.1 Bedienungsanleitung

Adobe

Adobe 65007312 - Photoshop Lightroom Handbuch

Avaya

Avaya NULL One-X for RIM Blackberry Bedienungsanleitung

HP ProLiant BL420c Bedienungsanleitung

PS Audio

PS Audio PowerPlay Betriebsanleitung

Brady

Brady LOCKOUT PRO 3.0 Service-Handbuch

Avaya

Avaya Interaction Center Bedienungsanleitung

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Handbuch

Novell

Novell GROUPWISE 8 - INTERNET AGENT Bedienungsanleitung

Oracle

Oracle Application 9i Bedienungsanleitung

Acer

Acer RDM Bedienungsanleitung

Canon

Canon Vixia HF21 Bedienungsanleitung

Canon

Canon ZR950 Bedienungsanleitung

Samsung

Samsung Auto Backup Bedienungsanleitung

Polycom

Polycom Vortex EF2201 Montage- und Bedienungsanleitung

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Bedienungsanleitung