Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION User manual

Red Hat Certificate
System 7.3
Command-Line Tools Guide
Publication date: March 25, 2010 (updated)

Command-Line Tools Guide
Red Hat Certificate System 7.3 Command-Line Tools Guide
Copyright © 2009 Red Hat, Inc.
Copyright © 2009 Red Hat, Inc.
The text of and illustrations in this document are licensed by Red Hat under a Creative Commons
Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available
at http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute this
document or an adaptation of it, you must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert,
Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity
Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
All other trademarks are the property of their respective owners.
1801 Varsity Drive
Raleigh, NC 27606-2072 USA
Phone: [phone]
Phone: [phone]
Fax: [phone]
PO Box 13588
Research Triangle Park, NC 27709 USA
This book covers important, Certificate System-specific, command-line tools that you can use to
create, remove, and manage subsystem instances and to create and manage keys and certificates.

iii
About This Guide vii
1. Required Information ..................................................................................................... vii
2. What Is in This Guide .................................................................................................... vii
3. Common Tool Information ............................................................................................... ix
4. Examples and Formatting ............................................................................................... ix
4.1. File Locations for Examples and Commands ......................................................... ix
4.2. Using Mozilla LDAP Tools .................................................................................... ix
4.3. Default Port Numbers .......................................................................................... ix
4.4. Guide Formatting .................................................................................................. x
5. Additional Reading ......................................................................................................... xi
6. Giving Feedback ............................................................................................................ xi
7. Document History .......................................................................................................... xii
1. Create and Remove Instance Tools 1
1.1. pkicreate ...................................................................................................................... 1
1.1.1. Syntax .............................................................................................................. 1
1.1.2. Usage ............................................................................................................... 3
1.2. pkiremove .................................................................................................................... 3
1.2.1. Syntax .............................................................................................................. 3
1.2.2. Usage ............................................................................................................... 4
2. Silent Installation 5
2.1. Syntax ......................................................................................................................... 5
2.2. Usage .......................................................................................................................... 9
3. TokenInfo 11
3.1. Syntax ....................................................................................................................... 11
4. SSLGet 13
4.1. Syntax ....................................................................................................................... 13
4.2. Usage ........................................................................................................................ 13
5. AuditVerify 15
5.1. About the AuditVerify Tool ........................................................................................... 15
5.2. Setting up the Auditor's Database ............................................................................... 15
5.3. Syntax ....................................................................................................................... 15
5.4. Return Values ............................................................................................................ 16
5.5. Usage ........................................................................................................................ 17
6. PIN Generator 19
6.1. The setpin Command ................................................................................................. 19
6.1.1. Editing the setpin.conf Configuration File ........................................................... 19
6.1.2. Syntax ............................................................................................................. 20
6.1.3. Usage ............................................................................................................. 22
6.2. How setpin Works ...................................................................................................... 22
6.2.1. Input File ......................................................................................................... 25
6.2.2. Output File ...................................................................................................... 26
6.2.3. How PINs Are Stored in the Directory ............................................................... 26
6.2.4. Exit Codes ...................................................................................................... 27
7. ASCII to Binary 29
7.1. Syntax ....................................................................................................................... 29
7.2. Usage ........................................................................................................................ 29
8. Binary to ASCII 31

Command-Line Tools Guide
iv
8.1. Syntax ....................................................................................................................... 31
8.2. Usage ........................................................................................................................ 31
9. Pretty Print Certificate 33
9.1. Syntax ....................................................................................................................... 33
9.2. Usage ........................................................................................................................ 33
10. Pretty Print CRL 37
10.1. Syntax ..................................................................................................................... 37
10.2. Usage ...................................................................................................................... 37
11. TKS Tool 39
11.1. Syntax ...................................................................................................................... 39
11.2. Usage ...................................................................................................................... 41
12. CMC Request 45
12.1. Syntax ..................................................................................................................... 45
12.2. Usage ...................................................................................................................... 48
13. CMC Enrollment 49
13.1. Syntax ..................................................................................................................... 49
13.2. Usage ...................................................................................................................... 49
14. CMC Response 51
14.1. Syntax ..................................................................................................................... 51
15. CMC Revocation 53
15.1. Syntax ..................................................................................................................... 53
15.2. Testing CMC Revocation ........................................................................................... 53
16. CRMF Pop Request 55
16.1. Syntax ..................................................................................................................... 55
16.2. Usage ...................................................................................................................... 56
17. Extension Joiner 57
17.1. Syntax ..................................................................................................................... 57
17.2. Usage ...................................................................................................................... 57
18. Key Usage Extension 59
18.1. Syntax ..................................................................................................................... 59
19. Issuer Alternative Name Extension 61
19.1. Syntax ..................................................................................................................... 61
19.2. Usage ...................................................................................................................... 62
20. Subject Alternative Name Extension 63
20.1. Syntax ..................................................................................................................... 63
20.2. Usage ...................................................................................................................... 64
21. HTTP Client 65
21.1. Syntax ..................................................................................................................... 65
22. OCSP Request 67
22.1. Syntax ..................................................................................................................... 67
23. PKCS #10 Client 69
23.1. Syntax ..................................................................................................................... 69
24. Bulk Issuance Tool 71
24.1. Syntax ..................................................................................................................... 71

v
25. Revocation Automation Utility 73
25.1. Syntax ..................................................................................................................... 73
26. tpsclient 75
26.1. Syntax ..................................................................................................................... 77
Index 79

vi

vii
About This Guide
The Certificate System Command-Line Tools Guide describes the command-line tools and utilities
bundled with Red Hat Certificate System and provides information such as command syntax and
usage examples to help use these tools.
This guide is intended for experienced system administrators who are planning to deploy the
Certificate System. Certificate System agents should use the Certificate System Agent's Guide
for information on how to perform agent tasks, such as handling certificate requests and revoking
certificates.
1. Required Information
This guide assumes familiarity with the following concepts:
• Public-key cryptography and the Secure Sockets Layer (SSL) protocol
• SSL cipher suites
• The purpose of and major steps in the SSL handshake
• Intranet, extranet, Internet security, and the role of digital certificates in a secure enterprise,
including the following topics:
• Encryption and decryption
• Public keys, private keys, and symmetric keys
• Significance of key lengths
• Digital signatures
• Digital certificates
• The role of digital certificates in a public-key infrastructure (PKI)
• Certificate hierarchies
2. What Is in This Guide
This guide contains the following topics:
Chapter 1, Create and Remove Instance Tools Describes the tools used to create and remove
subsystem instances.
Chapter 2, Silent Installation Describes the tool used for a silent instance
creation.
Chapter 3, TokenInfo Describes the utility which can be used to identify
tokens on a machine, which shows whether the
Certificate System can detect those tokens to
use for a subsystem.
Chapter 4, SSLGet Describes a tool used by the Certificate System
to help configure and use security domains.
Chapter 5, AuditVerify Describes how to use the tool used to verify
signed audit logs.

About This Guide
viii
Chapter 6, PIN Generator Describes how to use the tool for generating
unique PINs for end users and for populating
their directory entries with PINs.
Chapter 7, ASCII to Binary Describes how to use the tool for converting
ASCII data to its binary equivalent.
Chapter 8, Binary to ASCII Describes how to use the tool for converting
binary data to its ASCII equivalent.
Chapter 9, Pretty Print Certificate Describes how to use the tool for printing or
viewing the contents of a certificate stored
as ASCII base-64 encoded data in a human-
readable form.
Chapter 10, Pretty Print CRL Describes how to use the tool for printing or
viewing the contents of a CRL stored as ASCII
base-64 encoded data in a human-readable
form.
Chapter 11, TKS Tool Describes how to manipulate symmetric keys,
including keys stored on tokens, the TKS master
key, and related keys and databases.
Chapter 12, CMC Request Describes how to construct a Certificate
Management Messages over Cryptographic
Message Syntax (CMC) request.
Chapter 13, CMC Enrollment Describes how to sign a CMC certificate
enrollment request with an agent's certificate.
Chapter 14, CMC Response Describes how to parse a CMC response.
Chapter 15, CMC Revocation Describes how to sign a CMC revocation request
with an agent's certificate.
Chapter 16, CRMF Pop Request Describes how to generate Certificate Request
Message Format (CRMF) requests with proof of
possession (POP).
Chapter 17, Extension Joiner Describes how to use the tool for joining
MIME-64 encoded formats of certificate
extensions to create a single blob.
Chapter 18, Key Usage Extension Describes how to generate a distinguished
encoding rules (DER)-encoded Extended Key
Usage extension.
Chapter 19, Issuer Alternative Name Extension Describes how to generate an Issuer Alternative
Name extension in base-64 encoding.
Chapter 20, Subject Alternative Name Extension Describes how to generate a Subject Alternative
Name extension in base-64 encoding.
Chapter 21, HTTP Client Describes how to communicate with any HTTP/
HTTPS server.
Chapter 22, OCSP Request Describes how to verify certificate status by
submitting Online Certificate Status Protocol
(OCSP) requests to an instance of an OCSP
subsystem.

Common Tool Information
ix
Chapter 23, PKCS #10 Client Describes how to generate a Public-Key
Cryptography Standards (PKCS) #10 enrollment
request.
Chapter 24, Bulk Issuance Tool Describes how to send either a KEYGEN or
CRMF enrollment request to the bulk issuance
interface to create certificates automatically.
Chapter 25, Revocation Automation Utility Describes how to automate user management
scripts to revoke certificates.
Chapter 26, tpsclient Describes how to test the TPS configuration and
common operations.
Table 1. List of Contents
3. Common Tool Information
All of the tools in this guide are located in the /usr/bin directory, except for the Silent Install tool
which is downloaded separately and installed to any directory. These tools can be run from any
location without specifying the tool location.
4. Examples and Formatting
4.1. File Locations for Examples and Commands
All of the examples for Red Hat Certificate System commands, file locations, and other usage are
given for Red Hat Enterprise Linux 4 (32 bit) systems. Be certain to use the appropriate commands
and files for your platform.
To start the Red Hat Certificate System:
/etc/init.d/rhpki-ca start
Example 1. Example Command
All of the tools for Red Hat Certificate System are located in the /usr/bin directory. These tools can
be run from any location without specifying the tool location.
4.2. Using Mozilla LDAP Tools
There is another important consideration with the LDAP utilities. The LDAP tools referenced in
this guide are Mozilla LDAP, installed with Red Hat Certificate System in the /usr/dir/mozldap
directory on Red Hat Enterprise Linux.
However, Red Hat Enterprise Linux systems also include LDAP tools from OpenLDAP in the /usr/
bin directory. It is possible to use the OpenLDAP commands as shown in the examples, but you must
use the -x argument to disable SASL, which OpenLDAP tools use by default.
4.3. Default Port Numbers
After Errata RHSA-2009:0007, Certificate System 7.3 supports port separation. Port separation means
that the different subsystem services for administrators, agents, and end entities run on different, user-
defined ports.

About This Guide
x
The default subsystem instances, however, are configured to use a single secure port for all services.
Therefore, any example commands or files reference these default ports.
Susbsystem SSL Port Non-SSL Port
CA 9443 9080
RA 12889 12888
DRM 10443 10080
OCSP 11443 11080
TKS 13443 13080
TPS 7889 7888
Table 2. Default Subsystem Ports
4.4. Guide Formatting
Certain words are represented in different fonts, styles, and weights. Different character formatting is
used to indicate the function or purpose of the phrase being highlighted.
Formatting Style Purpose
Monospace font Monospace is used for commands, package names, files and
directory paths, and any text displayed in a prompt.
Monospace
with a
background
This type of formatting is used for anything entered or returned
in a command prompt.
Italicized text Any text which is italicized is a variable, such as
instance_name or hostname. Occasionally, this is also used to
emphasize a new term or other phrase.
Bolded text Most phrases which are in bold are application names, such as
Cygwin, or are fields or options in a user interface, such as a
User Name Here: field or Save button.
Other formatting styles draw attention to important text.
NOTE
A note provides additional information that can help illustrate the behavior of the system or
provide more detail for a specific issue.
IMPORTANT
Important information is necessary, but possibly unexpected, such as a configuration
change that will not persist after a reboot.
WARNING
A warning indicates potential data loss, as may happen when tuning hardware for
maximum performance.

Additional Reading
xi
5. Additional Reading
The Certificate System Administrator's Guide describes how to set up, configure, and administer the
Certificate System subsystems and how to configure backend certificate management functions, such
as publishing and logging. The Administrator's Guide also describes how to configure subsystems to
relate to one another to manage certificates and tokens and how to manage certificates and tokens;
this guide is targeted for Certificate System administrators.
The Certificate System Agent's Guide describes how agents — users responsible for processing
certificate requests and managing other aspects of certificate management — can use the Certificate
System subsystems web services pages to process certificate requests, key recovery, OCSP requests
and CRLs, and other functions.
The documentation for Certificate System includes the following guides:
•Certificate System Administrator's Guide explains all administrative functions for the Certificate
System, such as adding users, creating and renewing certificates, managing smart cards, publishing
CRLs, and modifying subsystem settings like port numbers.
•Certificate System Agent's Guide details how to perform agent operations for the CA, RA, DRM, and
TPS subsystems through the Certificate System agent services interfaces.
•Certificate System Command-Line Tools Guide covers the command-line scripts supplied with Red
Hat Certificate System.
•Managing Smart Cards with the Enterprise Security Client explains how to install, configure, and use
the Enterprise Security Client, the user client application for managing smart cards, user certificates,
and user keys.
•Certificate System Migration Guides cover version-specific procedures for migrating from older
versions of Certificate System to Red Hat Certificate System 7.3.
•Release Notes contains important information on new features, fixed bugs, known issues and
workarounds, and other important deployment information for Red Hat Certificate System 7.3.
For the latest information about Red Hat Certificate System, including current release notes, complete
product documentation, technical notes, and deployment information, see http://www.redhat.com/docs/
manuals/cert-system/.
6. Giving Feedback
If there is any error in this Command-Line Tools Guide or there is any way to improve the
documentation, please let us know. Bugs can be filed against the documentation for Red Hat
Certificate System through Bugzilla, http://bugzilla.redhat.com/bugzilla. Make the bug report as
specific as possible, so we can be more effective in correcting any issues:
• Select the Red Hat Certificate System product.
• Set the component to Doc - cli-tools-guide.
• Set the version number to 7.3.
• For errors, give the page number (for the PDF) or URL (for the HTML), and give a succinct
description of the problem, such as incorrect procedure or typo.

About This Guide
xii
For enhancements, put in what information needs to be added and why.
• Give a clear title for the bug. For example, "Incorrect command example for setup
script options" is better than "Bad example".
We appreciate receiving any feedback — requests for new sections, corrections, improvements,
enhancements, even new ways of delivering the documentation or new styles of docs. You are
welcome to contact Red Hat Content Services directly at [email protected].
7. Document History
Revision 7.3.4 March 25, 2010 Ella Deon Lackey [email protected]
Adding information on new end-entities client authentication port for the CA, related to the MitM
resolution in Errata RHBA-2010:0170.
Revision 7.3.3 January 29, 2009 Ella Deon Lackey [email protected]
Added port separation parameters and usage to pkicreate for Errata RHSA-2009:0007.
Updated examples and formatting section to define default ports used in examples.
Revision 7.3.2 Tuesday, August 5, 2008 Ella Deon Lackey [email protected]
Edited setpin options per Bugzilla #224748 and Bugzilla #224930
Revision
7.3.0-1
Fri May 25 2007 David O'Brien [email protected]
Removed ecc as key type option
Added pkisilent tool syntax for RA
Revision
7.3.0-0
Thu May 24 2007 David O'Brien [email protected]
Added revision history.
Updated version for 7.3.0
Updates to presentation and layout for commands.

Chapter 1.
1
Create and Remove Instance Tools
The Certificate System includes two tools to create and remove subsystem instances, pkicreate
and pkiremove.
NOTE
The pkicreate tool does not install the Certificate System system; this is done through
installing the packages or running the Red Hat Enterprise Linux up2date command. This
tool creates new instances after the default subsystems have been installed.
Likewise, the pkiremove utility does not uninstall the Certificate System subsystem; it
removes a single instance.
1.1. pkicreate
The pkicreate tool creates instances of Certificate System subsystems and does a minimal
configuration of the new instance, such as setting the configuration directory and port numbers.
Further configuration is done through the HTML configuration page, as with configuring the default
instances.
The following sections explain the syntax and usage of the pkicreate tool.
1.1.1. Syntax
This tool has the following syntax:
pkicreate -pki_instance_root=/directory/path -subsystem_type=type -
pki_instance_name=instance_ID [-secure_port=SSLport | [-agent_secure_port=SSLport -
ee_secure_port=SSLport -ee_secure_client_auth_port=SSLport -admin_secure_port=SSLport]]
[-unsecure_port=port] -tomcat_server_port=port -user=user_name -group=group_name [-
verbose] [-help]
NOTE
The pkicreate tool also accepts an environment variable, DONT_RUN_PKICREATE;
if this is set, the pkicreate utility is prevented from doing anything. When the
DONT_RUN_PKICREATE variable is set before installing the default subsystem instance
(before running the rhpki-install script), this allows the default instance to be
installed in a user-defined location instead of the default location.
Parameter Description
pki_instance_root Gives the full path to the new instance
configuration directory.
subsystem_type Gives the type of subsystem being created. The
possible values are as follows:
•ca, for a Certificate Authority
•ra, for a Registration Authority

Chapter 1. Create and Remove Instance Tools
2
Parameter Description
•kra, for a DRM
•ocsp, for an OCSP
•tks, for a TKS
•tps, for a TPS
pki_instance_name Gives the name of the new instance.The name
must be unique within the security domain. Even
cloned subsystems must have different instance
names for cloning to succeed.
secure_port Sets the SSL port number for the subsystem.
This parameter is required if port separation is
not configured, meaning that separate ports are
assigned for the admininistrator, agent, and end-
entities services.
agent_secure_port Optional. Sets the SSL port for the agent
web services. If this is specified, then both
ee_secure_port and admin_secure_port
must be specified. For CAs only, an end-entities
client authentication port is also required with the
ee_secure_client_auth_port option.
ee_secure_port Optional. Sets the SSL port for the end-
entities web services. If this is specified,
then both agent_secure_port and
admin_secure_port must be specified.
For CAs only, an end-entities client
authentication port is also required with the
ee_secure_client_auth_port option.
ee_secure_client_auth_port For CAs only. Sets the SSL port for the end-
entity client authentication. If this is specified,
then ee_secure_port, agent_secure_port,
and admin_secure_port must be specified.
admin_secure_port Optional. Sets the SSL port number for
the administrator services, usually the
pkiconsole. If this is specified, then both
agent_secure_port and ee_secure_port.
For CAs only, an end-entities client
authentication port is also required with the
ee_secure_client_auth_port option.
unsecure_port Optional. Sets the regular port number. If this is
not set, the number is randomly generated.
tomcat_server_port Sets the port number for the Tomcat web server.
This option must be set for CA, OCSP, TKS, and
DRM instances. tomcat_server_port is not
used when creating a TPS instance since it does
not use a Tomcat web server.

Usage
3
Parameter Description
user Sets the user as which the Certificate System
instance will run. This option must be set.
group Sets the group as which the Certificate System
instance will run. This option must be set.
verbose Optional. Runs the new instance creation in
verbose mode.
help Shows the help information.
Table 1.1.
1.1.2. Usage
In Example 1.1, “Default pkicreate Usage”, the pkicreate is used to create a new CA instance
running on ports 9180 and 9543, named rhpki-ca2, in the /var/lib/rhpki-ca2 directory.
pkicreate -pki_instance_root=/var/lib -subsystem_type=ca -pki_instance_name=rhpki-
ca2 -ee_secure_port=9543 -ee_secure_client_auth_port=9546 -unsecure_port=9180 -
tomcat_server_port=1802 -user=pkiuser -group=pkiuser -verbose
Example 1.1. Default pkicreate Usage
Alternatively, the CA services can run on different ports. Example 1.2, “pkicreate with Port Separation”
creates a CA instance with port separation. The agent port is 9544, the end-entity port is 9543, and
the administrator port is 9545.
pkicreate -pki_instance_root=/var/lib -subsystem_type=ca -pki_instance_name=rhpki-ca2
-agent_secure_port=9544 -ee_secure_port=9543 -ee_secure_client_auth_port=9546 -
admin_secure_port=9545 -unsecure_port=9180 -tomcat_server_port=1802 -user=pkiuser -
group=pkiuser -verbose
Example 1.2. pkicreate with Port Separation
To keep the pkicreate script from creating a new instance when it is run, set the
DONT_RUN_PKICREATE environment variable to 1.
export DONT_RUN_PKICREATE=1
1.2. pkiremove
The pkiremove tool removes subsystem instances. This tool removes the single subsystem instance
specified; it does not uninstall the Certificate System packages.
1.2.1. Syntax
This tool has the following syntax:
pkiremove -pki_instance_root=/directory/path -pki_instance_name=instance_ID
Parameter Description
pki_instance_root Gives the full path to the instance configuration
directory.

Chapter 1. Create and Remove Instance Tools
4
Parameter Description
pki_instance_name Gives the name of the instance.
1.2.2. Usage
The following example removes a DRM instance named rhpki-drm2 which was installed in the /
var/lib/rhpki-drm2 directory.
pkiremove -pki_instance_root=/var/lib -pki_instance_name=rhpki-drm2

Chapter 2.
5
Silent Installation
The Certificate System includes a tool, pkisilent, which can completely create and configure
an instance in a single step. Normally, adding instances requires running the pkicreate utility to
create the instance and then accessing the subsystem HTML page to complete the configuration. The
pkisilent utility creates and configures the instance in a single step. The pkisilent tool must
be downloaded independently. It is available through the Red Hat Certificate System 7.3 Red Hat
Network channel.
NOTE
Run this tool on a system which already has a subsystem installed, since this tool
depends on having libraries, JRE, and core jar files already installed.
Two files are installed for the pkisilent tool:
•pkisilent, the Perl wrapper script.
•pkisilent.jar, the jar files containing the Java™ classes to perform a silent installation.
The utility can be downloaded and saved to any location and is then executed locally.
2.1. Syntax
This tool has the following syntax for a CA:
perl pkisilent ConfigureCA -cs_hostname hostname
-cs_port SSLport
-client_certdb_dir certDBdir
-client_certdb_pwd password
-preop_pin preoppin
-domain_name domain_name
-admin_user adminUID
-admin_email admin@email
-admin_password password
-agent_name agentName
-agent_key_size keySize
-agent_key_type keyType
-agent_cert_subject cert_subject_name
-ldap_host hostname
-ldap_port port
-bind_dn bindDN
-bind_password password
-base_dn search_base_DN
-db_name dbName
-key_size keySize
-key_type keyType
-token_name HSM_name
-token_pwd HSM_password
-save_p12 export-p12-file
-backup_pwd password
This tool has the following syntax for the RA subsystem:
perl pkisilent ConfigureRA

Chapter 2. Silent Installation
6
-help,-? displays help information
-cs_hostname CS Hostname
-cs_port CS SSL port
-sd_hostname Security Domain Hostname
-sd_ssl_port Security Domain SSL port
-sd_admin_name Security Domain username
-sd_admin_password Security Domain password
-ca_hostname CA Hostname
-ca_port CA non SSL port
-ca_ssl_port CA SSL port
-client_certdb_dir Client CertDB dir
-client_certdb_pwd client certdb password
-preop_pin pre op pin
-domain_name domain name
-admin_user Admin User Name
-admin_email Admin email
-admin_password Admin password
-agent_name Agent Cert Nickname
-token_name HSM/Software Token name
-token_pwd HSM/Software Token password
-key_size Key Size
-key_type Key type [rsa]
-agent_key_size Agent Cert Key Size
-agent_key_type Agent cert Key type [rsa]
-agent_cert_subject Agent cert Subject
-ra_subsystem_cert_subject_name RA subsystem cert subject name
-ra_server_cert_subject_name RA server cert subject name
-subsystem_name RA subsystem name
This tool has the following syntax for the DRM, OCSP, and TKS subsystems:
perl pkisilent ConfiguresubsystemType -cs_hostname hostname
-cs_port SSLport
-ca_hostname hostname
-ca_port port
-ca_ssl_port SSLport
-ca_agent_name agentName
-ca_agent_password password
-client_certdb_dir certDBdir
-client_certdb_pwd password
-preop_pin preoppin
-domain_name domain_name
-admin_user adminUID
-admin_email admin@email
-admin_password password
-agent_name agentName
-ldap_host hostname
-ldap_port port
-bind_dn bindDN
-bind_password password
-base_dn search_base_DN
-db_name dbName
-key_size keySize
-key_type keyType
-agent_key_size keySize
-agent_key_type keyType
-agent_cert_subject cert_subject_name
-backup_pwd password
This tool has the following syntax for the TPS subsystem:

Syntax
7
perl pkisilent ConfigureTPS -cs_hostname hostname
-cs_port SSLport
-ca_hostname hostname
-ca_port port
-ca_ssl_port SSLport
-ca_agent_name agentName
-ca_agent_password password
-client_certdb_dir certDBdir
-client_certdb_pwd password
-preop_pin preoppin
-domain_name domain_name
-admin_user adminUID
-admin_email admin@email
-admin_password password
-agent_name agentName
-ldap_host hostname
-ldap_port port
-bind_dn bindDN
-bind_password password
-base_dn search_base_DN
-db_name dbName
-key_size keySize
-key_type keyType
-agent_key_size keySize
-agent_key_type keyType
-agent_cert_subject cert_subject_name
-ldap_auth_host ldap_auth_host
-ldap_auth_port ldap_auth_port
-ldap_auth_base_dn ldap_auth_base_dn
Java™ Class Name Subsystem
ConfigureCA For the CA.
ConfigureRA For the RA.
ConfigureDRM For the DRM.
ConfigureOCSP For the OCSP.
ConfigureTKS For the TKS.
ConfigureTPS For the TPS.
Table 2.1. Subsystem Java™ Classes for pkisilent
NOTE
The ConfigureCA script is used to create a security domain or to add the new CA to an
existing domain. The other scripts only add the subsystem to an existing security domain.
Parameter Description
cs_hostname The hostname for the Certificate System
machine.
cs_port The SSL port number of the Certificate System.
ca_hostname The hostname for the CA subsystem which will
issue the certificates for the DRM, OCSP, TKS,
or TPS subsystem.
ca_port The non-SSL port number of the CA.

Chapter 2. Silent Installation
8
Parameter Description
ca_ssl_port The SSL port number of the CA.
ca_agent_name The UID of the CA agent.
ca_agent_password The password of the CA agent.
client_certdb_dir The directory for the subsystem certificate
databases.
client_certdb_pwd The password to protect the certificate database.
preop_pin The preoperation PIN number used for the initial
configuration.
domain_name The name of the security domain to which the
subsystem will be added.
admin_user The new admin user for the new subsystem.
admin_email The email address of the admin user.
admin_password The password for the admin user.
agent_name The new agent for the new subsystem.
agent_key_size The key size to use for generating the agent
certificate and key pair.
agent_key_type The key type to use for generating the agent
certificate and key pair.
agent_cert_subject The subject name for the agent certificate.
ldap_host The hostname of the Directory Server machine.
ldap_port The non-SSL port of the Directory Server.
bind_dn The bind DN which will access the Directory
Server; this is normally the Directory Manager ID.
bind_password The bind DN password.
base_dn The entry DN under which to create all of the
subsystem entries.
db_name The database name.
key_size The size of the key to generate. The
recommended size for an RSA key is 1024 bits
for regular operations and 2048 bits for sensitive
operations.
key_type The type of key to generate; the only option is
RSA.
save_p12 Sets whether to export the keys and certificate
information to a backup PKCS #12 file. true
backs up the information; false does not back
up the information. Only for the CA subsystem.
backup_pwd The password to protect the PKCS #12
backup file containing the subsystem keys and
certificates. Not for use with TPS installation.