Red Hat Summit Red Hat SummitSupportKonsoleEntwicklerDemo startenKontakt

Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.

Chapter 14. Setting automated jobs

The Certificate System provides a customizable Job Scheduler that can execute specific jobs at specified times. This chapter explains how to configure Certificate System to use specific job plug-in modules for accomplishing jobs.

NOTE

Automated jobs are not to be confused with automated notifications. See Chapter 13, Using automated notifications for more on this topic.

The job scheduler supports various mechanisms for scheduling cron jobs. It is similar to a traditional Unix cron daemon; it takes registered cron jobs and executes them at a pre-configured date and time. If configured, the scheduler checks at specified intervals for jobs waiting to be executed; if the specified execution time has arrived, the scheduler initiates the job automatically.

14.1. About automated jobs
Link kopieren

Jobs are implemented as Java™ classes, which are then registered with Certificate System as plug-in modules. One implementation of a job module can be used to configure multiple instances of the job. Each instance must have a unique name (an alphanumeric string with no spaces) and can contain different input parameter values to apply to different jobs.

The automated jobs feature is set up by doing the following:

The types of automated jobs are:

  • RenewalNotificationJob
  • RequestInQueueJob
  • PublishCertsJob
  • UnpublishExpiredJob

One instance of each job type is created when Certificate System is deployed.

14.1.1. certRenewalNotifier (RenewalNotificationJob)
Link kopieren

The certRenewalNotifier job checks for certificates that are about to expire in the internal database. When it finds one, it automatically emails the certificate’s owner and continues sending email reminders for a configured period of time or until the certificate is replaced. The job collects a summary of all renewal notifications and mails the summary to the configured agents or administrators.

The job determines the email address to send the notification using an email resolver. By default, the email address is found in the certificate itself or in the certificate’s associated enrollment request.

14.1.2. requestInQueueNotifier (RequestInQueueJob)
Link kopieren

The requestInQueueNotifier job checks the status of the request queue at pre-configured time intervals. If any deferred enrollment requests are waiting in the queue, the job constructs an email message summarizing its findings and sends it to the specified agents.

14.1.3. publishCerts (PublishCertsJob)
Link kopieren

The publishCerts job checks for any new certificates that have been added to the publishing directory that have not yet been published. When these new certificates are added, they are automatically published to an LDAP directory or file by the publishCerts job.

Note

Most of the time, publishers immediately publish any certificates that are created matching their rules to the appropriate publishing directory.

If a certificate is successfully published when it is created, then the publishCerts job will not re-publish the certificate. Therefore, the new certificate will not be listed in the job summary report, since the summary only lists certificates published by the publishCerts job.

14.1.4. unpublishExpiredCerts (UnpublishExpiredJob)
Link kopieren

Expired certificates are not automatically removed from the publishing directory. If a Certificate Manager is configured to publish certificates to an LDAP directory, over time the directory will contain expired certificates.

The unpublishExpiredCerts job checks for certificates that have expired and are still marked as published in the internal database at the configured time interval. The job connects to the publishing directory and deletes those certificates; it then marks those certificates as unpublished in the internal database. The job collects a summary of expired certificates that it deleted and mails the summary to the agents or administrators specified by the configuration.

Note

This job automates removing expired certificates from the directory. Expired certificates can also be removed manually; for more information on this, see Section 10.11, “Updating certificates and CRLs in a directory”.

14.2. Setting up the Job Scheduler
Link kopieren

The Certificate Manager can execute a job only if the Job Scheduler is enabled. The job settings, such as enabling the job schedule, setting the frequency, and enabling the job modules, can be done through the Certificate System CA Console or through editing the CS.cfg file.

To turn the Job Scheduler on:

  1. Open the Certificate Manager Console. 

    pkiconsole https://server.example.com:8443/ca
    Copy to Clipboard Toggle word wrap
    Note

    pkiconsole is being deprecated.

  2. In the Configuration tab navigation tree, click Job Scheduler.

    This opens the General Settings tab, which shows whether the Job Scheduler is currently enabled.

    job sched
    View larger image
    job sched

  3. Click the Enable Jobs Scheduler checkbox to enable or disable the Job Scheduler.

    Disabling the Job Scheduler turns off all the jobs.

  4. Set the frequency which the scheduler checks for jobs in the Check Frequency field.

    The frequency is how often the Job Scheduler daemon thread wakes up and calls the configured jobs that meet the cron specification. By default, it is set to one minute.

    NOTE

    The window for entering this information may be too small to see the input. Drag the corners of the Certificate Manager Console to enlarge the entire window.

  5. Click Save.

14.3. Setting up specific jobs
Link kopieren

Automated jobs can be configured through the Certificate Manager Console or by editing the configuration file directory.

14.3.1. Configuring jobs using the console
Link kopieren

To enable and configure an automated job using the Certificate Manager Console:

  1. Open the Certificate Manager Console. 

    pkiconsole https://server.example.com:8443/ca
    Copy to Clipboard Toggle word wrap
    Note

    pkiconsole is being deprecated.

  2. Confirm that the Jobs Scheduler is enabled. See Section 14.2, “Setting up the Job Scheduler” for more information.

  3. In the Configuration tab, select Job Scheduler from the navigation tree. Then select Jobs to open the Job Instance tab.

    job
    View larger image
    job

    Select the job instance from the list, and click Edit/View.

    The Job Instance Editor opens, showing the current job configuration.

    Figure 14.1. Job Configuration

    job config
    View larger image
    job config
  4. Select enabled to turn on the job.

  5. Set the configuration settings by specifying them in the fields for this dialog.

  6. Click OK.
  7. Click Refresh to view any changes in the main window.
  8. If the job is configured to send automatic messages, check that a mail server is set up correctly. See Section 13.4, “Configuring a mail server for notifications”.
  9. Customize the email message text and appearance.

14.3.2. Configuring Jobs by Editing the Configuration File
Link kopieren

  1. Ensure that the Jobs Scheduler is enabled and configured; see Section 14.2, “Setting up the Job Scheduler”.

  2. Stop the CA subsystem instance. 

    # pki-server stop instance_name
    Copy to Clipboard Toggle word wrap
  3. Open the CS.cfg file for that server instance in a text editor.

  4. Edit all of the configuration parameters for the job module being configured.

  5. Save the file.

  6. Restart the server instance. 

    pki-server start instance_name
    Copy to Clipboard Toggle word wrap
  7. If the job sends automated messages, check that the mail server is set up correctly. See Section 13.4, “Configuring a mail server for notifications”.
  8. Customize the automatic job messages.

14.4. Configuration parameters of jobs
Link kopieren

This sections lists the parameters for the frequency settings and for each of the four types of jobs:

  • RenewalNotificationJob
  • RequestInQueueJob
  • PublishCertsJob
  • UnpublishExpiredJob

14.5. Frequency Settings for Automated Jobs
Link kopieren

The Job Scheduler uses a variation of the Unix crontab entry format to specify dates and times for checking the job queue and executing jobs. As shown in Table 14.1, “Time Values for Scheduling Jobs” and Section 14.3.1, “Configuring jobs using the console”, the time entry format consists of five fields. (The sixth field specified for the Unix crontab is not used by the Job Scheduler.) Values are separated by spaces or tabs.

Each field can contain either a single integer or a pair of integers separated by a hyphen (-) to indicate an inclusive range. To specify all legal values, a field can contain an asterisk rather than an integer. Day fields can contain a comma-separated list of values. The syntax of this expression is 

Minute Hour Day_of_month Month_of_year Day_of_week
Copy to Clipboard Toggle word wrap
Expand
Table 14.1. Time Values for Scheduling Jobs
FieldValue

Minute

0-59

Hour

0-23

Day of month

1-31

Month of year

1-12

Day of week

0-6 (where 0=Sunday)

For example, the following time entry specifies every hour at 15 minutes (1:15, 2:15, 3:15, and so on): 

15 * * * *
Copy to Clipboard Toggle word wrap

The following example sets a job to run at noon on April 12: 

0 12 12 4 *
Copy to Clipboard Toggle word wrap

The day-of-month and day-of-week options can contain a comma-separated list of values to specify more than one day. If both day fields are specified, the specification is inclusive; that is, the day of the month is not required to fall on the day of the week to be valid. For example, the following entry specifies a job execution time of midnight on the first and fifteenth of every month and on every Monday: 

0 0 1,15 * 1
Copy to Clipboard Toggle word wrap

To specify one day type without the other, use an asterisk in the other day field. For example, the following entry runs the job at 3:15 a.m. every weekday morning: 

15 3 * * 1-5
Copy to Clipboard Toggle word wrap

14.5.1. Configuration parameters of certRenewalNotifier
Link kopieren

The following table gives details for each of these parameters that can be configured for the certRenewalNotifier job, either in the CS.cfg file or in the Certificate Manager Console.

Expand
Table 14.2. certRenewalNotifier parameters
ParameterDescription

enabled

Specifies whether the job is enabled or disabled. The value true enables the job; false disables it.

cron

Sets the schedule when this job should be run. This sets the time at which the Job Scheduler daemon thread checks the certificates for sending renewal notifications. These settings must follow the conventions in Section 14.5, “Frequency Settings for Automated Jobs”. For example:

0 3 * * 1-5

The job in this example is run Monday through Friday at 3:00 pm.

notifyTriggerOffset

Sets how long (in days) before the certificate expiration date the first notification will be sent.

notifyEndOffset

Sets how long (in days) after the certificate expires that notifications will continue to be sent if the certificate is not replaced.

senderEmail

Sets the sender of the notification messages, who will be notified of any delivery problems.

emailSubject

Sets the text of the subject line of the notification message.

emailTemplate

Sets the path, including the filename, to the directory that contains the template to use to create the message content.

summary.enabled

Sets whether a summary report of renewal notifications should be compiled and sent. The value true enables sending the summary; false disables it. If enabled, set the remaining summary parameters; these are required by the server to send the summary report.

summary.recipientEmail

Specifies the recipients of the summary message. These can be agents who need to know the status of user certificates or other users. Set more than one recipient by separating each email address with a comma.

summary.senderEmail

Specifies the email address of the sender of the summary message.

summary.emailSubject

Gives the subject line of the summary message.

summary.itemTemplate

Gives the path, including the filename, to the directory that contains the template to use to create the content and format of each item to be collected for the summary report.

summary.emailTemplate

Gives the path, including the filename, to the directory that contains the template to use to create the summary report email notification.

14.5.2. Configuration parameters of requestInQueueNotifier
Link kopieren

The following table gives details for each of these parameters that can be configured for the requestInQueueNotifier job, either in the CS.cfg file or in the Certificate Manager Console.

Expand
Table 14.3. requestInQueueNotifier parameters
ParameterDescription

enabled

Sets whether the job is enabled (true) or disabled (false).

cron

Sets the time schedule for when the job should run. This is the time at which the Job Scheduler daemon thread checks the queue for pending requests. This setting must follow the conventions in Section 14.5, “Frequency Settings for Automated Jobs”. For example:

0 0 * * 0

subsystemid

Specifies the subsystem which is running the job. The only possible value is ca, for the Certificate Manager.

summary.enabled

Specifies whether a summary of the job accomplished should be compiled and sent. The value true enables the summary reports; false disables them. If enabled, set the remaining summary parameters; these are required by the server to send the summary report.

summary.emailSubject

Sets the subject line of the summary message.

summary.emailTemplate

Specifies the path, including the filename, to the directory containing the template to use to create the summary report.

summary.senderEmail

Specifies the sender of the notification message, who will be notified of any delivery problems.

summary.recipientEmail

Specifies the recipients of the summary message. These can be agents who need to process pending requests or other users. More than one recipient can be listed by separating each email address with a comma.

14.5.3. Configuration parameters of publishCerts
Link kopieren

The following table gives details for each of these parameters that can be configured for the publishCerts job, either in the CS.cfg file or in the Certificate Manager Console.

Expand
Table 14.4. publishCerts parameters
ParameterDescription

enabled

Sets whether the job is enabled. The value true is enabled; false is disabled.

cron

Sets the time schedule for when the job runs. This is the time the Job Scheduler daemon thread checks the certificates to removing expired certificates from the publishing directory. This setting must follow the conventions in Section 14.5, “Frequency Settings for Automated Jobs”. For example:

0 0 * * 6

summary.enabled

Specifies whether a summary of the certificates published by the job should be compiled and sent. The value true enables the summaries; false disables them. If enabled, set the remaining summary parameters; these are required by the server to send the summary report.

summary.emailSubject

Gives the subject line of the summary message.

summary.emailTemplate

Specifies the path, including the filename, to the directory containing the template to use to create the summary report.

summary.itemTemplate

Specifies the path, including the filename, to the directory containing the template to use to create the content and format of each item collected for the summary report.

summary.senderEmail

Specifies the sender of the summary message, who will be notified of any delivery problems.

summary.recipientEmail

Specifies the recipients of the summary message. These can be agents who need to know the status of user certificates or other users. More than one recipient can be set by separating each email address with a comma.

14.5.4. Configuration parameters of unpublishExpiredCerts
Link kopieren

The following table gives details for each of these parameters that can be configured for the unpublishedExpiresCerts job, either in the CS.cfg file or in the Certificate Manager Console.

Expand
Table 14.5. unpublishExpiredCerts parameters
ParameterDescription

enabled

Sets whether the job is enabled. The value true is enabled; false is disabled.

cron

Sets the time schedule for when the job runs. This is the time the Job Scheduler daemon thread checks the certificates to removing expired certificates from the publishing directory. This setting must follow the conventions in Section 14.5, “Frequency Settings for Automated Jobs”. For example:

0 0 * * 6

summary.enabled

Specifies whether a summary of the certificates published by the job should be compiled and sent. The value true enables the summaries; false disables them. If enabled, set the remaining summary parameters; these are required by the server to send the summary report.

summary.emailSubject

Gives the subject line of the summary message.

summary.emailTemplate

Specifies the path, including the filename, to the directory containing the template to use to create the summary report.

summary.itemTemplate

Specifies the path, including the filename, to the directory containing the template to use to create the content and format of each item collected for the summary report.

summary.senderEmail

Specifies the sender of the summary message, who will be notified of any delivery problems.

summary.recipientEmail

Specifies the recipients of the summary message. These can be agents who need to know the status of user certificates or other users. More than one recipient can be set by separating each email address with a comma.

14.6. Registering a job module
Link kopieren

You can register custom job plug-ins through the Certificate Manager Console. Registering a new module involves specifying the name of the module and the full name of the Java™ class that implements the module.

To register a new job module:

  1. Create the custom job class. For this example, the custom job plug-in is called MyJob.java.

  2. Compile the new class. 

    javac -d . -classpath $CLASSPATH MyJob.java
    Copy to Clipboard Toggle word wrap

  3. Create a directory in the CA’s WEB-INF web directory to hold the custom classes, so that the CA can access them. 

    mkdir /var/lib/pki/ instance_name/ca/webapps/ca/WEB-INF/classes
    Copy to Clipboard Toggle word wrap

  4. Copy the new plug-in files into the new classes directory, and set the owner to the Certificate System system user (pkiuser). 

    cp -pr com /var/lib/pki/ instance_name/ca/webapps/ca/WEB-INF/classes

chown -R pkiuser:pkiuser /var/lib/pki/ instance_name/ca/webapps/ca/WEB-INF/classes
    Copy to Clipboard Toggle word wrap

  5. Register the plug-in.

    1. Log into the Certificate Manager Console. 

      pkiconsole https://server.example.com:8443/ca
      Copy to Clipboard Toggle word wrap
      Note

      pkiconsole is being deprecated.

    2. In the Configuration tab, select Job Scheduler in the left navigation tree. Select Jobs.

      The Job Instance tab opens, which lists any currently configured jobs. Select the Job Plugin Registration tab.

    3. Click Register to add the new module.

    4. In the Register Job Scheduler Plugin Implementation window, supply the following information:

      • Plugin name. Type a name for the plug-in module.
      • Class name. Type the full name of the class for this module; this is the path to the implementing Java™ class. If this class is part of a package, include the package name. For example, to register a class named customJob that is in a package named com.customplugins, type com.customplugins.customJob.
    5. Click OK.
NOTE

It is also possible to delete job modules, but this is not recommended.

If it is necessary to delete a module, open the Job Plugin Registration tab as when registering a new module, select the module to delete, and click Delete. When prompted, confirm the deletion.

Nach oben
Red Hat logoGithubredditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können. Entdecken Sie unsere neuesten Updates.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

Theme

© 2025 Red Hat