Red Hat SummitCe contenu n'est pas disponible dans la langue sélectionnée.
13.2. PKI Instance Execution Management
The act of starting, stopping, restarting, or obtaining the status of a PKI instance is known as execution management. Each PKI instance, separate or shared, is started, stopped, restarted, and has its status obtained separately. This section describes the execution management for any PKI instance.
13.2.1. Starting, Stopping, and Restarting a PKI Instance
Copier lienLien copié sur presse-papiers!
A PKI instance is started, stopped, and restarted like other system programs, using
systemd.
- Log in to the server machine as
root. - Run the
systemctlcommand, specifying the action and the instance name:systemctl start|stop|restart pki-tomcatd@instance_name.service
systemctl start|stop|restart pki-tomcatd@instance_name.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow For example:systemctl restart pki-tomcatd@pki-tomcat.service
systemctl restart pki-tomcatd@pki-tomcat.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow
13.2.2. Restarting a PKI Instance after a Machine Restart
Copier lienLien copié sur presse-papiers!
If a computer running one or more PKI instances is shut down unexpectedly, more services than just the PKI instances must be restarted, in the proper order, for the subsystem to be available both through the HTML services page and the administrative console.
- If the Directory Server instance used by the subsystem is installed on the local machine, restart the Administration Server and the Directory Server processes.
systemctl start dirsrv-admin.service systemctl start dirsrv@instance_name.service
systemctl start dirsrv-admin.service systemctl start dirsrv@instance_name.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow - Start the Certificate System subsystem instances.
systemctl start pki-tomcatd@instance_name.service
systemctl start pki-tomcatd@instance_name.serviceCopy to Clipboard Copied! Toggle word wrap Toggle overflow
13.2.3. Checking the PKI Instance Status
Copier lienLien copié sur presse-papiers!
The
systemctl command can be used to check the status of a process, showing whether it is running or stopped. For example:
If the instance is running, the status check returns information similar to the following example:
13.2.4. Configuring a PKI Instance to Automatically Start Upon Reboot
Copier lienLien copié sur presse-papiers!
The
systemctl command can be used to automatically start instances upon reboot. For example, the following commands automatically start the Red Hat Administration Server, Directory Server, and a CA upon reboot:
systemctl enable dirsrv-admin.service systemctl enable dirsrv.target systemctl enable pki-tomcatd@pki-tomcat.service
# systemctl enable dirsrv-admin.service
# systemctl enable dirsrv.target
# systemctl enable pki-tomcatd@pki-tomcat.serviceNote
The default PKI instance installation and configuration using the
pkispawn command automatically enables the instance to start upon reboot.
To disable this behavior (that is, to prevent PKI instances from automatically starting upon reboot), issue the following commands:
systemctl disable pki-tomcatd@pki-tomcat.service systemctl disable dirsrv.target systemctl disable dirsrv-admin.service
# systemctl disable pki-tomcatd@pki-tomcat.service
# systemctl disable dirsrv.target
# systemctl disable dirsrv-admin.service13.2.5. Setting sudo Permissions for Certificate System Services
Copier lienLien copié sur presse-papiers!
For both simplicity of administration and security, the Certificate System and Directory Server processes can be configured so that PKI administrators (instead of only root) can start and stop the services.
A recommended option when setting up subsystems is to use a
pkiadmin system group. (Details are in the Red Hat Certificate System 9 Planning, Installation, and Deployment Guide.) All of the operating system users which will be Certificate System administrators are then added to this group. If this pkiadmin system group exists, then it can be granted sudo access to perform certain tasks.
- Edit the
/etc/sudoersfile; on Red Hat Enterprise Linux 7, this can be done using thevisudocommand:visudo
# visudoCopy to Clipboard Copied! Toggle word wrap Toggle overflow - Depending on what is installed on the machine, add a line for the Directory Server, the Administration Server, PKI management tools, and each PKI subsystem instance, granting
sudorights to thepkiadmingroup:Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Important
Make sure to set sudo permissions for every Certificate System, Directory Server, and Administration Server on the machine — and only for those instances on the machine. There could be multiple instances of the same subsystem type on a machine or no instance of a subsystem type. It depends on the deployment.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}