Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

Chapter 23. Subsystem control and maintenance

This chapter provides information on how to control (start, stop, restart, and status check) a Red Hat Certificate System subsystem, as well as general maintenance (health check) recommendation.

23.1. Starting, stopping, restarting and obtaining status
링크 복사

Red Hat Certificate System subsystem instances can be stopped and started using the systemctl utility on Red Hat Enterprise Linux {VER}.

Note

You can also use the pki-server alias to start and stop instances: pki-server <command> <instance> is an alias to systemctl <command> pki-tomcatd@<instance>.service.

  • To start an instance: 

    # systemctl start unit_file@instance_name.service
# pki-server start instance_name
    Copy to Clipboard Toggle word wrap

  • To stop an instance: 

    # systemctl stop unit_file@instance_name.service
# pki-server stop instance_name
    Copy to Clipboard Toggle word wrap

  • To restart an instance: 

    # systemctl restart unit_file@instance_name.service
# pki-server restart instance_name
    Copy to Clipboard Toggle word wrap

  • To display the status of an instance: 

    # systemctl status unit_file@instance_name.service
    Copy to Clipboard Toggle word wrap

unit_file has one of the following values:

  • pki-tomcat: with watchdog disabled
  • pki-tomcat-nuxwdog: with watchdog enabled

23.2. Subsystem health check
링크 복사

It is important for administrators to periodically monitor possible failures, such as the following:

  • Audit failure caused by a full disk
  • Signing failure caused by HSM connection issue
  • LDAP server connection issues
  • And so on

Self-tests can also be run by demand as described in Section 15.8, “Running self-tests”.

PKI Healthcheck is a command-line tool that helps find issues that may impact the health of your Certificate System environment. If needed, this tool can report to the Healthcheck tool present in Red Hat Identity Management.

23.2.1. PKI Healthcheck test modules
링크 복사

PKI Healthcheck consists of independent modules which test for:

  • Certificate sync between CS.cfg and NSS database:

    Checks whether the system certificates in CS.cfg (located in /var/lib/pki/<instance>/<subsystem>/conf/CS.cfg) and NSS database (located in /var/lib/pki/<instance>/alias/) match. Else, the Certificate Authority (CA) fails to start.

  • System certificate expiry:

    Checks the expiry status of the installed system certificates (See System Certificates for more information).

  • System certificate trust flags:

    Checks whether the installed system certificates carry the correct Trust flags (See System Certificates for more information).

  • Subsystem connectivity check:

    Checks whether a subsystem is running and able to respond to requests.

  • Subsystem clones connectivity and data check:

    Checks simple connectivity and data sanity for a set of clones configured within a given CS subsystem. A given CA subsystem’s security domain is consulted to identify clones that have been set. The check then proceeds to reach out to each clone and verify data sanity where applicable.

23.2.2. PKI Healthcheck configuration
링크 복사

The PKI Healthcheck tool configuration is stored at /etc/pki/healthcheck.conf. It looks like the following: 

[global]
	 plugin_timeout=300
	 cert_expiration_days=30

     # Dogtag specific section
     [dogtag]
     instance_name=pki-tomcat
Copy to Clipboard Toggle word wrap

23.2.3. Running PKI Healthcheck
링크 복사

To perform a health check, run the pki-healthcheck command. You can also execute a specific check. For example: 

# pki-healthcheck --source pki.server.healthcheck.meta.csconfig --check DogtagCertsConfigCheck
Copy to Clipboard Toggle word wrap

For more information on the possible options, see the man page: man pki-healthcheck.

23.2.4. PKI Healthcheck output formats
링크 복사

Healthcheck generates the following outputs, which you can set using the --output-type:

  • By default, machine-readable output in JSON format (json).
  • Alternatively, human-readable output (human).

You can specify an alternative file destination with the --output-file option.

23.2.5. PKI Healthcheck results
링크 복사

The report consists of a message describing what was run and the status. Each health check module returns one of the following results:

SUCCESS
Configured as expected, the check executed and found no issue
WARNING
Not an error, but worth keeping an eye on or evaluating (e.g. a certificate will expire soon)
ERROR
Not configured as expected, something is wrong but your server is probably still working (e.g. a clone conflict)
CRITICAL
Not configured as expected, with a high possibility for impact (e.g. a service is not started, certificates are expired, etc.)

If the status is not successful, the message may include additional information or recommendations, which can be used by the admin to correct the issue (e.g. a file has the wrong permissions, expected X and got Y).

맨 위로 이동
Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

Theme

© 2025 Red Hat