Red Hat Summit Red Hat SummitSuporteConsoleDesenvolvedoresComeçar um testeContato

Este conteúdo não está disponível no idioma selecionado.

Chapter 10. Self-tests

Red Hat Certificate System has the added functionality to allow self-tests of the server. The self-tests are run at start up and can also be run on demand. The startup self-tests run when the server starts and keep the server from starting if a critical self-test fails. The on-demand self-tests are run by clicking the self-tests button in the subsystem console.

10.1. Running self-tests
Copiar o link

You can run the on-demand self-tests using the CLI on all CS subsystems (CA, OCSP, KRA, TKS, and TPS).

The console also provides on-demand self-tests services, however only for the CA, OCSP, KRA, and TKS subsystems - not for the TPS. As the pkiconsole tool is also being deprecated, we encourage using the CLI.

10.1.1. Running self-tests from the console
Copiar o link

  1. Log into the Console. 

    # pkiconsole -d nssdb -n 'optional client cert nickname' https://server.example.com:admin_port/subsystem_type
    Copy to Clipboard Toggle word wrap
    Note

    pkiconsole is being deprecated and will be replaced by a new browser-based UI in a future major release. Although pkiconsole will continue to be available until the replacement UI is released, we encourage using the command line equivalent of pkiconsole at this time, as the pki CLI will continue to be supported and improved upon even when the new browser-based UI becomes available in the future.

  2. Select the subsystem name at the top of the left pane.

    self test
    View larger image
    self test
  3. Select the Self Tests tab.

  4. Click Run.

    The self-tests that are configured for the subsystem will run. If any critical self-tests fail, the server will stop.

  5. The On-Demand Self Tests Results window appears, showing the logged events for this run of the self-tests.

10.1.2. Running self-tests using the CLI
Copiar o link

The following command-line interfaces (CLIs) are available for self-tests for all subsystems. Where <subsystem> can be “ca”, “kra”, “ocsp”, “tks”, or “tps”

  • To view all the self-tests enabled for a subsystem: 

    # pki -d nssdb -n 'cert-nickname' -p subsystem_port <subsystem>-selftest-find
    Copy to Clipboard Toggle word wrap

    For example: 

    # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c <nssdb passwd> -n 'PKI OCSP Administrator for RSA-OCSP' -p 32443 ocsp-selftest-find

--------
3 entries matched
-----------------
  SelfTest ID: OCSPValidity
  Enabled at startup: false
  Enabled on demand: true
  Critical on demand: true

  SelfTest ID: OCSPPresence
  Enabled at startup: true
  Critical at startup: true
  Enabled on demand: true
  Critical on demand: true

  SelfTest ID: SystemCertsVerification
  Enabled at startup: true
  Critical at startup: true
  Enabled on demand: true
  Critical on demand: true
----------------------------
Number of entries returned 3
----------------------------
    Copy to Clipboard Toggle word wrap

  • To run on demand self-tests: 

    # pki -d nssdb -n ‘cert-nickname’ -p subsystem_port <subsystem>-selftest-run
    Copy to Clipboard Toggle word wrap

    For example: 

    # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c <nssdb passwd> -n 'PKI OCSP Administrator for RSA-OCSP' -p 32443 ocsp-selftest-run

  Selftest ID: OCSPPresence
  Status: PASSED
  Selftest ID: SystemCertsVerification
  Status: PASSED
  Selftest ID: OCSPValidity
  Status: PASSED
-------------------
Selftests completed
-------------------
    Copy to Clipboard Toggle word wrap

  • To show the details of a self-test: 

    # pki -d nssdb -n ‘cert-nickname’ -p subsystem_port <subsystem>-selftest-show
    Copy to Clipboard Toggle word wrap

    For example: 

    # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c <nssdb passwd> -n 'PKI OCSP Administrator for RSA-OCSP' -p 32443 ocsp-selftest-show OCSPPresence

-----------------------
SelfTest "OCSPPresence"
-----------------------
  SelfTest ID: OCSPPresence
  Enabled at startup: true
  Critical at startup: true
  Enabled on demand: true
  Critical on demand: true
    Copy to Clipboard Toggle word wrap

10.2. Debugging self-tests failures
Copiar o link

In the event of self-test failure, the Certificate System instance will stop completely and will not respond to any HTTP or HTTPS requests.

To diagnose a manually run self-test failure, refer to the various logs described in Section 10.2.1, “Self-Test logging”. Often other logs are useful as well, including debug logs. For more information on subsystem logs, refer to Chapter 12, Configuring subsystem logs. For more information on debug logs, refer to 2.3.14 Logs section under Chapter 2 Certificate System Architecture Overview in the Planning, Installation and Deployment Guide (Common Criteria Edition).

Common causes of self-test failures are services (such as LDAP) are down or unreachable, certificates are expired, or the system configuration is wrong. A precise cause of self-test failure is given in the logs.

After the cause of the self-test failure is identified and fixed, please restart the Certificate System server to resume normal operations: 

# systemctl restart pki-tomcatd-nuxwdog@instance_name.service
Copy to Clipboard Toggle word wrap

10.2.1. Self-Test logging
Copiar o link

A separate log, selftests.log, is added to the log directory that contains reports for both the start up self-tests and the on-demand self-tests. This log is configured by changing the setting for the log in the CS.cfg file. See the Modifying Self-Test Configuration in the Planning, Installation and Deployment Guide (Common Criteria Edition) for details.

Voltar ao topo
Red Hat logoGithubredditYoutubeTwitter

Aprender

Experimente, compre e venda

Comunidades

Sobre a documentação da Red Hat

Ajudamos os usuários da Red Hat a inovar e atingir seus objetivos com nossos produtos e serviços com conteúdo em que podem confiar. Explore nossas atualizações recentes.

Tornando o open source mais inclusivo

A Red Hat está comprometida em substituir a linguagem problemática em nosso código, documentação e propriedades da web. Para mais detalhes veja o Blog da Red Hat.

Sobre a Red Hat

Fornecemos soluções robustas que facilitam o trabalho das empresas em plataformas e ambientes, desde o data center principal até a borda da rede.

Theme

© 2025 Red Hat