| Description |
|---|---|
| Display information about a domain |
| Display all domains |
| Select a domain |
| Display information about a domain |
| Give the domain a new description |
| Don't display the passphrase when adding a new node |
| Require a passphrase when adding a new node |
| Generates a CSR (Certificate Signing Request) that you can send to a CA (Certificate Authority) to generate a custom certificate. |
| Displays the Cluster Node Mappings configured in the domain. |
| Creates a new Node Mapping. |
| Displays details about the specified Node Mapping. |
| Removes the specified Node Mapping. |
| Sets the Node Mapping to which future commands will be applied. |
| Sets the Node Mapping description. |
| Sets the Administration Group with which this mapping will be associated. |
| Sets the IP addresses of the Cryptographic Security Platform Vault nodes in this Node Mapping. |
| Changes the Node Mapping name. |
| Display information about a domain. |
| Displays the default CSR values for the named server. |
| Display detailed information about a server. |
| Installs a custom certificate on the server. |
| Displays information about the status of the certificate installation process. |
| Shows the current server certificate. |
| Tells Cryptographic Security Platform Vault to ignore any custom certificates and to return to using the default, self-signed Cryptographic Security Platform Vault certificate. |
| Restarts the web server on the Cryptographic Security Platform Vault node. This is required after you install a new custom certificate. |
Cryptographic Security Platform Vault Node Examples
The domain list command shows the name of the Cryptographic Security Platform Vault domain:
$hicli domain list Domain Admin Group Servers Status -------------------------------------------------------------------------- KeyControl Domain KeyControl Admin Group 1 Healthy
And now get details about the Cryptographic Security Platform Vault domain:
$ hicli domain detail "KeyControl Domain" Name KeyControl Domain Status Healthy Group KeyControl Admin Group Description Domain of Clustered KeyControl Servers Allow reconnect Yes Passphrase required Yes Passphrase hidden No Check hardware id Yes Server Count 2 Server Names kc1.hytrust.com,kc2.hytrust.com
To set Cryptographic Security Platform Vault domain attributes:
$ hicli domain set "KeyControl Domain" --description="New description" \
--allow_reconnect=yes --require_passphrase=yes \
--hide_passphrase=noFor Cryptographic Security Platform Vault server operations we need to select the domain first:
$ hicli domain select "KeyControl Domain"
To show the Cryptographic Security Platform Vault domain is selected:
$ hicli domain KeyControl Domain
Get Cryptographic Security Platform Vault server details:
$ hicli server detail kc1.hytrust.com Name kc1.hytrust.com Status Online IP Address 192.168.140.151 Authenticated Yes
Authenticate the Cryptographic Security Platform Vault server:
$ hicli server auth kc1.hytrust.com
Cluster Node Mapping Examples
List the Cluster Node Mappings already defined in the domain:
$ hicli mapping list KeyControl Mapping Name Admin Group Description -------------------------------------------------------------------------------- kc-west-coast-mapping Cloud Admin Group KC servers on the west coast
Create a new Cluster Node Mapping:
$ hicli mapping new kc-east-coast-mapping "Cloud Admin Group" "kc1:192.168.13.124:443,kc2:192.168.12.157:443" --description="KC servers on the east coast"
Verify that the new Node Mapping was created:
$ hicli mapping list KeyControl Mapping Name Admin Group Description -------------------------------------------------------------------------------- kc-east-coast-mapping Cloud Admin Group KC servers on the east coast kc-west-coast-mapping Cloud Admin Group KC servers on the west coast
Get the details for a Cluster Node Mapping:
$ hicli mapping detail kc-east-coast-mapping Name | kc-east-coast-mapping Admin Group | Cloud Admin Group Description | KC servers on the east coast servers | "kc1:192.168.13.124:443:0.0.0.0:1,kc2:192.168.12.157:443:0.0.0.0:1"
Change the servers in the Node Mapping. Note that the list you specify overwrites the existing list, so if you want to add a server to the existing list, you must specify all servers that are already in the list as well as the one you want to add.
$ hicli mapping set kc-east-coast-mapping --servers "kc1:192.168.13.124:443,kc2:192.168.12.157:443,kc3:192.168.11.162:443"
Select and the view the selected Node Mapping:
$ hicli mapping select kc-east-coast-mapping $ hicli mapping Current KeyControl Mapping: kc-east-coast-mapping
Delete a Node Mapping, then select the mapping to make sure it has been removed:
$ hicli mapping rm kc-east-coast-mapping $ hicli mapping select kc-east-coast-mapping KeyControl Mapping not found: kc-east-coast-mapping
Cryptographic Security Platform Vault Certificate Examples
Generate a CSR (Certificate Signing Request):
$ hicli generate_csr --common_name=kc1.hytrust.com --country=US --days=180 --state=California --locality="San Francisco" --org=HyTurst --org_unit=Engineering --sans="kc2.hytrust.com,kc3.hytrust.com,kc4.hytrust.com"
Show the text of the certificate named mycert.pem:
$ hicli server show_cert mycert.pem
Install the custom certificate mycert.pem on the Cryptographic Security Platform Vault node kc1.hytrust.com. After you install the certificate you must restart the webserver on the node.
Note: If the certificate was generated using the CSR created by the hicli generate_csr command, you do not need to specify a private key file or password.
$ hicli server install_cert kc1.hytrust.com --cert_file=mycert.pem --cacert=mycacert.pem $ hicli server webserver_restart kc1.hytrust.com
Install a custom certificate my-other-cert.pem on the Cryptographic Security Platform Vault node kc2.hytrust.com. This certificate was generated using a custom CSR command, so you must also specify the private key file and password (if required).
$ hicli server install_cert kc2.hytrust.com --cert_file=my-other-cert.pem --private_key=key.pem
--password=DogDays123! --cacert=my-other-cacert.pem $ hicli server webserver_restart kc1.hytrust.com
Return to using the default, self-signed Cryptographic Security Platform Vault certificate:
$ hicli server use_default_certs kc1.hytrust.com