$ pki <command>

$ pki ca-cert-find

To authenticate with username and password:

The following additional new options are available in PKI 10.2.x:

Use of the -W (uppercase W) option is preferred for batch deployments as greater safeguards may be placed upon a file (e.g. system permissions, system ACLs, SELinux, etc.) rather than the -w (lowercase w) option of a simple plaintext designation which may be seen in shell history when invoked directly from the command-line, are far more likely to show up accidentally in cut/pastes of command-lines, and inside shell scripts which are seldom safeguarded from being world readable.

Prompt for password which is preferred for individual command-line invocations as it masks the actual password from being displayed, but is generally not suitable for batch-oriented deployments.

In PKI 10.0 or later the authentication can be done as follows:

The default certificate database directory is $HOME/.pki/nssdb.

In PKI 10.1 or later the authentication can be done as follows:

The NSS database password now should be specified with a -c parameter. This option should only be used in a test environment where plain-text password visible in shell history or in shell scripts would not cause a security problem.

In PKI 10.2 or later the authentication can be done as follows:

The first option is identical to the option available in the previous version.

The second option using -C parameter can be used to provide the NSS database password via a file. This option might be preferrable for batch execution as greater safeguards may be placed upon a file (e.g. system permissions, system ACLs, SELinux).

In PKI 10.4.1 or later the authentication can be done as follows:

The first and second options are identical to the options available in the previous version.

The third option without any password parameter can be used if there is no NSS database, or if the NSS database is not protected with a password. If the NSS database has a password the CLI will prompt for the password on the console. This option might be preferred for manual execution.

In PKI 10.6.0 or later the authentication can be done as follows:

The first, second, and the third options are identical to the options available in the previous version.

The fourth option with -f provides a way to specify multiple passwords for NSS database that has multiple tokens. The passwords can be specified in a configuration file. The internal token password should be specified as follows:

HSM password should be specified as follows:

Anything else will be ignored.

This option can be used to access PKI server’s NSS database: