Debugs all the components of the Validation Authority deployment.
evactl check all [-c <tls_ca_path>] [-i <cert_id>] [-l <level>] [-p <pin>] [-v <vendor>] [-t <token>]For example:
$ sudo evactl check allStarting PKCS #11 Manager... Done===============================================CHECKING HSM=============================================== Slot Id -> 0 Label -> pking203 Serial Number -> 1433959427612 Model -> LunaSA 7.2.0 Firmware Version -> 7.0.3 Configuration -> Luna User Partition With SO (PED) Signing With Cloning Mode Slot Description -> Net Token Slot FM HW Status -> FM Ready Slot Id -> 1 Label -> pking202 Serial Number -> 1433964084224 Model -> LunaSA 7.2.0 Firmware Version -> 7.0.3 Configuration -> Luna User Partition With SO (PED) Signing With Cloning Mode Slot Description -> Net Token Slot FM HW Status -> FM Ready Current Slot Id: 0Passing HSM checks... Done===============================================CHECKING DB===============================================Starting Configurator... DoneChecking DB user privileges... DoneChecking DB tables... Done===============================================CHECKING CAGW===============================================CAID: intminions~subordinate Checking CAGW is reachable... Done Checking configured CA... Done===============================================Tests passed successfullySee below for a description of each parameter.
-c <tls_ca_path>
Validate the TLS server certificate of CA Gateway with <tls_ca_path>. Where <tls_ca_path> is the path of a CA file in PEM format.
Mandatory: No. When omitting this option, the command uses the CA configured in CSP CA Gateway.
-i <cert_id>
Authenticate in CA Gateway with the <cert_id> certificate, where <cert_id> is the identifier of the certificate described in CA Gateway for Validation Authority.
Mandatory: No. This optional parameter defaults to the latest client certificate imported with the evactl import-p12 command.
Run the evactl list-certs command to list the available certificates and the latest one imported.
-l <level>
Debug the nShield HSM with the <level> level, where <level> is a CKNFAST_DEBUG variable level. When not using a nShield HSM, the command ignores this option.
See the nShield documentation for details on the CKNFAST_DEBUG configuration parameter.
Mandatory: No. This optional parameter defaults to 0.
-p <pin>
Authenticate in the HSM with the <pin> PIN.
Mandatory: No. When omitting this option, the command looks for the PIN in the application secrets. If not found, prompts the user for the PIN.
-v <vendor>
Use the <vendor> security module. See the following table for the supported values.
Vendor | Security module |
|---|---|
none | Built-in software PKCS #11 module. |
nshield | nShield HSM. See HSM requirements for the supported models. |
thales | Thales HSM. See HSM requirements for the supported models. |
It is recommended to select a Hardware Security Module (HSM).
Mandatory: No. When omitting this option, the command assumes the value of the Vendor configuration parameter.
The command will raise an error if you omit this option and the configuration is not loaded.
-t <token>
Select the HSM token with the <token> label.
Mandatory: No. When omitting this option, the command uses the value of the Token label configuration parameter.
The command will raise an error if you omit this option and the configuration is not loaded.