See below for a reference of hicli commands
Command | Description |
|---|---|
hicli domain detail | Display information about a domain |
hicli domain list | Display all domains |
hicli domain select | Select a domain |
hicli domain set allow_reconnect | Display information about a domain |
hicli domain set description | Give the domain a new description |
hicli domain set hide_passphrase | Don't display the passphrase when adding a new node |
hicli domain set require_passphrase | Require a passphrase when adding a new node |
hicli generate_csr | Generates a CSR (Certificate Signing Request) that you can send to a CA (Certificate Authority) to generate a custom certificate. |
hicli mapping list | Displays the Cluster Node Mappings configured in the domain. |
hicli mapping new | Creates a new Node Mapping. |
hicli mapping detail | Displays details about the specified Node Mapping. |
hicli mapping rm | Removes the specified Node Mapping. |
hicli mapping select | Sets the Node Mapping to which future commands will be applied. |
hicli mapping set description | Sets the Node Mapping description. |
hicli mapping set group | Sets the Administration Group with which this mapping will be associated. |
hicli mapping set servers | Sets the IP addresses of the Cryptographic Security Platform Vault nodes in this Node Mapping. |
hicli mapping set newname | Changes the Node Mapping name. |
hicli server auth | Displays information about a domain. |
hicli server default_csr_values | Displays the default CSR values for the named server. |
hicli server detail | Displays detailed information about a server. |
hicli server install_cert | Installs a custom certificate on the server. |
hicli server install_cert_status | Displays information about the status of the certificate installation process. |
hicli server show_cert | Shows the current server certificate. |
hicli server use_default_certs | Tells Cryptographic Security Platform Vault to ignore any custom certificates and to return to using the default, self-signed Cryptographic Security Platform Vault certificate. |
hicli server webserver_restart | Restarts the web server on the Cryptographic Security Platform Vault node. This is required after you install a new custom certificate. |
See below for command line samples.
Cryptographic Security Platform Vault node examples
The following sample command line shows the name of the Cryptographic Security Platform Vault domain.
$hicli domain listDomain Admin Group Servers Status--------------------------------------------------------------------------KeyControl Domain KeyControl Admin Group 1 HealthyThe following command line gets details about the Cryptographic Security Platform Vault domain.
$ hicli domain detail "KeyControl Domain"Name KeyControl DomainStatus HealthyGroup KeyControl Admin GroupDescription Domain of Clustered KeyControl ServersAllow reconnect YesPassphrase required YesPassphrase hidden NoCheck hardware id YesServer Count 2Server Names kc1.hytrust.com,kc2.hytrust.comThe following command line sets Cryptographic Security Platform Vault domain attributes.
$ hicli domain set "KeyControl Domain" --description="New description" --allow_reconnect=yes --require_passphrase=yes --hide_passphrase=noThe following command line selects the domain on which to perform server operations
$ hicli domain select "KeyControl Domain"The following command line shows the selected Cryptographic Security Platform Vault domain.
$ hicli domainKeyControl DomainThe following command line shows Cryptographic Security Platform Vault server details.
$ hicli server detail kc1.hytrust.comName kc1.hytrust.comStatus OnlineIP Address 192.168.140.151Authenticated YesThe following command line authenticates the Cryptographic Security Platform Vault server
$ hicli server auth kc1.hytrust.comCluster node mapping examples
The following command line lists the cluster node mappings already defined in the domain.
$ hicli mapping listKeyControl Mapping Name Admin Group Description--------------------------------------------------------------------------------kc-west-coast-mapping Cloud Admin Group KC servers on the west coast The following command line creates a new cluster node mapping.
$ hicli mapping new kc-east-coast-mapping "Cloud Admin Group" "kc1:192.168.13.124:443,kc2:192.168.12.157:443" --description="KC servers on the east coast"The following command line verifies that the new node mapping was created.
$ hicli mapping listKeyControl Mapping Name Admin Group Description--------------------------------------------------------------------------------kc-east-coast-mapping Cloud Admin Group KC servers on the east coastkc-west-coast-mapping Cloud Admin Group KC servers on the west coast The following command line gets the details for a Cluster Node Mapping.
$ hicli mapping detail kc-east-coast-mapping Name | kc-east-coast-mappingAdmin Group | Cloud Admin GroupDescription | KC servers on the east coastservers | "kc1:192.168.13.124:443:0.0.0.0:1,kc2:192.168.12.157:443:0.0.0.0:1" The following command line changes the servers in a node mapping.
The list you specify overwrites the existing list, so to add a server to the existing list, you must specify all servers already in the list as well as the one you want to add.
$ hicli mapping set kc-east-coast-mapping --servers "kc1:192.168.13.124:443,kc2:192.168.12.157:443,kc3:192.168.11.162:443"The following command lines select and show a node mapping.
$ hicli mapping select kc-east-coast-mapping $ hicli mappingCurrent KeyControl Mapping: kc-east-coast-mappingThe following command lines delete a node mapping and try to select it to make sure it has been removed
$ hicli mapping rm kc-east-coast-mapping$ hicli mapping select kc-east-coast-mappingKeyControl Mapping not found: kc-east-coast-mappingCryptographic Security Platform Vault certificate examples
The following command line generates a CSR (Certificate Signing Request).
$ hicli generate_csr --common_name=kc1.hytrust.com --country=US --days=180 --state=California --locality="San Francisco" --org=HyTurst --org_unit=Engineering --sans="kc2.hytrust.com,kc3.hytrust.com,kc4.hytrust.com"The following command line shows the text of a certificate.
$ hicli server show_cert mycert.pemThe following command lines install a certificate on the Cryptographic Security Platform Vault node and restart the webserver on the node.
If the certificate was generated using the CSR created by the hicli generate_csr command, you do not need to specify a private key file or password.
$ hicli server install_cert kc1.hytrust.com --cert_file=mycert.pem --cacert=mycacert.pem$ hicli server webserver_restart kc1.hytrust.comThe following command lines install a certificate generated using a CSR command, specify the private key file, and restart the webserver.
$ hicli server install_cert kc2.hytrust.com --cert_file=my-other-cert.pem --private_key=key.pem --password=<password> --cacert=my-other-cacert.pem $ hicli server webserver_restart kc1.hytrust.comThe following command line returns to using the default, self-signed Cryptographic Security Platform Vault certificate.
$ hicli server use_default_certs kc1.hytrust.com