hicli Command

Description

kmipsrv_obj fetch

Retrieves a list of objects stored on the KMIP server. You can specify the following properties:

  • --uuid=<object uuid>—The UUID of the KMIP server object. If this parameter is not specified, the command returns a list of the KMIP objects on the server.
  • --noattr—Only include the object UUIDs in the returned list. If this parameter is not specified, this command returns the full details about each KMIP object. hicli ignores this option if you specify a UUID.
  • --count=<list size>—The number of KMIP objects to retrieve.
  • --offset=<offset>—The index of the first object to retrieve in the list. If you specify 0 (zero) for this parameter, the command starts at the top of the list.
  • --total_count—Include the total number of objects stored on the KMIP server in the response.

kmipsrv_obj action uuid

Performs one or more of the following actions on the KMIP server object whose UUID is specified in the command.

  • --operation=<activate|archive|destroy|recover|revoke>—The action to perform on the KMIP object.
  • --revcode=<revoke reason code>—If you are revoking the object, this is the standard KMIP reason code.
  • --revmsg=<revoke message>—If you are revoking the object, this is a user-defined string specifying the reason why you are revoking the object.
  • --desc=<description>—Sets the user-defined description for the object.

Getting a List of KMIP Objects

The following command gets the total number of KMIP objects stored on the server:

$ hicli kmipsrv_obj fetch --total_count
Total number of KMIP objects: 10

The following command retrieves the details for the first 4 objects:

$ hicli kmipsrv_obj fetch --count=4 --offset=0
Object UUID                           Type          State       Initial Date                  Last Change                   Identification   Description
-----------                           ----          -----       ------------                  -----------                   --------------   -----------
bec40e89-e2c9-11e8-9997-000c299ae5eb  PublicKey     PreActive   2018-11-07T20:14:35+00:00     2018-11-07T20:14:35+00:00     []               None
bec39ac3-e2c9-11e8-9997-000c299ae5eb  PrivateKey    PreActive   2018-11-07T20:14:35+00:00     2018-11-07T20:14:35+00:00     []               None
997dd60b-e2c9-11e8-9997-000c299ae5eb  PublicKey     PreActive   2018-11-07T20:13:32+00:00     2018-11-07T20:13:32+00:00     []               None
996b5f4c-e2c9-11e8-9997-000c299ae5eb  PrivateKey    PreActive   2018-11-07T20:13:32+00:00     2018-11-07T20:13:32+00:00     []               None

The following command gets only the UUIDs for the first four KMIP objects:

$ hicli kmipsrv_obj fetch --count=4 --offset=0 --noattr
bec40e89-e2c9-11e8-9997-000c299ae5eb
bec39ac3-e2c9-11e8-9997-000c299ae5eb
997dd60b-e2c9-11e8-9997-000c299ae5eb
996b5f4c-e2c9-11e8-9997-000c299ae5eb

The following command gets a specific KMIP object. Note that even though the --noattr option is specified, it is ignored by hicli.

$ hicli kmipsrv_obj fetch --uuid=997dd60b-e2c9-11e8-9997-000c299ae5eb --noattr
CryptographicUsageMask   :   Encrypt Verify
InitialDate              :   2018-11-07T20:13:32+00:00
State                    :   PreActive
CryptographicAlgorithm   :   RSA
LastChangeDate           :   2018-11-07T20:13:32+00:00
CryptographicLength      :   4096
ObjectType               :   PublicKey

Managing KMIP Objects

You can use the following command to manage any KMIP object on the server using that object's UUID:

hicli kmipsrv_obj action <uuid> [--operation=<activate|archive|destroy|recover|revoke>]
[--revcode=<revoke_code>] [--revmsg=<revoke_message>] [--desc=<description>]

You can perform the following operations on a KMIP server object:

  • activate—By default, objects are created in PreActive state. Specify activate to enable more transitions for the object. Note: Many KMIP clients change objects to Active state as part of the creation process.
  • archive—Objects will no longer return keys but they remain in the system. You can use the recover operation to return an archived object to active state and retrieve its keys.
  • destroy—This operation permanently removes the object. Destroyed objects cannot be retrieved.
  • recover—Restores an Archived object to the active state so that its keys can be retrieved.

  • revoke—Revocation is permanent. Objects that are revoked cannot be moved back to Active, but the client can still retrieve any key material. You can also specify a revocation reason, which can be any string, and a numeric Reason Code, which is one of the following KMIP standard codes. If you omit the reason code or use a non-standard code, it will be considered the same as "1—Unspecified."

    1—Unspecified
    2—Key Compromise
    3—CA Compromise
    4—Affiliation Changed
    5—Superseded
    6—Cessation of Operation
    7—Privilege Withdrawn

The following command activates a KMIP object:

$ hicli kmipsrv_obj action cd9e4370-e2cb-11e8-bdab-00505685b461 --operation=activate
success

The following commands archive and then restore a KMIP object, fetching the details after each action to make sure the state was correctly changed. After you restore an object, the ArchiveDate is retained, but the Archived flag is no longer set.

$ hicli kmipsrv_obj action cd9e4370-e2cb-11e8-bdab-00505685b461 --operation=archive
success
$ hicli kmipsrv_obj fetch uuid=cd9e4370-e2cb-11e8-bdab-00505685b461
Archived                 :   1
CryptographicUsageMask   :   Decrypt Sign
InitialDate              :   2018-11-07T20:29:19+00:00
State                    :   Active
ActivationDate           :   2018-11-09T20:22:18+00:00
ArchiveDate              :   2018-11-09T20:27:05+00:00
CryptographicAlgorithm   :   RSA
LastChangeDate           :   2018-11-09T20:27:05+00:00
CryptographicLength      :   4096
ObjectType               :   PrivateKey
$ hicli kmipsrv_obj action cd9e4370-e2cb-11e8-bdab-00505685b461 --operation=restore
success
$ hicli kmipsrv_obj fetch uuid=cd9e4370-e2cb-11e8-bdab-00505685b461
CryptographicUsageMask   :   Decrypt Sign
InitialDate              :   2018-11-07T20:29:19+00:00
State                    :   Active
ActivationDate           :   2018-11-09T20:22:18+00:00
ArchiveDate              :   2018-11-09T20:27:05+00:00
CryptographicAlgorithm   :   RSA
LastChangeDate           :   2018-11-09T20:27:05+00:00
CryptographicLength      :   4096
ObjectType               :   PrivateKey

The following command revokes a KMIP object for the revocation reason "This key has been replaced with a new key":

$ hicli kmipsrv_obj action cd9e4370-e2cb-11e8-bdab-00505685b461 --operation=revoke --revcode=5 
--revmsg='This key has been replaced with a new key'
success
$ hicli kmipsrv_obj fetch uuid=cd9e4370-e2cb-11e8-bdab-00505685b461
ActivationDate           :   2018-11-09T20:22:18+00:00
RevocationReasonCode     :   Superceded
CryptographicUsageMask   :   Decrypt Sign
InitialDate              :   2018-11-07T20:29:19+00:00
DeactivationDate         :   2018-11-09T20:31:24+00:00
RevocationMessage        :   This key has been replaced with a new key
State                    :   Deactivated
CryptographicAlgorithm   :   RSA
LastChangeDate           :   2018-11-09T20:31:24+00:00
CryptographicLength      :   4096
ObjectType               :   PrivateKey