Nice Parameters

auth.use_revocation_id

Boolean, assign a monotonic sequence id to each revocation request and use it to issue CRLs. This is required for synchronisation when using RA/CA split and enables reproducible CRL builds.

issueCertificate

Issues a certitficate, will autodetect the most current ca for the requested profile. Issuer can be enforced by passing the issuer alias as second parameter, the certificates validity will be tailored to fit into the CA validity window.

Takes only the key information from the pkcs10 and requires subject, SAN and validity to be given as context parameters.

renewCertificate

Currently only an alias for issueCertificate

revokeCertificate

Set the status field of the certificate table to "CRL_ISSUANCE_PENDING". If use_revocation_id is on, also sets the revocation_id to the next available serial. In case two revocations are processed at the same time the query will either wait for a database lock or the transaction will fail on commit depending on your database isolation level.

checkForRevocation

Queries the certifictes status from the local certificate datasbase. Returns 0 if the certificate is not revoked, for revoked certificates returns the value of revocation_id or 1 if use_revocation_id is off.

issueCRL

Creates a crl for the given ca and pushes it into the database for publication. Incremental CRLs are not supported.

The first parameter must be the ca-alias, the second parameter is as hash with options:

crl_profile (optional)

the profile definition to use

crl_validity

OpenXPKI::DateTime relative date, overrides the profile validity.

delta_crl

not supported yet.

reason_code

List of reason codes to be included in the CRL (CRL Scope), default is to include all reason codes.

remove_expired

Boolean, if set, only certifcates with a notafter greater than now are included in the CRL, by default the CRL also lists expired certificates.

generateKey

See OpenXPKI::Server::NICE::Role::KeyGenerationLocal

fetchKey

See OpenXPKI::Server::NICE::Role::KeyInDataPool

testConnection

not implemented. returns undef.