sysconf regencert
Generate or regenerate the Luna Network HSMserver certificate used for NTLS and save it to the appliance file system. Include the -csr option if you plan to have the resulting certificate signed by a Certificate Authority (CA).
This command stores the resulting private and public keys on the file system (hard disk) inside the Luna appliance.
User Privileges
Users with the following privileges can perform this command:
>Admin
Syntax
sysconf regencert [<IPaddress>] [-csr] [-startdate <startdate>] [-days <days>] [-country <country>] [-state <state>] [-location <location>] [-organization <organization>] [-orgunit <unit>] [-email <email_address>] [-san <SAN>] [-force]
| Argument(s) | Shortcut | Description |
|---|---|---|
| <IPaddress> |
Specifies the IP address to set as the CN of the server's NTLS certificate. If not specified, the CN will be the hostname of the Luna Network HSM appliance, as specified by the network hostname command. See network hostname for more information. |
|
| -country <country> | -co | The country where the client computer resides. |
| -csr | -cs |
Create a Certificate Signing Request (CSR), a private key and unsigned client certificate. The certificate must be signed by a third party before being used to authenticate the Luna Network HSM. NOTE This feature requires appliance software version 7.7.0 or newer. See Version Dependencies by Feature for more information.
|
| -days <days> | -d |
Specifies the number of days for which the new certificate will remain valid, starting on <startdate>. Range: 1-3653 Default: 3653 (10 years) |
| -email <email_address> | -e | An email address to contact the certificate creator. |
| -force | -f | Force the action without prompting. |
| -location <location> | -l | The locality where the client computer resides. |
| -organization <organization> | -orga | The name of the organization that owns the client computer. |
| -orgunit <unit> | -orgu | The business unit or department that owns the client computer. |
| -san <SAN> | -sa |
Subject Alternate Names (SAN) for this appliance. This field must be set if clients intend to use IP/hostname verification. Specify a list of comma-separated IPs and domains associated with the appliance. Example: -san IP:1.2.3.4,DNS:abc.com,... |
| -startdate <startdate> | -s | Specifies the starting date upon which the certificate becomes valid, in the format YYYYMMDD. The default is 24 hours ago, to eliminate possible time zone mismatch issues if you need the certificate to be valid immediately anywhere in the world. |
| -state <state> | -stat | The state where the client computer resides. |
Example
lunash:>sysconf regencert
WARNING !! This command will overwrite the current server certificate and private key.
All clients will have to add this server again with this new certificate.
If you are sure that you wish to proceed, then type 'proceed', otherwise type 'quit'
> proceed
Proceeding...
'sysconf regenCert' successful. The NTLS, STC and CBS services must be (re)started before clients can connect.
Please use the 'ntls show' command to ensure that NTLS is bound to an appropriate network device or IP address/hostname
for the network device(s) NTLS should be active on. Use 'ntls bind' to change this binding if necessary.
Command Result : 0 (Success)
