mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-08-30 11:49:41 +02:00
Koen van HoveandGitHub
0ccc5cdff4
This PR adds API access via a local Unix socket on Unix systems allowing to use the username of local user accessing the API as the authentication username. Configuration options are provided to map user names to roles similar to the configfile authentication provider. This will allow using Krill without authentication tokens if it is only accessed via krillc on the same machine. The PR also removes the example configuration files and moves the documentation included in those files into a krill.conf.5 manual page. By doing this, it simplifies the creation of the configuation file in the binary packages. Those are now very minimal and only contain the mandatory config options.
2640 lines
102 KiB
ReStructuredText
2640 lines
102 KiB
ReStructuredText
.. _doc_krill_cli:
|
|
.. highlight:: none
|
|
|
|
Using the CLI or API
|
|
====================
|
|
|
|
Introduction
|
|
------------
|
|
|
|
Every function of Krill can be controlled from the command line interface (CLI).
|
|
The Krill CLI is a wrapper around the API which is based on JSON over HTTPS.
|
|
|
|
We will document all current functions below, providing examples of both the
|
|
CLI and API.
|
|
|
|
Note that you can use the CLI from another machine, but then you will need to
|
|
set up a proxy server in front of Krill and make sure that it has a real TLS
|
|
certificate.
|
|
|
|
To use the CLI you need to invoke :command:`krillc` followed by one or more
|
|
subcommands, and some arguments. Help is built-in:
|
|
|
|
.. code-block:: text
|
|
|
|
USAGE:
|
|
krillc <subcommand..> [FLAGS] [OPTIONS]
|
|
|
|
FLAGS:
|
|
--api Only show the API call and exit. Or set env: KRILL_CLI_API=1
|
|
-h, --help Prints help information
|
|
-V, --version Prints version information
|
|
|
|
OPTIONS:
|
|
-c, --ca <name> The name of the CA you wish to control. Or set env: KRILL_CLI_MY_CA
|
|
-f, --format <type> Report format: none|json|text (default). Or set env: KRILL_CLI_FORMAT
|
|
-s, --server <URI> The full URI to the krill server. Or set env: KRILL_CLI_SERVER
|
|
-t, --token <string> The secret token for the krill server. Or set env: KRILL_CLI_TOKEN
|
|
|
|
|
|
Setting Defaults
|
|
----------------
|
|
|
|
As noted in the OPTIONS help text above you can set default values via
|
|
environment variables for the most common arguments that need to be supplied to
|
|
``krillc`` subcommands. When setting environment variables note the following
|
|
requirements:
|
|
|
|
- ``KRILL_CLI_SERVER`` must be in the form ``https://<host:port>/``.
|
|
- ``KRILL_CLI_MY_CA`` must consist only of alphanumeric characters, dashes and
|
|
underscores, i.e. ``a-zA-Z0-9_``.
|
|
|
|
For example:
|
|
|
|
.. code-block:: bash
|
|
|
|
export KRILL_CLI_TOKEN="correct-horse-battery-staple"
|
|
export KRILL_CLI_MY_CA="Acme-Corp-Intl"
|
|
|
|
If you do use the command line argument equivalents, you will override whatever
|
|
value you set in the ENV. Krill will give you a friendly error message if you
|
|
did not set the applicable ENV variable, and don't include the command line
|
|
argument equivalent.
|
|
|
|
Explore the API
|
|
----------------
|
|
|
|
The reference below documents the available ``krillc`` subcommands and the
|
|
equivalent API functions by example.
|
|
|
|
You can also explore the CLI and API yourself:
|
|
|
|
- Each subcommand can be prefixed with ``help`` to access the CLI built-in help
|
|
- You can always use ``--api`` argument to make the CLI print out the API
|
|
call that it would do, without actually sending it to the server.
|
|
- You can use ``--format=json`` to have the API print out the JSON returned by
|
|
the server without reformatting or filtering information. Of course, be
|
|
careful if you use this option for subcommands with side-effects, such as
|
|
``krillc delete --ca <ca>``
|
|
|
|
If you want a to have a safe sandbox environment to test your Krill CA and
|
|
really explore the API, then we recommend that you set up a local Krill testbed
|
|
as described in :ref:`doc_krill_testbed`.
|
|
|
|
*Tip*: Click subcommand names in this section to jump to its detailed description.
|
|
|
|
Subcommands for managing your Krill server:
|
|
|
|
.. parsed-literal::
|
|
|
|
:ref:`config<cmd_krillc_config>` Creates a configuration file for krill and prints it to STDOUT
|
|
:ref:`health<cmd_krillc_health>` Perform an authenticated health check
|
|
:ref:`info<cmd_krillc_info>` Show server info
|
|
|
|
Subcommands for adding / removing CA instances in your Krill server:
|
|
|
|
.. parsed-literal::
|
|
|
|
:ref:`add<cmd_krillc_add>` Add a new CA
|
|
:ref:`delete<cmd_krillc_delete>` Delete a CA and let it withdraw its objects and request revocation. WARNING: Irreversible!
|
|
:ref:`list<cmd_krillc_list>` List the current CAs
|
|
|
|
|
|
Subcommands for initialising a CA:
|
|
|
|
.. parsed-literal::
|
|
|
|
:ref:`parents<cmd_krillc_parents>` Manage parents for a CA.
|
|
:ref:`repo<cmd_krillc_repo>` Manage the repository for a CA.
|
|
|
|
Subcommands for showing the details of a CA:
|
|
|
|
.. parsed-literal::
|
|
|
|
:ref:`show<cmd_krillc_show>` Show details of a CA.
|
|
:ref:`issues<cmd_krillc_issues>` Show issues for a CA
|
|
:ref:`history<cmd_krillc_history>` Show the history of a CA
|
|
|
|
|
|
Manage ROAs:
|
|
|
|
.. parsed-literal::
|
|
|
|
:ref:`roas<cmd_krillc_roas>` Manage ROAs for a CA.
|
|
|
|
Other operations:
|
|
|
|
.. parsed-literal::
|
|
|
|
:ref:`bulk<cmd_krillc_bulk>` Manually trigger refresh/republish/resync for all CAs
|
|
:ref:`children<cmd_krillc_children>` Manage children for a CA
|
|
:ref:`keyroll<cmd_krillc_keyroll>` Perform a manual key rollover for a CA
|
|
|
|
.. _cmd_krillc_config:
|
|
|
|
krillc config
|
|
-------------
|
|
|
|
This subcommand is implemented on the CLI only and is intended to help
|
|
generate a configuration file which can be used for your Krill server.
|
|
|
|
We currently support two subcommands for this: ``krillc config simple`` and
|
|
``krillc config user``. The first can be used to generate general server
|
|
configuration. The second can be used to generate user (``id``) entries to
|
|
use if you want to have multiple local users access the Krill UI by their own
|
|
name and password.
|
|
|
|
.. _cmd_krillc_health:
|
|
|
|
krillc health
|
|
-------------
|
|
|
|
Perform an authenticated health check. Verifies that the specified Krill server
|
|
can be connected to, is able to verify the specified token and is, at least thus
|
|
far, healthy. This does NOT check whether your CAs have any issues, please have
|
|
a look at the :ref:`issues<cmd_krillc_issues>` subcommand for this.
|
|
|
|
Can be used in automation scripts by checking the exit code:
|
|
|
|
+-----------+------------------------------------------------------------------+
|
|
| Exit Code | Meaning |
|
|
+===========+==================================================================+
|
|
| 0 | the Krill server appears to be healthy. |
|
|
+-----------+------------------------------------------------------------------+
|
|
| non-zero | incorrect server URI, token, connection failure or server error. |
|
|
+-----------+------------------------------------------------------------------+
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ krillc health
|
|
$ echo $?
|
|
0
|
|
|
|
Example API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc health --api
|
|
GET:
|
|
https://localhost:3000/api/v1/authorized
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
If you need to do an unauthorized health check, then you can just call the following
|
|
endpoint instead. This will always return a 200 OK response if the server is running:
|
|
|
|
.. code-block:: text
|
|
|
|
GET:
|
|
https://localhost:3000/health
|
|
|
|
....
|
|
|
|
.. _cmd_krillc_info:
|
|
|
|
krillc info
|
|
-----------
|
|
|
|
Show server info. Prints the version of the Krill *server* and the date and time
|
|
that it was last started, e.g.:
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc info
|
|
Version: 0.9.0
|
|
Started: 2021-04-07T12:36:00+00:00
|
|
|
|
Example API call:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc info --api
|
|
GET:
|
|
https://localhost:3000/stats/info
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
|
|
Example API resonse:
|
|
|
|
.. code-block:: json
|
|
|
|
{
|
|
"version": "0.9.0",
|
|
"started": 1617798960
|
|
}
|
|
|
|
|
|
....
|
|
|
|
.. _cmd_krillc_add:
|
|
|
|
krillc add
|
|
----------
|
|
|
|
Adds a new CA.
|
|
|
|
When adding a CA you need to choose a handle, essentially just a name. The term
|
|
"handle" comes from :RFC:`8183` and is used in the communication protocol
|
|
between parent and child CAs, as well as CAs and publication servers. The handle
|
|
may consist of alphanumeric characters, dashes and underscores, i.e. ``a-zA-Z0-9_``.
|
|
|
|
The handle you select is not published in the RPKI but used as identification to
|
|
parent and child CAs you interact with. You should choose a handle that helps
|
|
others recognise your organisation. Once set, the handle cannot be be changed
|
|
as it would interfere with the communication between parent and child CAs, as
|
|
well as the publication repository.
|
|
|
|
When a CA has been added, it is registered to publish locally in the Krill
|
|
instance where it exists, but other than that it has no configuration yet. In
|
|
order to do anything useful with a CA you will first have to add at least one
|
|
parent to it, followed by some Route Origin Authorisations and/or child CAs.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc add --ca newca
|
|
|
|
|
|
Example API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc add --ca newca --api
|
|
POST:
|
|
https://localhost:3000/api/v1/cas
|
|
Headers:
|
|
content-type: application/json
|
|
Authorization: Bearer secret
|
|
Body:
|
|
{
|
|
"handle": "newca"
|
|
}
|
|
|
|
The API response is an empty 200 OK response, unless an issue occurred - e.g.
|
|
the handle was already in use:
|
|
|
|
.. code-block:: json
|
|
|
|
{"label":"ca-duplicate","msg":"CA 'newca' was already initialised","args":{"ca":"newca"}}
|
|
|
|
|
|
....
|
|
|
|
.. _cmd_krillc_delete:
|
|
|
|
krillc delete
|
|
-------------
|
|
|
|
Deletes a CA in your Krill server. The CA will try (best effort) to request revocation of its
|
|
current certificates from its parents, and withdraw its objects from its repository.
|
|
|
|
.. Warning:: This action is irreversible!
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc delete --ca ca
|
|
|
|
Example API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc delete --ca ca --api
|
|
DELETE:
|
|
https://localhost:3000/api/v1/cas/ca
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
The API response is an empty 200 OK response, unless an issue occurred - e.g.
|
|
the CA is not known:
|
|
|
|
.. code-block:: json
|
|
|
|
{"label":"ca-unknown","msg":"CA 'unknown' is unknown","args":{"ca":"unknown"}}
|
|
|
|
|
|
....
|
|
|
|
|
|
.. _cmd_krillc_list:
|
|
|
|
krillc list
|
|
-----------
|
|
|
|
List the current CAs.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc list
|
|
testbed
|
|
ta
|
|
|
|
Example API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc list --api
|
|
GET:
|
|
https://localhost:3000/api/v1/cas
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
|
|
Example API response:
|
|
|
|
.. code-block:: json
|
|
|
|
{
|
|
"cas": [
|
|
{
|
|
"handle": "testbed"
|
|
},
|
|
{
|
|
"handle": "ta"
|
|
}
|
|
]
|
|
}
|
|
|
|
....
|
|
|
|
.. _cmd_krillc_parents:
|
|
|
|
krillc parents
|
|
--------------
|
|
|
|
Manage parents for a CA. You will need to add at least one parent, and a repository (see below), before
|
|
your CA can request any resource certificate.
|
|
|
|
The Krill CLI and API have a number of subcommands to manage CA parents:
|
|
|
|
.. parsed-literal::
|
|
:ref:`request<cmd_krillc_parents_request>` Show RFC8183 Publisher Request XML
|
|
:ref:`add<cmd_krillc_parents_add>` Add a parent to this CA
|
|
:ref:`statuses<cmd_krillc_parents_statuses>` Show overview of all parent statuses of a CA
|
|
:ref:`contact<cmd_krillc_parents_contact>` Show contact information for a parent of this CA
|
|
:ref:`remove<cmd_krillc_parents_remove>` Remove an existing parent from this CA
|
|
|
|
.. _cmd_krillc_parents_request:
|
|
|
|
krillc parents request
|
|
----------------------
|
|
|
|
Before you can add a parent to any CA, you will need to present an :rfc:`8183` Publisher Request XML
|
|
to that parent. Their response XML can then be used to add them as a parent.
|
|
|
|
For more information on how this is done through the UI see: :ref:`doc_krill_using_ui_parent_setup`.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc parents request --ca newca
|
|
<child_request xmlns="http://www.hactrn.net/uris/rpki/rpki-setup/" version="1" child_handle="newca">
|
|
<child_bpki_ta>MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhFRjJENzgwRkNCRkU1QjZBMkExMjA1OUM0MDlDN0M5Mjc3NTQxOTU2MB4XDTIxMDQwNzE0MzUxNFoXDTM2MDQwNzE0NDAxNFowMzExMC8GA1UEAxMoRUYyRDc4MEZDQkZFNUI2QTJBMTIwNTlDNDA5QzdDOTI3NzU0MTk1NjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANuBsEO4C9n7PlYcDT0PTeZntR5l778lZQDsgxiB7ofLrg8lKcf8ugFiYI4vRqR+gDMHhR3t/X3Ho5gC7uuKf4LYqbJj+Z9ltr/236/hDYJfWMXZVcEuL+wUble1zhe2NKrgnAkpReVMSdiugoqZ9ICK2Fwkj5jCGc/qHiWOba7T78zfij8OlB/dGlJvkAY8b/XTNKsTrLozi1uVAC8GqDrV5MEgY/NfzUvgA024yxx/rC6QBDEoBjnP7wDFiaZ2lwvL2beVYu6/hVcXQzsVN+ijy7cGdkE6zi0meXJLTHPEpoA88hi3Pi+pIDBIQ3wTcpQIOqAq/SZuh4dbZK7BV8MCAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU7y14D8v+W2oqEgWcQJx8kndUGVYwHwYDVR0jBBgwFoAU7y14D8v+W2oqEgWcQJx8kndUGVYwDQYJKoZIhvcNAQELBQADggEBAArqsa/gpJtONdgIWV1EqwEzhKKA2EP6tLDF9ejsdMFNYrYr+2hVWaoLsSuarfwfLFSgKDFqR6sh3ljYq6mIz9gdkjBOJsR9JyHFEtsDsRpf8Hs1WlbIb8bWb73Cp/YPMPVBpmG15Z9iKantzC1tck+E1xYW5awvj+YZqGVqyFdPJOZWmaYoS83kWvg4g4IucXTH6wwy23MQ7+0gyoK4wxfXRQmWjlXpLueCOsJo7ZXopsDAmXHLoFKZVEXn1ocQNc91l521BEQ6t/d7srQA4IxZCRGh9B+JdAIOKuXBA0nncmMJLQN8Qpxlz2bxKKAgXBLdoDqjbTDVbXTPM8YLRgc=</child_bpki_ta>
|
|
</child_request>
|
|
|
|
|
|
The API can be called to return the Publisher Request in XML format if you use the following path scheme:
|
|
|
|
.. code-block:: text
|
|
|
|
GET:
|
|
https://localhost:3000/api/v1/cas/newca/id/child_request.xml
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
|
|
The API also supports a JSON equivalent of the response if the `child_request.json` is requested instead:
|
|
|
|
.. code-block:: text
|
|
|
|
GET:
|
|
https://localhost:3000/api/v1/cas/newca/id/child_request.json
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
|
|
.. _cmd_krillc_parents_add:
|
|
|
|
krillc parents add
|
|
------------------
|
|
|
|
Add a parent to a CA. Or update the information for an existing parent.
|
|
|
|
In order to add a parent to a CA you will need to present the :rfc:`8183` Parent Response. You will
|
|
usually get this response in the standard RFC XML format. The Krill API supports submitting this file
|
|
in its plain XML form, in which case the *local* name for the parent - i.e. the name that your CA will
|
|
use for it in the presentation to you - will be derived from the path, or if it is not supplied there
|
|
from the `parent_handle` in the XML.
|
|
|
|
The API also supports a JSON format where the parent *local* `handle` can be explicitly specified. If
|
|
you use the CLI then it will expect that you provide this local handle, parse a supplied XML file, and
|
|
then combine both in a JSON body sent to the server:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc parents add --parent my_parent --response ./data/new-ca-parent-response.xml --api
|
|
POST:
|
|
https://localhost:3000/api/v1/cas/ca/parents
|
|
Headers:
|
|
content-type: application/json
|
|
Authorization: Bearer secret
|
|
Body:
|
|
{
|
|
"handle": "my_parent",
|
|
"contact": {
|
|
"type": "rfc6492",
|
|
"tag": null,
|
|
"id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhFOTBDMjE3MzRDMkMzNzBBOTFBODQ3NUNCNEYwRTc1REE0RDBGMEJGMB4XDTIxMDMyOTA3NTg0NFoXDTM2MDMyOTA4MDM0NFowMzExMC8GA1UEAxMoRTkwQzIxNzM0QzJDMzcwQTkxQTg0NzVDQjRGMEU3NURBNEQwRjBCRjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANcL8DFS3AQyI8HewRH2Xkh6RNIfCSb7mJDaS6dHwp2Dns0VZ07SjA/vVYxq1F1w2yQ/VoTr1dvEHxJ+SDayMcFVktWCObiY8tcPhvWG+OdaX9ckDJhsOEEvdVEogwiGacNs7yXJPbqDBptJtbR8/CauF9OqMqjkB/8xkGmBoY5OI/V2832jkp7LPsbyET0RMQN7fgSpGbewvkaZVxGU3pHh5kT1nzPTXrwjxNMXgpunSEY7zR20vYCvsYYbxnSwFNbSMSL+Jgpa+HWPUc0ydqk2Dn3XneHqClu3O37URxcvI+th4+rECNp6/qlqlZK+tkppI2LkSBhTV5+n7cGA8ZsCAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU6Qwhc0wsNwqRqEdctPDnXaTQ8L8wHwYDVR0jBBgwFoAU6Qwhc0wsNwqRqEdctPDnXaTQ8L8wDQYJKoZIhvcNAQELBQADggEBAG9DNu26d2S9b15NzzaArLg3Ac/nVmqDlK/1sWZNUXFWP4dt1wLTjDWnceyS8mI7Yx8dH/Fez60m4lp4dD45eeaXfbjP2cWnh3n/PLGE70Nj+G0AnUhUmwiTl0H6Px1xn8fZouhv9MEheaZJA+M4NF77+Nmkp2P3WI4cvIS7Te7R/7XpwSr29lVNtYjmRlrBDXx/bMFSgFL61mrtj/l6G8OB40w+sAwO0XKUj1vUUpfIXc3ISCo0LNT9JSPcgy1SZWfmLb98q4HuvxekhkIPRzW7vlb/NBXGarZmKc+HQjE2aXcIewhen2OoTSNda2jSSuEWZuWzZu0aMCKwFBNHLqs=",
|
|
"parent_handle": "testbed",
|
|
"child_handle": "newca",
|
|
"service_uri": "https://localhost:3000/rfc6492/testbed"
|
|
}
|
|
}
|
|
|
|
Note that whichever handle you choose, your CA will use the handles that the
|
|
parent response included for itself *and* for your CA in its communication with
|
|
this parent. I.e. you may want to inspect the response and use the same handle
|
|
for the parent (parent_handle attribute), and do not be surprised or alarmed if
|
|
the parent refers to your ca (child_handle attribute) by some seemingly random
|
|
name. Some parents do this to ensure uniqueness.
|
|
|
|
In case you have multiple parents you may want to refer to them by names that
|
|
make sense in your context, or to avoid name collisions in case they all like
|
|
to go by the same the name.
|
|
|
|
In order to specify the parent 'handle' on the path it can simply be added as
|
|
a path parameter in the call. This is primarily intended for XML in which case
|
|
the path argument will be taken from here. If you submit a JSON body *and*
|
|
specify a the handle as path parameter, then Krill will return an error in case
|
|
the handles do not match.
|
|
|
|
.. Important:: The API path for ADDING a parent is the same as the API path for updating a parent.
|
|
This means that adding the same parent multiple times is idempotent. If you are unsure about
|
|
The parents that your CA currently has, then have a look at the :ref:`show<cmd_krillc_show>`
|
|
subcommand.
|
|
|
|
.. _cmd_krillc_parents_statuses:
|
|
|
|
krillc parents statuses
|
|
-----------------------
|
|
|
|
Show the current status between a CA and all of its parents.
|
|
|
|
.. Warning:: This command will return an empty result if you did not yet
|
|
configure a repository for the CA. This is because Krill will not even
|
|
attempt to contact parent CAs until it knows which URIs to use in
|
|
certificate requests.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc parents statuses --ca newca
|
|
Parent: my_parent
|
|
URI: https://localhost:3000/rfc8181/localname/
|
|
Status: success
|
|
Last contacted: 2021-04-08T11:20:00+00:00
|
|
Resource Entitlements: asn: AS65000, ipv4: 10.0.0.0/8, ipv6: 2001:db8::/32
|
|
resource class: 0
|
|
entitled resources: asn: 'AS65000', ipv4: '10.0.0.0/8', ipv6: '2001:db8::/32'
|
|
entitled not after: 2023-03-15T14:23:57+00:00
|
|
issuing cert uri: rsync://localhost/repo/ta/0/0BA5C132B94891CB2D3A89EDE12F01ACA4BCD3DC.cer
|
|
issuing cert PEM:
|
|
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIFKzCCBBOgAwIBA...
|
|
-----END CERTIFICATE-----
|
|
|
|
received certificate(s):
|
|
published at: rsync://localhost/repo/testbed/0/16B31C92EB116BC60026C50944AD44205DD9ACBD.cer
|
|
resources: asn: AS65000, v4: 10.0.0.0/8, v6: 2001:db8::/32
|
|
cert PEM:
|
|
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIFYDCCBEigAwIBAgIUN5PzATTKVrjgual4CpJMaggW2EIwDQYJKoZIhvcNAQELBQAwMzExMC8GA1UEAxMoMEJBNUMxMzJCOTQ4OTFDQjJEM0E4OUVERTEyRjAxQUNBNEJDRDNEQzAeFw0yMTA0MDgwOTQ4MjVaFw0yMjA0MDcwOTUzMjVaMDMxMTAvBgNVBAMTKDE2QjMxQzkyRUIxMTZCQzYwMDI2QzUwOTQ0QUQ0NDIwNUREOUFDQkQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDsBouGWEPhWg+XsRDGZyuFLDPiIExy7p4b3bjNPBfHeSqHCeOwiVIVS2xiIAGO2NBcv+hL2OFKNCAnpd71hOXMBNXW/7OHN8TU6crIu1/w1gkf6UCXFrv+poW9EJHnLonMa4ZFLSFsvQACIGUpxIuiQjaSYFltTbb+o2c9KWoKsX0kZqt5zOrgAP8cke8SFGHdqqenPInXKTgyss9kCs9pFtMk6BIa6KjRvqFVZIf6xG53ytJ3JqsGjvEo8qoHYxkvkMtbjhjlmW097i6DeC1241X3SG64DSMk1CNv1xt5MSXubLzWOD+2lLId/ngql4OV0bLkbb63J/26c8FZOThZAgMBAAGjggJqMIICZjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQWsxyS6xFrxgAmxQlErUQgXdmsvTAfBgNVHSMEGDAWgBQLpcEyuUiRyy06ie3hLwGspLzT3DAOBgNVHQ8BAf8EBAMCAQYwXgYDVR0fBFcwVTBToFGgT4ZNcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90ZXN0YmVkLzAvMEJBNUMxMzJCOTQ4OTFDQjJEM0E4OUVERTEyRjAxQUNBNEJDRDNEQy5jcmwwZAYIKwYBBQUHAQEEWDBWMFQGCCsGAQUFBzAChkhyc3luYzovL2xvY2FsaG9zdC9yZXBvL3RhLzAvMEJBNUMxMzJCOTQ4OTFDQjJEM0E4OUVERTEyRjAxQUNBNEJDRDNEQy5jZXIwgdgGCCsGAQUFBwELBIHLMIHIMC8GCCsGAQUFBzAFhiNyc3luYzovL2xvY2FsaG9zdC9yZXBvL2xvY2FsbmFtZS8wLzBbBggrBgEFBQcwCoZPcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9sb2NhbG5hbWUvMC8xNkIzMUM5MkVCMTE2QkM2MDAyNkM1MDk0NEFENDQyMDVERDlBQ0JELm1mdDA4BggrBgEFBQcwDYYsaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMC9ycmRwL25vdGlmaWNhdGlvbi54bWwwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjAsBggrBgEFBQcBBwEB/wQdMBswCgQCAAEwBAMCAAowDQQCAAIwBwMFACABDbgwGgYIKwYBBQUHAQgBAf8ECzAJoAcwBQIDAP3oMA0GCSqGSIb3DQEBCwUAA4IBAQB8hxBbJjvgVRMfXsotTNwKCc2Q0QO92xmZlV19Uh0/Yja+sYhyg/pG1/ZTvhOLIxGWap8JmqOnYa9XgX8uUlsV8LgJoEH3Gde3txcGtfLO99ugvbnKKGOcPxB8AX5hAhhfdiSnt3V06dEz3HUoTYdUKTV0bZr3dhRIBa94esAS7lsP2vhHEQ8gVjZGWVvS7lGju+kuwm9H3PBscW/K8349vN0QJUZGm3gAUsM5PlnAqbkM7VFIyu8g2Yp9g+M/iwaHar8CqABKxLBThYgqrPLLv6CsZD3mjk5BkXVZh6R9dBcR7sPbSfGBWPWCv8SwLknyQDOvsWTho1Ga6AibjUQp
|
|
-----END CERTIFICATE-----
|
|
|
|
Note that in case there are any issues, i.e. the status is "failure" then Krill will keep
|
|
trying to resynchronise the CA with this parent automatically. There is usually no need to
|
|
trigger this manually before the next planned contact, but you can use :ref:`krillc bulk refresh<cmd_krillc_bulk_refresh>`
|
|
if you are debugging an issue.
|
|
|
|
The JSON response returned by the server contains some additional information, in particular about the
|
|
certificates used by parent CAs to sign the certificates of your CA:
|
|
|
|
.. code-block:: json
|
|
|
|
{
|
|
"my_parent": {
|
|
"last_exchange": {
|
|
"timestamp": 1617881400,
|
|
"uri": "https://localhost:3000/rfc8181/localname/",
|
|
"result": "Success"
|
|
},
|
|
"last_success": 1617881400,
|
|
"all_resources": {
|
|
"asn": "AS65000",
|
|
"ipv4": "10.0.0.0/8",
|
|
"ipv6": "2001:db8::/32"
|
|
},
|
|
"classes": [
|
|
{
|
|
"class_name": "0",
|
|
"resource_set": {
|
|
"asn": "AS65000",
|
|
"ipv4": "10.0.0.0/8",
|
|
"ipv6": "2001:db8::/32"
|
|
},
|
|
"not_after": "2023-03-15T14:23:57Z",
|
|
"issued_certs": [
|
|
{
|
|
"uri": "rsync://localhost/repo/testbed/0/16B31C92EB116BC60026C50944AD44205DD9ACBD.cer",
|
|
"req_limit": {},
|
|
"cert": "MII..."
|
|
}
|
|
],
|
|
"signing_cert": {
|
|
"url": "rsync://localhost/repo/ta/0/0BA5C132B94891CB2D3A89EDE12F01ACA4BCD3DC.cer",
|
|
"cert": "MII..."
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
|
|
Example API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc parents statuses --ca newca --api
|
|
GET:
|
|
https://localhost:3000/api/v1/cas/newca/parents
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
|
|
.. _cmd_krillc_parents_contact:
|
|
|
|
krillc parents contact
|
|
----------------------
|
|
|
|
Show contact information for a parent of this CA.
|
|
|
|
This can be useful for verifying that the parent contact information matches
|
|
the :rfc:`8183` Parent Response that is expected for the given parent.
|
|
|
|
The API returns the response in JSON format, but this is converted to XML by
|
|
the CLI when the default text format is used.
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc parents contact --ca newca --parent my_parent
|
|
|
|
|
|
Here we will show the JSON output:
|
|
|
|
.. code-block:: json
|
|
|
|
{
|
|
"type": "rfc6492",
|
|
"tag": null,
|
|
"id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhFOTBDMjE3MzRDMkMzNzBBOTFBODQ3NUNCNEYwRTc1REE0RDBGMEJGMB4XDTIxMDMyOTA3NTg0NFoXDTM2MDMyOTA4MDM0NFowMzExMC8GA1UEAxMoRTkwQzIxNzM0QzJDMzcwQTkxQTg0NzVDQjRGMEU3NURBNEQwRjBCRjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANcL8DFS3AQyI8HewRH2Xkh6RNIfCSb7mJDaS6dHwp2Dns0VZ07SjA/vVYxq1F1w2yQ/VoTr1dvEHxJ+SDayMcFVktWCObiY8tcPhvWG+OdaX9ckDJhsOEEvdVEogwiGacNs7yXJPbqDBptJtbR8/CauF9OqMqjkB/8xkGmBoY5OI/V2832jkp7LPsbyET0RMQN7fgSpGbewvkaZVxGU3pHh5kT1nzPTXrwjxNMXgpunSEY7zR20vYCvsYYbxnSwFNbSMSL+Jgpa+HWPUc0ydqk2Dn3XneHqClu3O37URxcvI+th4+rECNp6/qlqlZK+tkppI2LkSBhTV5+n7cGA8ZsCAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU6Qwhc0wsNwqRqEdctPDnXaTQ8L8wHwYDVR0jBBgwFoAU6Qwhc0wsNwqRqEdctPDnXaTQ8L8wDQYJKoZIhvcNAQELBQADggEBAG9DNu26d2S9b15NzzaArLg3Ac/nVmqDlK/1sWZNUXFWP4dt1wLTjDWnceyS8mI7Yx8dH/Fez60m4lp4dD45eeaXfbjP2cWnh3n/PLGE70Nj+G0AnUhUmwiTl0H6Px1xn8fZouhv9MEheaZJA+M4NF77+Nmkp2P3WI4cvIS7Te7R/7XpwSr29lVNtYjmRlrBDXx/bMFSgFL61mrtj/l6G8OB40w+sAwO0XKUj1vUUpfIXc3ISCo0LNT9JSPcgy1SZWfmLb98q4HuvxekhkIPRzW7vlb/NBXGarZmKc+HQjE2aXcIewhen2OoTSNda2jSSuEWZuWzZu0aMCKwFBNHLqs=",
|
|
"parent_handle": "testbed",
|
|
"child_handle": "newca",
|
|
"service_uri": "https://localhost:3000/rfc6492/testbed"
|
|
}
|
|
|
|
Example API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc parents contact --ca newca --parent my_parent --api
|
|
GET:
|
|
https://localhost:3000/api/v1/cas/newca/parents/my_parent
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
|
|
.. _cmd_krillc_parents_remove:
|
|
|
|
krillc parents remove
|
|
---------------------
|
|
|
|
Remove an existing parent from this CA.
|
|
|
|
The CA will do a best effort attempt to request revocation of any certificate received under
|
|
the parent - meaning that if the parent cannot be reached the operation just continues without
|
|
error. After all a parent may well be removed *because* it is no longer reachable. Furthermore
|
|
any RPKI published under those certificate(s) will be withdrawn.
|
|
|
|
Note that although revocations are requested the parent may not be aware that they have been
|
|
removed. You may want to notify them through different channels. The RPKI provisioning protocol
|
|
:rfc:`6492` does not have verbs by which a child CA can ask the parent to be removed completely.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc parents remove --ca newca --parent my_parent
|
|
|
|
|
|
Example API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc parents remove --ca newca --parent my_parent --api
|
|
DELETE:
|
|
https://localhost:3000/api/v1/cas/newca/parents/my_parent
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
....
|
|
|
|
.. _cmd_krillc_repo:
|
|
|
|
krillc repo
|
|
-----------
|
|
|
|
Manage the repository where a CA will publish its objects. There are a number of
|
|
subcommands provided for this:
|
|
|
|
.. parsed-literal::
|
|
|
|
USAGE:
|
|
krillc repo [SUBCOMMAND]
|
|
|
|
SUBCOMMANDS:
|
|
:ref:`request<cmd_krillc_repo_request>` Show RFC8183 Publisher Request
|
|
:ref:`configure<cmd_krillc_repo_configure>` Configure which repository this CA uses
|
|
:ref:`show<cmd_krillc_repo_show>` Show current repo config
|
|
:ref:`status<cmd_krillc_repo_status>` Show current repo status
|
|
|
|
.. _cmd_krillc_repo_request:
|
|
|
|
krillc repo request
|
|
-------------------
|
|
|
|
Show the :rfc:`8183` Publisher Request XML for a CA. You will need to hand this
|
|
over to your repository so that they can add your CA.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc repo request --ca newca
|
|
<publisher_request xmlns="http://www.hactrn.net/uris/rpki/rpki-setup/" version="1" publisher_handle="newca">
|
|
<publisher_bpki_ta>MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhFRjJENzgwRkNCRkU1QjZBMkExMjA1OUM0MDlDN0M5Mjc3NTQxOTU2MB4XDTIxMDQwNzE0MzUxNFoXDTM2MDQwNzE0NDAxNFowMzExMC8GA1UEAxMoRUYyRDc4MEZDQkZFNUI2QTJBMTIwNTlDNDA5QzdDOTI3NzU0MTk1NjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANuBsEO4C9n7PlYcDT0PTeZntR5l778lZQDsgxiB7ofLrg8lKcf8ugFiYI4vRqR+gDMHhR3t/X3Ho5gC7uuKf4LYqbJj+Z9ltr/236/hDYJfWMXZVcEuL+wUble1zhe2NKrgnAkpReVMSdiugoqZ9ICK2Fwkj5jCGc/qHiWOba7T78zfij8OlB/dGlJvkAY8b/XTNKsTrLozi1uVAC8GqDrV5MEgY/NfzUvgA024yxx/rC6QBDEoBjnP7wDFiaZ2lwvL2beVYu6/hVcXQzsVN+ijy7cGdkE6zi0meXJLTHPEpoA88hi3Pi+pIDBIQ3wTcpQIOqAq/SZuh4dbZK7BV8MCAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU7y14D8v+W2oqEgWcQJx8kndUGVYwHwYDVR0jBBgwFoAU7y14D8v+W2oqEgWcQJx8kndUGVYwDQYJKoZIhvcNAQELBQADggEBAArqsa/gpJtONdgIWV1EqwEzhKKA2EP6tLDF9ejsdMFNYrYr+2hVWaoLsSuarfwfLFSgKDFqR6sh3ljYq6mIz9gdkjBOJsR9JyHFEtsDsRpf8Hs1WlbIb8bWb73Cp/YPMPVBpmG15Z9iKantzC1tck+E1xYW5awvj+YZqGVqyFdPJOZWmaYoS83kWvg4g4IucXTH6wwy23MQ7+0gyoK4wxfXRQmWjlXpLueCOsJo7ZXopsDAmXHLoFKZVEXn1ocQNc91l521BEQ6t/d7srQA4IxZCRGh9B+JdAIOKuXBA0nncmMJLQN8Qpxlz2bxKKAgXBLdoDqjbTDVbXTPM8YLRgc=</publisher_bpki_ta>
|
|
</publisher_request>
|
|
|
|
The CLI will present the Publisher Request in its RFC XML format by default. The API supports both the
|
|
XML and an equivalent JSON format dependent on the file extension used in the request URI:
|
|
|
|
XML:
|
|
|
|
.. code-block:: text
|
|
|
|
GET:
|
|
https://localhost:3000/api/v1/cas/newca/id/publisher_request.xml
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
JSON:
|
|
|
|
.. code-block:: text
|
|
|
|
GET:
|
|
https://localhost:3000/api/v1/cas/newca/id/publisher_request.json
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
.. _cmd_krillc_repo_configure:
|
|
|
|
krillc repo configure
|
|
---------------------
|
|
|
|
This is used to configure the repository used by a CA.
|
|
|
|
Your CA needs a repository configuration before it will request any certificates from
|
|
parents. You can chose to configure a repository first and then add the first parent
|
|
to your CA, or vice versa. The order does not matter, but both are needed for your
|
|
CA to function.
|
|
|
|
You can use the CLI to configure a repository by submitting the :rfc:`8183` Repository
|
|
Response XML to your CA. Before committing the configuration Krill checks whether the
|
|
Publication Server can be reached and responds to a query sent by your CA. If this fails,
|
|
then an error is reported and the configuration is aborted. You can try again when you
|
|
think the issue has been resolved.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc repo configure --ca newca --response ./data/new-ca-repository-response.xml
|
|
|
|
|
|
The API will accept the plain :rfc:`8183` Repository Response XML if it's posted
|
|
to the API path for the CA in question, but the CLI will post the XML formatted
|
|
as its JSON equivalent:
|
|
|
|
Example API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc repo configure --ca newca --response ./data/new-ca-repository-response.xml --api
|
|
POST:
|
|
https://localhost:3000/api/v1/cas/newca/repo
|
|
Headers:
|
|
content-type: application/json
|
|
Authorization: Bearer secret
|
|
Body:
|
|
{
|
|
"repository_response": {
|
|
"tag": null,
|
|
"publisher_handle": "localname",
|
|
"id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyg4OEJBMzA2QkMzMUVFRkU3NzRDNzYzRUY1N0VBNUZEQzdBMTlERTI1MB4XDTIxMDMyOTA3NTg0M1oXDTM2MDMyOTA4MDM0M1owMzExMC8GA1UEAxMoODhCQTMwNkJDMzFFRUZFNzc0Qzc2M0VGNTdFQTVGREM3QTE5REUyNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAORLpfOKS8M2QGBto1OdnDYdrgjxJeF+uU7mJLgqTT3l5NbkOXxgPClUqbbbfp/c7x5sy3JbmUWaQHtkl6N9l8vcRlQQfhk0vwlVCHcQQrcMViJ5GmGtEjo7+Uf9e0TDA+rrkdqOkpOLcGRKjs1SZNqCRktubQU7Ndc0ICLo6KsQ5VYvw0p6YJcsL33+jcOWsFe6D4dhYlQkw5QHXn5c0Eenvz1SQqE96pcXJ57gmnzO9iVjY9RqPoLWXSRub0pG3Q6x8naOq16uaJZyk8kVjYOayx5umR73fI9iyMG0YOF8H5vy6/gYAnYssX26kObXan0fD9rgv4aWK0Xzp5hwz1ECAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUiLowa8Me7+d0x2PvV+pf3HoZ3iUwHwYDVR0jBBgwFoAUiLowa8Me7+d0x2PvV+pf3HoZ3iUwDQYJKoZIhvcNAQELBQADggEBAMtieNiamax1gUeSeGuA72NucPCZIdx2JrTIDhCAjLmPpvnXu1djGSa07YpgLiosnbtMMfsQO2O/Yz1VkQUTjLn2x7DKwuL9A8+IrYELSth4aCNSgPkhZfDL238MflAxptNRAoIeRGn8l3oSg4AUzBuScErwvBbHWShO66nV0wzVFb+mLvNas3Wd/GMiZHI/MwGZpj86Q/8wvyyw2C0b0ddWaoXwDyJjuxja0nHPDHVriJ8/xsOfBk144n1zyP++apQXmXorCy4hs9GPyr+HGeoL6kNydDxdwzJLCqWW7u3wSnxjCJk+hfGq82qNm90ALv5PaOb58fDgWwBwuvTP0AA=",
|
|
"service_uri": "https://localhost:3000/rfc8181/localname/",
|
|
"repo_info": {
|
|
"sia_base": "rsync://localhost/repo/localname/",
|
|
"rrdp_notification_uri": "https://localhost:3000/rrdp/notification.xml"
|
|
}
|
|
}
|
|
}
|
|
|
|
.. Important:: If you need to change your repository configuration, then
|
|
follow :ref:`this<doc_krill_ca_migrate_repo>` process to migrate your
|
|
CA to a new repository.
|
|
|
|
.. _cmd_krillc_repo_status:
|
|
|
|
krillc repo status
|
|
------------------
|
|
|
|
This subcommand can be used to verify the status between a CA and its repository. Note that Krill will
|
|
keep trying to re-sync CAs with their repositories in case of any issues and the response includes an
|
|
indication of the next planned moment for this. In other words, there should not be a need to trigger
|
|
this synchronisation manually, but for the impatient, you can use :ref:`krillc bulk sync<cmd_krillc_bulk_sync>`.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc repo status --ca newca
|
|
URI: https://localhost:3000/rfc8181/localname/
|
|
Status: success
|
|
Last contacted: 2021-04-08T09:53:27+00:00
|
|
Next contact on or before: 2021-04-09T01:53:27+00:00
|
|
|
|
|
|
So the CLI text output does NOT include the files which are published. If you want to see these files
|
|
then you can look at the JSON response instead:
|
|
|
|
.. code-block:: json
|
|
|
|
{
|
|
"last_exchange": {
|
|
"timestamp": 1617875607,
|
|
"uri": "https://localhost:3000/rfc8181/localname/",
|
|
"result": "Success"
|
|
},
|
|
"next_exchange_before": 1617933207,
|
|
"published": [
|
|
{
|
|
"base64": "MIIJTQYJKoZIhvcNAQcCoIIJPjCCCToCAQMxDTALBglghkgBZQMEAgEwgZsGCyqGSIb3DQEJEAEaoIGLBIGIMIGFAgEBGA8yMDIxMDQwODA5NDgyNVoYDzIwMjEwNDA5MDk1MzI1WgYJYIZIAWUDBAIBMFMwURYsMTZCMzFDOTJFQjExNkJDNjAwMjZDNTA5NDRBRDQ0MjA1REQ5QUNCRC5jcmwDIQDYb3KmzVBt0Ee3CkVLOpcale0dr9EHoL/NWi2U6R7ffaCCBtgwggbUMIIFvKADAgECAhQfMMPbsoNAMCZM8zHTPf4QMZ06vjANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygxNkIzMUM5MkVCMTE2QkM2MDAyNkM1MDk0NEFENDQyMDVERDlBQ0JEMB4XDTIxMDQwODA5NDgyNVoXDTIxMDQxNTA5NTMyNVowggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIwMTAxMDBBQzhDQzlEMkUzM0ZCQ0U4MzdDMDIwRUFFQzYyNjA4OEY3NkNFQTM3MTA3MzNBMDhFNTYyQTg5M0UyMDBDRTA2QkIzMUQ0QkU3QTJGNzQ5QTM0Rjg1RTYyODdCNjE1MzQzODA2NDJBOTUzNzQyQUY2RDM0RTIxRDY0MkJFOUMwQjg1OURDQjcxMDJGRDJGNDM1MjE1ODI0RDU5NjVFNDlBNDBGRDBFOTZCQTFDRjRDQkM3QzM3RkFCRTBBNzlCNkEzRkM4OTE2MzA1RjY1MjYwREE0NERCMUEzOEZBN0MzM0UwNzRGQTRBMTVFODc5MkJEQzQwMDZCQUM2Mzc4RkU3M0Y1MEMxQjRBMTdFQ0EwNjU4NkQwRjRERUFFREQzQzJGOTlDQ0E2NzM3ODU4MUZFRUM5RjRGNjk3QTcwN0I5QUY4Q0RGQTFDREE1RERCNzA3MUU3QjY5QTNCMDQ2MUJBMDMyOTg3OEVFOTkwMDBFNDhBQUU0NzIwMjY0OEI3RjZCNUZENDc4NUFBREIzMUUwM0U0QjMxNzEzQTNGODVFNzQ4RjFCQUY0QURBNjQyMUFFODE4QjIwOEFFQkVCMUQwQjAxNzk0NEQyRTM0MDkxODExQzFFNzk5RDI3MDVBQ0IwNkQxMUEwQzQ0NjdGODlCMjU4RjBFNEY2OTRBQjkwQjAyMDMwMTAwMDEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsjMnS4z+86DfAIOrsYmCI92zqNxBzOgjlYqiT4gDOBrsx1L56L3SaNPheYoe2FTQ4BkKpU3Qq9tNOIdZCvpwLhZ3LcQL9L0NSFYJNWWXkmkD9Dpa6HPTLx8N/q+Cnm2o/yJFjBfZSYNpE2xo4+nwz4HT6ShXoeSvcQAa6xjeP5z9QwbShfsoGWG0PTert08L5nMpnN4WB/uyfT2l6cHua+M36HNpd23Bx57aaOwRhugMph47pkADkiq5HICZIt/a1/UeFqtsx4D5LMXE6P4XnSPG69K2mQhroGLIIrr6x0LAXlE0uNAkYEcHnmdJwWssG0RoMRGf4myWPDk9pSrkLAgMBAAGjggHiMIIB3jAdBgNVHQ4EFgQU0iBYgw/6TJwtHRc735eady5RAOIwHwYDVR0jBBgwFoAUFrMckusRa8YAJsUJRK1EIF3ZrL0wDgYDVR0PAQH/BAQDAgeAMGAGA1UdHwRZMFcwVaBToFGGT3JzeW5jOi8vbG9jYWxob3N0L3JlcG8vbG9jYWxuYW1lLzAvMTZCMzFDOTJFQjExNkJDNjAwMjZDNTA5NDRBRDQ0MjA1REQ5QUNCRC5jcmwwaQYIKwYBBQUHAQEEXTBbMFkGCCsGAQUFBzAChk1yc3luYzovL2xvY2FsaG9zdC9yZXBvL3Rlc3RiZWQvMC8xNkIzMUM5MkVCMTE2QkM2MDAyNkM1MDk0NEFENDQyMDVERDlBQ0JELmNlcjBrBggrBgEFBQcBCwRfMF0wWwYIKwYBBQUHMAuGT3JzeW5jOi8vbG9jYWxob3N0L3JlcG8vbG9jYWxuYW1lLzAvMTZCMzFDOTJFQjExNkJDNjAwMjZDNTA5NDRBRDQ0MjA1REQ5QUNCRC5tZnQwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjAhBggrBgEFBQcBBwEB/wQSMBAwBgQCAAEFADAGBAIAAgUAMBUGCCsGAQUFBwEIAQH/BAYwBKACBQAwDQYJKoZIhvcNAQELBQADggEBAJQiHZ91d7/a52qM0DyXp7jbkygm2MkT5tc6pp6sxHv6pDfXxAzJS8OtgcFCTDKC57pKvVvw8THE079nbMSxfaA5nP8egedxeuTzrj8iOh9nHk/X4pWhIWsAvNgiTebYj+Eax97MmRWAkDgxWpDQ+CWQBl2gBstLmBKCBTw6cFlkGrBCLVe+gSDTnHpy4ltza6pD+EawTNrGLBnFn+/+dgzx/GA2qbRXiBLm2/R4HR7zI/QYy+wWDoaZraCu6dUZEF4WomS99aihEyNp8tzyuEntmmMfw0z/xYt1I7VN1pzc5umEPksSRvILmA3eJO3Khw2xWZzYjYcVyZAo0QbujdExggGqMIIBpgIBA4AU0iBYgw/6TJwtHRc735eady5RAOIwCwYJYIZIAWUDBAIBoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yMTA0MDgwOTUzMjVaMC8GCSqGSIb3DQEJBDEiBCDjDAYghzZK/MgJG2G+mOfNzHsAV6ysGcb89bMa7KTEmTANBgkqhkiG9w0BAQEFAASCAQCHxZ3CeXicDOpmXZ/uhEGtvsuzpepVryk58zBLnSpbKfjnJWwiL0t3PsvlQuKAXgW0Xc5cC4Bbvb8Aysr4W1c0SKjnWz4dPLqgNCzvIVJRToc2xHFd6lbJGuqii6tNRvYKzPtuUMrToyHTgh6+SdWI98RsBVtQsSt68f6620ow9r4aGjdXokkayCyOBZ/DF2j3h8eZpEM1Y09kOTQfwkn297UYOv9Hi74iKIzhS3+8FmfSP0UTA207+U7HBQp9SNkK2HjFa3milgV+hJHOPutNsbgvwd5YPAFMbuve+J5k4/qvfTN0hZlGafx5ODIppv+tqJ76zts9wzgVXrpl6tKQ",
|
|
"uri": "rsync://localhost/repo/localname/0/16B31C92EB116BC60026C50944AD44205DD9ACBD.mft"
|
|
},
|
|
{
|
|
"base64": "MIIBrzCBmAIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygxNkIzMUM5MkVCMTE2QkM2MDAyNkM1MDk0NEFENDQyMDVERDlBQ0JEFw0yMTA0MDgwOTQ4MjVaFw0yMTA0MDkwOTUzMjVaMACgLzAtMB8GA1UdIwQYMBaAFBazHJLrEWvGACbFCUStRCBd2ay9MAoGA1UdFAQDAgEBMA0GCSqGSIb3DQEBCwUAA4IBAQDJ3GxaYCxDCyfyfqdsUtM/OQx341/wWYrBrEAQ56NE6AVN+r0qjmO2mhNgVNQ1VdCLjo67ilQufmxGhtUQxBS625f1hr69cYw1l15wHDP4SFpXO96ysTxBhxpLGL215nT0S6FkQ+PLJ2IFLMhwn7Sns7RpQ9HDugNtz7QMRLbxeAz8ckeJHItUfyTpBhsweZEocTej1I7K4FugjZ+qSLDUFiy3QIcHO7lkepPraWLz9RVMuaJjcA7gAz3lNrtdRkygWRwGEC0eDwBa7MJ44feymQjsol6cr7m09MjSqTJyrNECjuNvLfilYuUMdW965Ih1HJQySE+FaetLQLbsTJxr",
|
|
"uri": "rsync://localhost/repo/localname/0/16B31C92EB116BC60026C50944AD44205DD9ACBD.crl"
|
|
}
|
|
]
|
|
}
|
|
|
|
|
|
|
|
Example API:
|
|
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc repo status --ca newca --api
|
|
GET:
|
|
https://localhost:3000/api/v1/cas/newca/repo/status
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
|
|
.. _cmd_krillc_repo_show:
|
|
|
|
krillc repo show
|
|
----------------
|
|
|
|
Show the repository configuration for your CA.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc repo show --ca newca
|
|
Repository Details:
|
|
service uri: https://localhost:3000/rfc8181/localname/
|
|
base_uri: rsync://localhost/repo/localname/
|
|
rpki_notify: https://localhost:3000/rrdp/notification.xml
|
|
|
|
|
|
Example API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc repo show --ca newca --api
|
|
GET:
|
|
https://localhost:3000/api/v1/cas/newca/repo
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
....
|
|
|
|
.. _cmd_krillc_show:
|
|
|
|
krillc show
|
|
-----------
|
|
|
|
Shows lots of details of a CA. Note, we may still extend the JSON response in future
|
|
but we will aim to add new information only.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc show --ca newca
|
|
Name: newca
|
|
|
|
Base uri: rsync://localhost/repo/localname/
|
|
RRDP uri: https://localhost:3000/rrdp/notification.xml
|
|
|
|
ID cert PEM:
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhFRjJE
|
|
NzgwRkNCRkU1QjZBMkExMjA1OUM0MDlDN0M5Mjc3NTQxOTU2MB4XDTIxMDQwNzE0
|
|
MzUxNFoXDTM2MDQwNzE0NDAxNFowMzExMC8GA1UEAxMoRUYyRDc4MEZDQkZFNUI2
|
|
QTJBMTIwNTlDNDA5QzdDOTI3NzU0MTk1NjCCASIwDQYJKoZIhvcNAQEBBQADggEP
|
|
ADCCAQoCggEBANuBsEO4C9n7PlYcDT0PTeZntR5l778lZQDsgxiB7ofLrg8lKcf8
|
|
ugFiYI4vRqR+gDMHhR3t/X3Ho5gC7uuKf4LYqbJj+Z9ltr/236/hDYJfWMXZVcEu
|
|
L+wUble1zhe2NKrgnAkpReVMSdiugoqZ9ICK2Fwkj5jCGc/qHiWOba7T78zfij8O
|
|
lB/dGlJvkAY8b/XTNKsTrLozi1uVAC8GqDrV5MEgY/NfzUvgA024yxx/rC6QBDEo
|
|
BjnP7wDFiaZ2lwvL2beVYu6/hVcXQzsVN+ijy7cGdkE6zi0meXJLTHPEpoA88hi3
|
|
Pi+pIDBIQ3wTcpQIOqAq/SZuh4dbZK7BV8MCAwEAAaNTMFEwDwYDVR0TAQH/BAUw
|
|
AwEB/zAdBgNVHQ4EFgQU7y14D8v+W2oqEgWcQJx8kndUGVYwHwYDVR0jBBgwFoAU
|
|
7y14D8v+W2oqEgWcQJx8kndUGVYwDQYJKoZIhvcNAQELBQADggEBAArqsa/gpJtO
|
|
NdgIWV1EqwEzhKKA2EP6tLDF9ejsdMFNYrYr+2hVWaoLsSuarfwfLFSgKDFqR6sh
|
|
3ljYq6mIz9gdkjBOJsR9JyHFEtsDsRpf8Hs1WlbIb8bWb73Cp/YPMPVBpmG15Z9i
|
|
KantzC1tck+E1xYW5awvj+YZqGVqyFdPJOZWmaYoS83kWvg4g4IucXTH6wwy23MQ
|
|
7+0gyoK4wxfXRQmWjlXpLueCOsJo7ZXopsDAmXHLoFKZVEXn1ocQNc91l521BEQ6
|
|
t/d7srQA4IxZCRGh9B+JdAIOKuXBA0nncmMJLQN8Qpxlz2bxKKAgXBLdoDqjbTDV
|
|
bXTPM8YLRgc=
|
|
-----END CERTIFICATE-----
|
|
|
|
Hash: 992ac17d85fef11d8be4aa37806586ce68b61fe9cf65c0965928dbce0c398a99
|
|
|
|
Total resources:
|
|
ASNs: AS65000
|
|
IPv4: 10.0.0.0/8
|
|
IPv6: 2001:db8::/32
|
|
|
|
Parents:
|
|
Handle: my_parent Kind: RFC 6492 Parent
|
|
|
|
Resource Class: 0
|
|
Parent: my_parent
|
|
State: active Resources:
|
|
ASNs: AS65000
|
|
IPv4: 10.0.0.0/8
|
|
IPv6: 2001:db8::/32
|
|
|
|
Children:
|
|
<none>
|
|
|
|
|
|
Example JSON response of the API:
|
|
|
|
.. code-block:: json
|
|
|
|
{
|
|
"handle": "newca",
|
|
"id_cert": {
|
|
"pem": "-----BEGIN CERTIFICATE-----\nMIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhFRjJE\nNzgwRkNCRkU1QjZBMkExMjA1OUM0MDlDN0M5Mjc3NTQxOTU2MB4XDTIxMDQwNzE0\nMzUxNFoXDTM2MDQwNzE0NDAxNFowMzExMC8GA1UEAxMoRUYyRDc4MEZDQkZFNUI2\nQTJBMTIwNTlDNDA5QzdDOTI3NzU0MTk1NjCCASIwDQYJKoZIhvcNAQEBBQADggEP\nADCCAQoCggEBANuBsEO4C9n7PlYcDT0PTeZntR5l778lZQDsgxiB7ofLrg8lKcf8\nugFiYI4vRqR+gDMHhR3t/X3Ho5gC7uuKf4LYqbJj+Z9ltr/236/hDYJfWMXZVcEu\nL+wUble1zhe2NKrgnAkpReVMSdiugoqZ9ICK2Fwkj5jCGc/qHiWOba7T78zfij8O\nlB/dGlJvkAY8b/XTNKsTrLozi1uVAC8GqDrV5MEgY/NfzUvgA024yxx/rC6QBDEo\nBjnP7wDFiaZ2lwvL2beVYu6/hVcXQzsVN+ijy7cGdkE6zi0meXJLTHPEpoA88hi3\nPi+pIDBIQ3wTcpQIOqAq/SZuh4dbZK7BV8MCAwEAAaNTMFEwDwYDVR0TAQH/BAUw\nAwEB/zAdBgNVHQ4EFgQU7y14D8v+W2oqEgWcQJx8kndUGVYwHwYDVR0jBBgwFoAU\n7y14D8v+W2oqEgWcQJx8kndUGVYwDQYJKoZIhvcNAQELBQADggEBAArqsa/gpJtO\nNdgIWV1EqwEzhKKA2EP6tLDF9ejsdMFNYrYr+2hVWaoLsSuarfwfLFSgKDFqR6sh\n3ljYq6mIz9gdkjBOJsR9JyHFEtsDsRpf8Hs1WlbIb8bWb73Cp/YPMPVBpmG15Z9i\nKantzC1tck+E1xYW5awvj+YZqGVqyFdPJOZWmaYoS83kWvg4g4IucXTH6wwy23MQ\n7+0gyoK4wxfXRQmWjlXpLueCOsJo7ZXopsDAmXHLoFKZVEXn1ocQNc91l521BEQ6\nt/d7srQA4IxZCRGh9B+JdAIOKuXBA0nncmMJLQN8Qpxlz2bxKKAgXBLdoDqjbTDV\nbXTPM8YLRgc=\n-----END CERTIFICATE-----\n",
|
|
"hash": "992ac17d85fef11d8be4aa37806586ce68b61fe9cf65c0965928dbce0c398a99"
|
|
},
|
|
"repo_info": {
|
|
"sia_base": "rsync://localhost/repo/localname/",
|
|
"rrdp_notification_uri": "https://localhost:3000/rrdp/notification.xml"
|
|
},
|
|
"parents": [
|
|
{
|
|
"handle": "my_parent",
|
|
"kind": "rfc6492"
|
|
}
|
|
],
|
|
"resources": {
|
|
"asn": "AS65000",
|
|
"ipv4": "10.0.0.0/8",
|
|
"ipv6": "2001:db8::/32"
|
|
},
|
|
"resource_classes": {
|
|
"0": {
|
|
"name_space": "0",
|
|
"parent_handle": "my_parent",
|
|
"keys": {
|
|
"active": {
|
|
"active_key": {
|
|
"key_id": "16B31C92EB116BC60026C50944AD44205DD9ACBD",
|
|
"incoming_cert": {
|
|
"cert": "MIIFYDCCBEigAwIBAgIUN5PzATTKVrjgual4CpJMaggW2EIwDQYJKoZIhvcNAQELBQAwMzExMC8GA1UEAxMoMEJBNUMxMzJCOTQ4OTFDQjJEM0E4OUVERTEyRjAxQUNBNEJDRDNEQzAeFw0yMTA0MDgwOTQ4MjVaFw0yMjA0MDcwOTUzMjVaMDMxMTAvBgNVBAMTKDE2QjMxQzkyRUIxMTZCQzYwMDI2QzUwOTQ0QUQ0NDIwNUREOUFDQkQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDsBouGWEPhWg+XsRDGZyuFLDPiIExy7p4b3bjNPBfHeSqHCeOwiVIVS2xiIAGO2NBcv+hL2OFKNCAnpd71hOXMBNXW/7OHN8TU6crIu1/w1gkf6UCXFrv+poW9EJHnLonMa4ZFLSFsvQACIGUpxIuiQjaSYFltTbb+o2c9KWoKsX0kZqt5zOrgAP8cke8SFGHdqqenPInXKTgyss9kCs9pFtMk6BIa6KjRvqFVZIf6xG53ytJ3JqsGjvEo8qoHYxkvkMtbjhjlmW097i6DeC1241X3SG64DSMk1CNv1xt5MSXubLzWOD+2lLId/ngql4OV0bLkbb63J/26c8FZOThZAgMBAAGjggJqMIICZjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQWsxyS6xFrxgAmxQlErUQgXdmsvTAfBgNVHSMEGDAWgBQLpcEyuUiRyy06ie3hLwGspLzT3DAOBgNVHQ8BAf8EBAMCAQYwXgYDVR0fBFcwVTBToFGgT4ZNcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90ZXN0YmVkLzAvMEJBNUMxMzJCOTQ4OTFDQjJEM0E4OUVERTEyRjAxQUNBNEJDRDNEQy5jcmwwZAYIKwYBBQUHAQEEWDBWMFQGCCsGAQUFBzAChkhyc3luYzovL2xvY2FsaG9zdC9yZXBvL3RhLzAvMEJBNUMxMzJCOTQ4OTFDQjJEM0E4OUVERTEyRjAxQUNBNEJDRDNEQy5jZXIwgdgGCCsGAQUFBwELBIHLMIHIMC8GCCsGAQUFBzAFhiNyc3luYzovL2xvY2FsaG9zdC9yZXBvL2xvY2FsbmFtZS8wLzBbBggrBgEFBQcwCoZPcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9sb2NhbG5hbWUvMC8xNkIzMUM5MkVCMTE2QkM2MDAyNkM1MDk0NEFENDQyMDVERDlBQ0JELm1mdDA4BggrBgEFBQcwDYYsaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMC9ycmRwL25vdGlmaWNhdGlvbi54bWwwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjAsBggrBgEFBQcBBwEB/wQdMBswCgQCAAEwBAMCAAowDQQCAAIwBwMFACABDbgwGgYIKwYBBQUHAQgBAf8ECzAJoAcwBQIDAP3oMA0GCSqGSIb3DQEBCwUAA4IBAQB8hxBbJjvgVRMfXsotTNwKCc2Q0QO92xmZlV19Uh0/Yja+sYhyg/pG1/ZTvhOLIxGWap8JmqOnYa9XgX8uUlsV8LgJoEH3Gde3txcGtfLO99ugvbnKKGOcPxB8AX5hAhhfdiSnt3V06dEz3HUoTYdUKTV0bZr3dhRIBa94esAS7lsP2vhHEQ8gVjZGWVvS7lGju+kuwm9H3PBscW/K8349vN0QJUZGm3gAUsM5PlnAqbkM7VFIyu8g2Yp9g+M/iwaHar8CqABKxLBThYgqrPLLv6CsZD3mjk5BkXVZh6R9dBcR7sPbSfGBWPWCv8SwLknyQDOvsWTho1Ga6AibjUQp",
|
|
"uri": "rsync://localhost/repo/testbed/0/16B31C92EB116BC60026C50944AD44205DD9ACBD.cer",
|
|
"resources": {
|
|
"asn": "AS65000",
|
|
"ipv4": "10.0.0.0/8",
|
|
"ipv6": "2001:db8::/32"
|
|
}
|
|
},
|
|
"request": null
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"children": [],
|
|
"suspended_children": []
|
|
}
|
|
|
|
|
|
Example API call:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc show --ca newca --api
|
|
GET:
|
|
https://localhost:3000/api/v1/cas/newca
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
|
|
....
|
|
|
|
.. _cmd_krillc_issues:
|
|
|
|
krillc issues
|
|
-------------
|
|
|
|
Show issues for CAs. The response will be empty unless there are actual current
|
|
issues.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc issues --ca newca
|
|
no issues found
|
|
|
|
|
|
Example JSON response with issues:
|
|
|
|
.. code-block:: json
|
|
|
|
{
|
|
"repo_issue": {
|
|
"label": "sys-http-client",
|
|
"msg": "HTTP client error: Access Forbidden",
|
|
"args": {
|
|
"cause": "Access Forbidden"
|
|
}
|
|
},
|
|
"parent_issues": [
|
|
{
|
|
"parent": "parent",
|
|
"issue": {
|
|
"label": "rfc6492-invalid-signature",
|
|
"msg": "Invalidly signed RFC 6492 CMS",
|
|
"args": {}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
|
|
|
|
Example API call:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc issues --ca newca --api
|
|
GET:
|
|
https://localhost:3000/api/v1/cas/newca/issues
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
....
|
|
|
|
.. _cmd_krillc_history:
|
|
|
|
krillc history
|
|
--------------
|
|
|
|
Show the history of a CA. Using this command you can show the history of all
|
|
the things that happened to your CA.
|
|
|
|
There are two subcommands for this:
|
|
|
|
.. parsed-literal::
|
|
|
|
USAGE:
|
|
krillc history [SUBCOMMAND]
|
|
|
|
SUBCOMMANDS:
|
|
:ref:`commands<cmd_krillc_history_commands>` Show the commands sent to a CA
|
|
:ref:`details<cmd_krillc_history_details>` Show details for a command in the history of a CA
|
|
|
|
.. _cmd_krillc_history_commands:
|
|
|
|
krillc history commands
|
|
-----------------------
|
|
|
|
With this subcommand you can look at an overview of all commands that were sent to a CA.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc history commands --ca newca
|
|
time::command::key::success
|
|
2021-04-07T15:25:01Z::Add parent 'my_parent' as 'RFC 6492 Parent' ::command--1617809101--1--cmd-ca-parent-add::OK
|
|
2021-04-08T09:53:23Z::Update repo to server at: https://localhost:3000/rfc8181/localname/ ::command--1617875603--2--cmd-ca-repo-update::OK
|
|
2021-04-08T09:53:24Z::Update entitlements under parent 'my_parent': 0 => asn: AS65000, v4: 10.0.0.0/8, v6: 2001:db8::/32 ::command--1617875604--3--cmd-ca-parent-entitlements::OK
|
|
2021-04-08T09:53:25Z::Update received cert in RC '0', with resources 'asn: 1 blocks, v4: 1 blocks, v6: 1 blocks' ::command--1617875605--4--cmd-ca-rcn-receive::OK
|
|
|
|
|
|
The JSON response includes some data which we do not (yet) show in the text output - e.g. the name of
|
|
the user who sent a command. This will become more relevant in future as people start using the multi-user
|
|
feature of the Krill UI:
|
|
|
|
.. code-block:: json
|
|
|
|
{
|
|
"offset": 0,
|
|
"total": 4,
|
|
"commands": [
|
|
{
|
|
"key": "command--1617809101--1--cmd-ca-parent-add",
|
|
"actor": "master-token",
|
|
"timestamp": 1617809101616,
|
|
"handle": "newca",
|
|
"version": 1,
|
|
"sequence": 1,
|
|
"summary": {
|
|
"msg": "Add parent 'my_parent' as 'RFC 6492 Parent'",
|
|
"label": "cmd-ca-parent-add",
|
|
"args": {
|
|
"parent": "my_parent",
|
|
"parent_contact": "RFC 6492 Parent"
|
|
}
|
|
},
|
|
"effect": {
|
|
"result": "success",
|
|
"events": [
|
|
1
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"key": "command--1617875603--2--cmd-ca-repo-update",
|
|
"actor": "master-token",
|
|
"timestamp": 1617875603613,
|
|
"handle": "newca",
|
|
"version": 2,
|
|
"sequence": 2,
|
|
"summary": {
|
|
"msg": "Update repo to server at: https://localhost:3000/rfc8181/localname/",
|
|
"label": "cmd-ca-repo-update",
|
|
"args": {
|
|
"service_uri": "https://localhost:3000/rfc8181/localname/"
|
|
}
|
|
},
|
|
"effect": {
|
|
"result": "success",
|
|
"events": [
|
|
2
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"key": "command--1617875604--3--cmd-ca-parent-entitlements",
|
|
"actor": "krill",
|
|
"timestamp": 1617875604550,
|
|
"handle": "newca",
|
|
"version": 3,
|
|
"sequence": 3,
|
|
"summary": {
|
|
"msg": "Update entitlements under parent 'my_parent': 0 => asn: AS65000, v4: 10.0.0.0/8, v6: 2001:db8::/32 ",
|
|
"label": "cmd-ca-parent-entitlements",
|
|
"args": {
|
|
"parent": "my_parent"
|
|
}
|
|
},
|
|
"effect": {
|
|
"result": "success",
|
|
"events": [
|
|
3,
|
|
4
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"key": "command--1617875605--4--cmd-ca-rcn-receive",
|
|
"actor": "krill",
|
|
"timestamp": 1617875605662,
|
|
"handle": "newca",
|
|
"version": 5,
|
|
"sequence": 4,
|
|
"summary": {
|
|
"msg": "Update received cert in RC '0', with resources 'asn: 1 blocks, v4: 1 blocks, v6: 1 blocks'",
|
|
"label": "cmd-ca-rcn-receive",
|
|
"args": {
|
|
"asn_blocks": "1",
|
|
"class_name": "0",
|
|
"ipv4_blocks": "1",
|
|
"ipv6_blocks": "1",
|
|
"resources": "asn: AS65000, v4: 10.0.0.0/8, v6: 2001:db8::/32"
|
|
}
|
|
},
|
|
"effect": {
|
|
"result": "success",
|
|
"events": [
|
|
5
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
|
|
|
|
The CLI and API support pagination:
|
|
|
|
.. parsed-literal::
|
|
--after <<RFC 3339 DateTime>> Show commands issued after date/time in RFC 3339 format, e.g. 2020-04-
|
|
09T19:37:02Z
|
|
--before <<RFC 3339 DateTime>> Show commands issued after date/time in RFC 3339 format, e.g. 2020-04-
|
|
09T19:37:02Z
|
|
--offset <<number>> Number of results to skip
|
|
--rows <<number>> Number of rows (max 250)
|
|
|
|
And these values are converted to path parameters in the API call:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc history commands --ca newca --after 2020-12-01T00:00:00Z --before 2021-04-09T00:00:00Z --rows 2 --offset 1 --api
|
|
GET:
|
|
https://localhost:3000/api/v1/cas/newca/history/commands/2/1/1606780800/1617926400
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
|
|
.. _cmd_krillc_history_details:
|
|
|
|
krillc history details
|
|
----------------------
|
|
|
|
Show details for a specific historic CA command. This subcommand expects the command
|
|
key as reported by :ref:`krillc history commands<cmd_krillc_history_commands>`.
|
|
|
|
The text output of the CLI will show a summary of the command details, and the state
|
|
changes in the CA (called events) that followed:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc history details --ca newca --key command--1617875604--3--cmd-ca-parent-entitlements
|
|
Time: 2021-04-08T09:53:24Z
|
|
Action: Update entitlements under parent 'my_parent': 0 => asn: AS65000, v4: 10.0.0.0/8, v6: 2001:db8::/32
|
|
Changes:
|
|
added resource class with name '0'
|
|
requested certificate for key (hash) '16B31C92EB116BC60026C50944AD44205DD9ACBD' under resource class '0'
|
|
|
|
|
|
If you want to see the full details, then have a look at the JSON response instead:
|
|
|
|
.. code-block:: json
|
|
|
|
{
|
|
"command": {
|
|
"actor": "krill",
|
|
"time": "2021-04-08T09:53:24.550017Z",
|
|
"handle": "newca",
|
|
"version": 3,
|
|
"sequence": 3,
|
|
"details": {
|
|
"type": "update_resource_entitlements",
|
|
"parent": "my_parent",
|
|
"entitlements": [
|
|
{
|
|
"resource_class_name": "0",
|
|
"resources": {
|
|
"asn": "AS65000",
|
|
"ipv4": "10.0.0.0/8",
|
|
"ipv6": "2001:db8::/32"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"effect": {
|
|
"result": "success",
|
|
"events": [
|
|
3,
|
|
4
|
|
]
|
|
}
|
|
},
|
|
"result": {
|
|
"Events": [
|
|
{
|
|
"id": "newca",
|
|
"version": 3,
|
|
"details": {
|
|
"type": "resource_class_added",
|
|
"resource_class_name": "0",
|
|
"parent": "my_parent",
|
|
"parent_resource_class_name": "0",
|
|
"pending_key": "16B31C92EB116BC60026C50944AD44205DD9ACBD"
|
|
}
|
|
},
|
|
{
|
|
"id": "newca",
|
|
"version": 4,
|
|
"details": {
|
|
"type": "certificate_requested",
|
|
"resource_class_name": "0",
|
|
"req": {
|
|
"class_name": "0",
|
|
"limit": {
|
|
"asn": "none",
|
|
"ipv4": "none",
|
|
"ipv6": "none"
|
|
},
|
|
"csr": "MIIDjzCCAncCAQAwMzExMC8GA1UEAxMoMTZCMzFDOTJFQjExNkJDNjAwMjZDNTA5NDRBRDQ0MjA1REQ5QUNCRDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOwGi4ZYQ+FaD5exEMZnK4UsM+IgTHLunhvduM08F8d5KocJ47CJUhVLbGIgAY7Y0Fy/6EvY4Uo0ICel3vWE5cwE1db/s4c3xNTpysi7X/DWCR/pQJcWu/6mhb0QkecuicxrhkUtIWy9AAIgZSnEi6JCNpJgWW1Ntv6jZz0pagqxfSRmq3nM6uAA/xyR7xIUYd2qp6c8idcpODKyz2QKz2kW0yToEhroqNG+oVVkh/rEbnfK0ncmqwaO8SjyqgdjGS+Qy1uOGOWZbT3uLoN4LXbjVfdIbrgNIyTUI2/XG3kxJe5svNY4P7aUsh3+eCqXg5XRsuRtvrcn/bpzwVk5OFkCAwEAAaCCARUwggERBgkqhkiG9w0BCQ4xggECMIH/MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMIHbBggrBgEFBQcBCwEBAASByzCByDAvBggrBgEFBQcwBYYjcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9sb2NhbG5hbWUvMC8wWwYIKwYBBQUHMAqGT3JzeW5jOi8vbG9jYWxob3N0L3JlcG8vbG9jYWxuYW1lLzAvMTZCMzFDOTJFQjExNkJDNjAwMjZDNTA5NDRBRDQ0MjA1REQ5QUNCRC5tZnQwOAYIKwYBBQUHMA2GLGh0dHBzOi8vbG9jYWxob3N0OjMwMDAvcnJkcC9ub3RpZmljYXRpb24ueG1sMA0GCSqGSIb3DQEBCwUAA4IBAQBFxEkEqMOnNWuIZalQkX/hxjAia3vtLrYtET1InOF/5UtRClDX5EWl34JRCXEIkDgWWbCVmxQyTw0VfqKImT/JqzC/NXrWMJBVJ27JgkHH5TITHGgfIjDRS19+JOFdiCBlQWgU3V5zfMGlB0263xRteX7A1kLedLuvt51DgNMwyWFgp/PkJKUCTEYi27j6DOF5J8jZ7JD5lMBs7gOGAiUJSzCBY7XfjEeVmePRLJ8hB0Wa/n3h+ni6UTOF6itKPmHqddxpiEb8ij987gCTjuZQisi9j+JKoPqzXon2vOx+GJjo4Sb++HD0buatiEmj5SvUmV8gl0F/msh4F4a5YG8r"
|
|
},
|
|
"ki": "16B31C92EB116BC60026C50944AD44205DD9ACBD"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
|
|
|
|
Example API call:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc history details --ca newca --key command--1617875604--3--cmd-ca-parent-entitlements --api
|
|
GET:
|
|
https://localhost:3000/api/v1/cas/newca/history/details/command--1617875604--3--cmd-ca-parent-entitlements
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
....
|
|
|
|
.. _cmd_krillc_roas:
|
|
|
|
krillc roas
|
|
-----------
|
|
|
|
Manage ROAs for your CA.
|
|
|
|
Krill lets users create Route Origin Authorisations (ROAs), the signed objects
|
|
that state which Autonomous System (AS) is authorised to originate one of your
|
|
prefixes, along with the maximum prefix length it may have.
|
|
|
|
Note that we use a Krill specific notation for desscribing ROAs.
|
|
|
|
.. code-block::
|
|
|
|
<prefix>[-max-length] => <ASN> [# optional comment]
|
|
|
|
Examples:
|
|
185.49.140.0/22 => 65501
|
|
185.49.140.0/22 => 65501 # with comment
|
|
185.49.140.0/22-22 => 65501 # with explicit max length equal to prefix length
|
|
185.49.140.0/22-24 => 65501 # with max length allowing more specifics
|
|
|
|
.. Important:: Krill CAs let operators configure which authorizations they want
|
|
to have on ROA **objects**. But it's Krill that will figure out which objects
|
|
to create for this. I.e. users just configure their intent to authorise an
|
|
ASN to originate a prefix, but they do not need to worry about things like
|
|
the actual ROA encoding, before and after times, object renewals, publishing,
|
|
and under which parent the ROA is to be created - if there are multiple.
|
|
However, we will refer to these authorizations as ROAs, because for all intent
|
|
and purposes this difference is an implementation detail that Krill, by design,
|
|
abstracts away from the operator.
|
|
|
|
|
|
|
|
.. parsed-literal::
|
|
|
|
USAGE:
|
|
krillc roas [SUBCOMMAND]
|
|
|
|
SUBCOMMANDS:
|
|
:ref:`list<cmd_krillc_roas_list>` Show current authorizations
|
|
:ref:`update<cmd_krillc_roas_update>` Update authorizations
|
|
:ref:`bgp<cmd_krillc_roas_bgp>` Show current authorizations in relation to known announcements
|
|
|
|
.. _cmd_krillc_roas_list:
|
|
|
|
krillc roas list
|
|
----------------
|
|
|
|
Show current configured ROAs.
|
|
|
|
.. parsed-literal::
|
|
|
|
USAGE:
|
|
krillc roas list [FLAGS] [OPTIONS]
|
|
|
|
OPTIONS:
|
|
-c, --ca <name> The name of the CA you wish to control. Or set env: KRILL_CLI_MY_CA
|
|
|
|
The text output shows all your current ROA configurations:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ krillc roas list
|
|
185.49.140.0/22-22 => 65501
|
|
2a04:b900::/29-29 => 65503 # my v6 router
|
|
185.49.140.0/22-22 => 65502 # my secondary!!
|
|
|
|
The JSON response also includes information about the ROA objects that
|
|
were issued for each of your configurations. Typically, you will have
|
|
exactly one ROA object issued for each configuration. However, you may
|
|
have more than one ROA object in case your CA holds the same prefix under
|
|
more than one parent organisation - this should be extremely rare but
|
|
this can happen in theory. You may have 0 ROA objects in case you added
|
|
a ROA *configuration*, but you no longer hold the prefix on your CA
|
|
certificate(s).
|
|
|
|
Because of this the JSON response includes an array of ROA objects rather
|
|
than a single object:
|
|
|
|
.. code-block:: json
|
|
|
|
[
|
|
{
|
|
"asn": 65502,
|
|
"prefix": "185.49.140.0/22",
|
|
"max_length": 22,
|
|
"comment": "my secondary!!",
|
|
"roa_objects": [
|
|
{
|
|
"authorizations": [
|
|
"185.49.140.0/22-22 => 65502"
|
|
],
|
|
"validity": {
|
|
"not_before": "2022-09-09T11:12:07.726607Z",
|
|
"not_after": "2023-09-08T11:17:07.726609Z"
|
|
},
|
|
"serial": "128656053576697823461520414002914294079408872181",
|
|
"uri": "rsync://localhost/repo/ca/0/3138352e34392e3134302e302f32322d3232203d3e203635353032.roa",
|
|
"base64": "MIIGxgYJKoZIhvcNAQcCoIIGtzCCBrMCAQMxDTALBglghkgBZQMEAgEwKgYLKoZIhvcNAQkQARigGwQZMBcCAwD/3jAQMA4EAgABMAgwBgMEArkxjKCCBMMwggS/MIIDp6ADAgECAhQWiSMQcj0WabA0/uwNQqQu5PCa9TANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhDQzI0ODdDRjNBOUM3NzRCRkFFMkRDRTRERDgzNjg0NDFDNzVDNzIwMB4XDTIyMDkwOTExMTIwN1oXDTIzMDkwODExMTcwN1owMzExMC8GA1UEAxMoQjcxODRCMjZGMjJFMTQxQ0QyQzFDRDM3QzJCRjg0Qzc0NTEwODg0MzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMz5gS4RE2gWak6+C8wNJQckJK3iLf6x309WmTGPCe1SxnRc9mqxUxshpzAKgPKWqXpzsKUidTnAnQZzKlJeOnn/bMPcM5Kh3PSsD8ZPVGFVqN1YHE/1Y4kdWXyPMQThBh+sR2JHOspmMVz773bNouswV8o2MFNSQY0ODsntalya9dCnrKQ9eJ+hquADSVTvNq7bQ7VjtLIq0SfEMRZ3xZjce/QaOGRNaOpObD7DUUygixUQpIZGtsDsQTPPOIIiCqkQzYaykE3HGwcMIu/xoeCQTDIBCETQWAvl8l91y/dDTqlCM6pDRvDE0h1AXWp5+N4u4bzAb6h+r9fkOFZQAo8CAwEAAaOCAckwggHFMB0GA1UdDgQWBBS3GEsm8i4UHNLBzTfCv4THRRCIQzAfBgNVHSMEGDAWgBTMJIfPOpx3S/ri3OTdg2hEHHXHIDAOBgNVHQ8BAf8EBAMCB4AwWQYDVR0fBFIwUDBOoEygSoZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wL0NDMjQ4N0NGM0E5Qzc3NEJGQUUyRENFNEREODM2ODQ0MUM3NUM3MjAuY3JsMGkGCCsGAQUFBwEBBF0wWzBZBggrBgEFBQcwAoZNcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90ZXN0YmVkLzAvQ0MyNDg3Q0YzQTlDNzc0QkZBRTJEQ0U0REQ4MzY4NDQxQzc1QzcyMC5jZXIwcgYIKwYBBQUHAQsEZjBkMGIGCCsGAQUFBzALhlZyc3luYzovL2xvY2FsaG9zdC9yZXBvL2NhLzAvMzEzODM1MmUzNDM5MmUzMTM0MzAyZTMwMmYzMjMyMmQzMjMyMjAzZDNlMjAzNjM1MzUzMDMyLnJvYTAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMB8GCCsGAQUFBwEHAQH/BBAwDjAMBAIAATAGAwQCuTGMMA0GCSqGSIb3DQEBCwUAA4IBAQBAWJ1E4zrF8xF/QFdJkVNDIoUwaVGxM8VFz8mh+KhDYzpGQEgGVcvNmsiGEXXJ4TkCfICinMEh88EhP/5kx0sE5dzaIxKdh+r6aoeIhSH3iKGYH1+ZDQ3dC1TiJSqDnK6wrs62A7R/oCOq1R9h6cqZ0GzIgJyG80Z9j1QleaS3evPuuSCgOls2MPlk68LR4Pn+rUwt7NVaDwXwXon0+QasB9mkjHa3mT1KP2OaZTsqcjTIy/Fdhxupi52+WEfNXYkQbr4sTIPKBoQD8JMa96DeZQtUlj/U7CbKR/jAaWmIevcUjw8u50k1o7UVaCxsaYETp2So1npX9bFBqJ6wCuo6MYIBqjCCAaYCAQOAFLcYSybyLhQc0sHNN8K/hMdFEIhDMAsGCWCGSAFlAwQCAaBrMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABGDAcBgkqhkiG9w0BCQUxDxcNMjIwOTA5MTExNzA3WjAvBgkqhkiG9w0BCQQxIgQgb9OF51MA1l9ozTu3fsFGvz5KTdJmXLfr7OwirJ8NaTcwDQYJKoZIhvcNAQEBBQAEggEAN6SjlxmS9rgnbAV74xP7rvYhfyiIV9GTVApeojXg96xUej7AIuxYxTN/dHhTb00n4a2Xt2WYeJCu31x9n+Liib/wqSDut5zYJuZacl7gtPqiGAcckUesWyD6GORr65wXvMne7WxaZS2ud5eluLyoQPwzbnuJWdgm2zvqiLYFyBnc7K93eYoSRy16GxGNJjYke3XUY0w4mafF4w/f8v5obZmnNRb465/IBgAWpWJfsq49bCT6+ayiwAZ/ld6tKT/Bdmjw5mhA6ukWvVeO3+xB3t0mzgJEHHABvlvHK7dmZyzXUYbSkPzgS85WiLF+NsVmcBCzCci1cePDc00uDQHb5A==",
|
|
"hash": "a5eb7f117a920f938cfee05294284e8107b0f2b4eb33306b44c0e0a4321f0730"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"asn": 65501,
|
|
"prefix": "185.49.140.0/22",
|
|
"max_length": 22,
|
|
"comment": null,
|
|
"roa_objects": [
|
|
{
|
|
"authorizations": [
|
|
"185.49.140.0/22-22 => 65501"
|
|
],
|
|
"validity": {
|
|
"not_before": "2022-09-09T11:12:07.804941Z",
|
|
"not_after": "2023-09-08T11:17:07.804943Z"
|
|
},
|
|
"serial": "383786375903727552044603555364114288366864376546",
|
|
"uri": "rsync://localhost/repo/ca/0/3138352e34392e3134302e302f32322d3232203d3e203635353031.roa",
|
|
"base64": "MIIGxgYJKoZIhvcNAQcCoIIGtzCCBrMCAQMxDTALBglghkgBZQMEAgEwKgYLKoZIhvcNAQkQARigGwQZMBcCAwD/3TAQMA4EAgABMAgwBgMEArkxjKCCBMMwggS/MIIDp6ADAgECAhRDOZOH/lR61pBf5m5TfgO3xvki4jANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhDQzI0ODdDRjNBOUM3NzRCRkFFMkRDRTRERDgzNjg0NDFDNzVDNzIwMB4XDTIyMDkwOTExMTIwN1oXDTIzMDkwODExMTcwN1owMzExMC8GA1UEAxMoM0U0QkZCRTc4NzE3MEVBRUY3RjNENjEwNDVDREU1MzI5MkUwRTM1QzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM2Fy1EHceCn67Pffm9chgDHr9s8RyIM9KTbHqixjcoAqq4FwHMU2JGui/9VtMvMKYz8lpBB7dggKM+cYKDrX6HDN2QtXDi9PqX5uaESb0dKR1FnBgnBep97wvjkkmDCHM9Y1mvVaZIyIy5hwlKtbG6/5SS3o858QLppiLnyzWfdZw+/rODvSYUtU0IlsKZAlG3VrSyXWjeWbEf+CLb8ylOu68zR6gaWzKgkYPKR0pKaVDrguM2T1owzvrrpmX9zXUFpR69pYNPrX1PYqLX/z3X3OpXNdkDjsBb2Dmg8ESDH267VRqTCvtlvClz6/7ZaA3I4bonQaG4f92R0ns21PdMCAwEAAaOCAckwggHFMB0GA1UdDgQWBBQ+S/vnhxcOrvfz1hBFzeUykuDjXDAfBgNVHSMEGDAWgBTMJIfPOpx3S/ri3OTdg2hEHHXHIDAOBgNVHQ8BAf8EBAMCB4AwWQYDVR0fBFIwUDBOoEygSoZIcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wL0NDMjQ4N0NGM0E5Qzc3NEJGQUUyRENFNEREODM2ODQ0MUM3NUM3MjAuY3JsMGkGCCsGAQUFBwEBBF0wWzBZBggrBgEFBQcwAoZNcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby90ZXN0YmVkLzAvQ0MyNDg3Q0YzQTlDNzc0QkZBRTJEQ0U0REQ4MzY4NDQxQzc1QzcyMC5jZXIwcgYIKwYBBQUHAQsEZjBkMGIGCCsGAQUFBzALhlZyc3luYzovL2xvY2FsaG9zdC9yZXBvL2NhLzAvMzEzODM1MmUzNDM5MmUzMTM0MzAyZTMwMmYzMjMyMmQzMjMyMjAzZDNlMjAzNjM1MzUzMDMxLnJvYTAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMB8GCCsGAQUFBwEHAQH/BBAwDjAMBAIAATAGAwQCuTGMMA0GCSqGSIb3DQEBCwUAA4IBAQANSR1pMhLY4LXSirIv3zMBr6lWwWVRV2WETeBkbP4YsFbqaHQTJBppTVcr6E3ny3hzYEZnjjcB8EiqeLcM/UZ3+whciQ1emSbdhxETbg4YcLOCscswMRP8SJxgfBsIeq1Co73hjrj22vMVOlQMb0xwYDILD7pwdiFi25GTvqsM/8obCpfJ8BFDvoqLVeZgD3EvHtlqxmnve7HFn4/lW6D/bHteUG1bv2aNZ8E88DTQJa0M6o3mcqhMkMuHXOam5MPe8ST28pbwlolrwCbtd+HwUTiuPuvPJYYV5l05S+EgUJ8f7zZtdJ0y1gu3NyANf0gRNTxSgTY8Tytqp4sexG8NMYIBqjCCAaYCAQOAFD5L++eHFw6u9/PWEEXN5TKS4ONcMAsGCWCGSAFlAwQCAaBrMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABGDAcBgkqhkiG9w0BCQUxDxcNMjIwOTA5MTExNzA3WjAvBgkqhkiG9w0BCQQxIgQgAh9E+dmDxlYGw+FsCrNpOG9MSFeCW0XDR4xAPbROyOYwDQYJKoZIhvcNAQEBBQAEggEAW7jgMst/ra42AhF0+oGRDmD71I41QdA6Q5ZIQIhWT3k11BJXpZL3P9beWMYLS6NlqcQtY+sgr3oBuofjBzuwi47r0ZieLKEvzzuOtT8xu9ffh7uRBWa/e11lMZmRxN3X/wwiN3p/9DRJMesDcQ7SrRYFOTB0bRfjEUWeVnqH1mgy4Qx7jxOCD/BWJ6cKVNLgWl/zorqgU9XfxuIzsnzwzmvT6U0MY+VHwBVc3giFTTRxcpzp9TMV/DYJk2XNCR7KFtGlAB07g5D2iEEQcAs4gIFJu3Hhesm4Nn2UXb6f0lKrI80uFaJwavY//9jauWMiOetTWNGtj/yMzRPIvwGhkg==",
|
|
"hash": "b84e4a840bfa171c22836be8b9918a1a85da1f1578fa168a4cf598f73adf9d01"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"asn": 65503,
|
|
"prefix": "2a04:b900::/29",
|
|
"max_length": 29,
|
|
"comment": "my v6 router",
|
|
"roa_objects": [
|
|
{
|
|
"authorizations": [
|
|
"2a04:b900::/29-29 => 65503"
|
|
],
|
|
"validity": {
|
|
"not_before": "2022-09-09T11:12:07.764079Z",
|
|
"not_after": "2023-09-08T11:17:07.764081Z"
|
|
},
|
|
"serial": "725767789577338305707073298821075818220425658157",
|
|
"uri": "rsync://localhost/repo/ca/0/326130343a623930303a3a2f32392d3239203d3e203635353033.roa",
|
|
"base64": "MIIGxgYJKoZIhvcNAQcCoIIGtzCCBrMCAQMxDTALBglghkgBZQMEAgEwKwYLKoZIhvcNAQkQARigHAQaMBgCAwD/3zARMA8EAgACMAkwBwMFAyoEuQCgggTCMIIEvjCCA6agAwIBAgIUfyCNoaRxBo0L8TDM3oYpk+rtPy0wDQYJKoZIhvcNAQELBQAwMzExMC8GA1UEAxMoQ0MyNDg3Q0YzQTlDNzc0QkZBRTJEQ0U0REQ4MzY4NDQxQzc1QzcyMDAeFw0yMjA5MDkxMTEyMDdaFw0yMzA5MDgxMTE3MDdaMDMxMTAvBgNVBAMTKDdGRkU0MDZDQTM0QURDMjdEQTdBMkVGQ0RDMkQ2QThGMzI5OTI2MTQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0HIIJJlCBsTicJBHris5xy3Vrq8KRle9MyAZOJgbjojiccCw2a+M50oMEdXk2KRooKSOVdcxEi1jQ1h2nZo6AKTIbxSngRWVLhIA9UBIIxX4aIl6z2llHbx0PGS06KurV6Vcr+3LntLqwxY0ID7q0/Dt9dL9yZGHF7vt9dDPPNjbzrwE1hVfo9LomhPW/skh5dOrcge75PJZjmy0CSKFasEt4veEfDcjFGxnE1MWhh2JhVOGwMY5/IG1e12izhpsy1csRldUT4a1vrjKmu/tkgr1hk5+5JTg6FinAd8cva5xyyhfwcgZ2BJiwbUCpqPumC/VoLGQJo83mDRJb1lEFAgMBAAGjggHIMIIBxDAdBgNVHQ4EFgQUf/5AbKNK3Cfaei783C1qjzKZJhQwHwYDVR0jBBgwFoAUzCSHzzqcd0v64tzk3YNoRBx1xyAwDgYDVR0PAQH/BAQDAgeAMFkGA1UdHwRSMFAwTqBMoEqGSHJzeW5jOi8vbG9jYWxob3N0L3JlcG8vY2EvMC9DQzI0ODdDRjNBOUM3NzRCRkFFMkRDRTRERDgzNjg0NDFDNzVDNzIwLmNybDBpBggrBgEFBQcBAQRdMFswWQYIKwYBBQUHMAKGTXJzeW5jOi8vbG9jYWxob3N0L3JlcG8vdGVzdGJlZC8wL0NDMjQ4N0NGM0E5Qzc3NEJGQUUyRENFNEREODM2ODQ0MUM3NUM3MjAuY2VyMHAGCCsGAQUFBwELBGQwYjBgBggrBgEFBQcwC4ZUcnN5bmM6Ly9sb2NhbGhvc3QvcmVwby9jYS8wLzMyNjEzMDM0M2E2MjM5MzAzMDNhM2EyZjMyMzkyZDMyMzkyMDNkM2UyMDM2MzUzNTMwMzMucm9hMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwIAYIKwYBBQUHAQcBAf8EETAPMA0EAgACMAcDBQMqBLkAMA0GCSqGSIb3DQEBCwUAA4IBAQBEAKtyFG7RrQ8QxYeOjgZ9WWKvmnQFWXHZcOtR5Z9TcIwwDB8K/Ep2vPpyvJ23q/gaepwo2VMC2bt84jYkTWGTeKKqd3pCn3dOs17NldEmBU9etH8oMoRH0XcaSI6bSN56nu4PlCUgs5Qt9bl8qnDMLwtr9W530K9y6htfRV/0Goleg9J8kPJf32SNNKIos60LHY2zb4TJ9JVdnEC++tku0w7AbdhvaU37ekAIuGC+YeH/KHMcVln1+bx8y9CKDxsVmtqjzfE8c4WIoyWnbtwy2PbLcUWcRMDcJoCllXxryUea59lXw103WdskR70vCPGT6eIUfPw8msRdnW5xNCtgMYIBqjCCAaYCAQOAFH/+QGyjStwn2nou/Nwtao8ymSYUMAsGCWCGSAFlAwQCAaBrMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABGDAcBgkqhkiG9w0BCQUxDxcNMjIwOTA5MTExNzA3WjAvBgkqhkiG9w0BCQQxIgQgrRdT14e2Dt+cfcphbSqTaWtKqpG4MmSQ5MCwdfzr+IowDQYJKoZIhvcNAQEBBQAEggEATGhF9lUpgNa8jInLpnTd9yW8nfdEtWtkH8yTGNm1TdbEN0VCUgWDEeKZEbU4c0tshMF8DWDPT1iwNauyf0rgEOvJZypeDrEhgdRaJSOGnfJZGz+oi5o4hwn4GI3Xv2ByZ9eVUTrhuyDr0+Tml/Cym7j9FUv5APObQ2LnHjr3paGHitJff+5V8NVr5FC39oF4weXQyqvXOTo7t3iuv5Fp+jPgwtUpl5qO3Ene44EAzrqLMaEj7vr62KVFVGX826jak/mEt+X9zS1G+FNGKF9WmPJGcRv39SfJzMfDg3ASUjCyHbqa1dntlqzfb8pEMdB7+QT/c6bUfjt6aTB2gVsliA==",
|
|
"hash": "f35bd38a7cdec57faa9df7a76bb5b98c61b09385f25cd89b43e33973e70e0560"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
|
|
|
|
.. Important:: Krill always uses an explicit max length for stored ROA configurations.
|
|
You can leave out the max length when submitting a new ROA configuration, but
|
|
Krill will then convert it to use an explicit max length equal to the prefix
|
|
length internally. The reason behind this is that Krill wants to avoid duplicate
|
|
equivalent entries in its configuration. The ROA *objects* generated by Krill
|
|
will only use an explicit max length if it is indeed more specific than the
|
|
prefix length.
|
|
|
|
|
|
.. _cmd_krillc_roas_update:
|
|
|
|
krillc roas update
|
|
------------------
|
|
|
|
Update ROAs.
|
|
|
|
The CLI supports adding or removing individual ROAs as well as submitting a file
|
|
with a delta of additions and removals as an atomic delta. In terms of the API these
|
|
options will call the same API end-point and always submit a JSON body with a delta.
|
|
|
|
* Add a single ROA
|
|
|
|
Example CLI usage to add a ROA:
|
|
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc roas update --add '2a04:b900::/29 => 65503 # my v6 router'
|
|
|
|
|
|
This will submit the following JSON to the API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc roas update --add "192.168.0.0/16 => 64496" --api
|
|
POST:
|
|
https://localhost:3000/api/v1/cas/ca/routes
|
|
Headers:
|
|
content-type: application/json
|
|
Authorization: Bearer secret
|
|
Body:
|
|
{
|
|
"added": [
|
|
{
|
|
"asn": 65503,
|
|
"prefix": "2a04:b900::/29",
|
|
"comment": "my v6 router"
|
|
}
|
|
],
|
|
"removed": []
|
|
}
|
|
|
|
NOTE: if you want to leave out the comment in the API update
|
|
you can either set its value to `null` or leave the json field
|
|
out altogether in which case it will default to `null`.
|
|
|
|
.. Important:: ROA configurations can only be added if they are
|
|
not yet present. Re-adding the same configuration will
|
|
result in an error. That said, if an
|
|
|
|
|
|
* Remove a single ROA
|
|
|
|
Example CLI usage to remove a ROA:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc roas update --remove '2a04:b900::/29 => 65503'
|
|
|
|
.. Important:: The # style comments are not allowed when
|
|
removing ROAs and will result in an error if included
|
|
here.
|
|
|
|
|
|
This will submit the following JSON to the API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc roas update --remove '2a04:b900::/29 => 65503' --api
|
|
POST:
|
|
https://localhost:3000/api/v1/cas/ca/routes
|
|
Headers:
|
|
content-type: application/json
|
|
Authorization: Bearer secret
|
|
Body:
|
|
{
|
|
"added": [],
|
|
"removed": [
|
|
{
|
|
"asn": 65503,
|
|
"prefix": "2a04:b900::/29"
|
|
}
|
|
]
|
|
}
|
|
|
|
|
|
|
|
* Update multiple ROAs
|
|
|
|
You can also update multiple ROAs as a single delta. You can either
|
|
use multiple `--add` and/or `--remove` arguments, or you can use
|
|
`--delta` and refer to a file with all updates using the following
|
|
format:
|
|
|
|
.. code-block:: text
|
|
|
|
# Some comment
|
|
# Indented comment
|
|
|
|
A: 10.0.0.0/24 => 64496
|
|
A: 10.1.0.0/16-20 => 64496 # Add prefix with max length
|
|
R: 10.0.3.0/24 => 64496 # Remove existing authorization
|
|
|
|
And then call the CLI with the ``--delta`` option. The CLI will parse the delta file
|
|
and submit a JSON body containing multiple changes:
|
|
|
|
|
|
.. code-block:: text
|
|
|
|
krillc roas update --delta ./data/roa-delta.txt --ca newca --api
|
|
POST:
|
|
https://localhost:3000/api/v1/cas/newca/routes
|
|
Headers:
|
|
content-type: application/json
|
|
Authorization: Bearer secret
|
|
Body:
|
|
{
|
|
"added": [
|
|
{
|
|
"asn": 64496,
|
|
"prefix": "10.0.0.0/24"
|
|
},
|
|
{
|
|
"asn": 64496,
|
|
"prefix": "10.1.0.0/16",
|
|
"max_length": 20
|
|
}
|
|
],
|
|
"removed": [
|
|
{
|
|
"asn": 64496,
|
|
"prefix": "10.0.3.0/24"
|
|
}
|
|
]
|
|
}
|
|
|
|
* Errors
|
|
|
|
You will get an error response if ROA updates cannot be applied. For
|
|
example adding a duplicate ROA will result in the following error:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc roas update --ca newca --add "192.168.0.0/16 => 64496"
|
|
Delta rejected:
|
|
|
|
Cannot add the following duplicate ROAs:
|
|
192.168.0.0/16-16 => 64496
|
|
|
|
The returned JSON for an error with with the label "ca-roa-delta-error" has a format similar
|
|
to the normal error response, but with the addition of a `delta_error` entry with details. There
|
|
you can expect 4 categories of errors:
|
|
|
|
+----------------+------------------------------------------------------------------+
|
|
| duplicates | You are trying to add a ROA that already exists |
|
|
+----------------+------------------------------------------------------------------+
|
|
| notheld | You are trying to add a ROA for a prefix you don't hold |
|
|
+----------------+------------------------------------------------------------------+
|
|
| unknowns | You are trying to remove a ROA that does not exist |
|
|
+----------------+------------------------------------------------------------------+
|
|
| invalid_length | You specified an invalid length/max_length for a prefix |
|
|
+----------------+------------------------------------------------------------------+
|
|
|
|
Example:
|
|
|
|
.. code-block:: json
|
|
|
|
{
|
|
"label": "ca-roa-delta-error",
|
|
"msg": "Delta rejected, see included json",
|
|
"args": {},
|
|
"delta_error": {
|
|
"duplicates": [
|
|
{
|
|
"asn": 1,
|
|
"prefix": "10.0.0.0/20",
|
|
"max_length": 24,
|
|
"comment": null
|
|
}
|
|
],
|
|
"notheld": [
|
|
{
|
|
"asn": 1,
|
|
"prefix": "10.128.0.0/9"
|
|
}
|
|
],
|
|
"unknowns": [
|
|
{
|
|
"asn": 1,
|
|
"prefix": "192.168.0.0/16",
|
|
"comment": null
|
|
}
|
|
],
|
|
"invalid_length": [
|
|
{
|
|
"asn": 1,
|
|
"prefix": "10.0.1.0/25",
|
|
"comment": null
|
|
}
|
|
]
|
|
}
|
|
}
|
|
|
|
|
|
* Try
|
|
|
|
With RPKI ROAs you can create RPKI invalids in BGP if for example your prefix is multi homed
|
|
and you authorise one ASN, but not another. Another cause of invalids might be that you authorise
|
|
a covering prefix, but not more specific announcements that you do.
|
|
|
|
To help with this Krill also comes with a "try", or "feeling lucky" feature. Meaning that when
|
|
``--try`` is specified with an update, Krill will check the effect of the update against what it
|
|
knows about BGP announcements. If the effect has no negative side-effects then it will just be
|
|
applied, but if it would result in any invalid announcements then an error report will be
|
|
returned instead:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc roas update --ca newca --add "192.168.0.0/16 => 64496" --try
|
|
Unsafe update, please review
|
|
|
|
Effect would leave the following invalids:
|
|
|
|
Announcements from invalid ASNs:
|
|
192.168.0.0/24 => 64497
|
|
|
|
192.168.1.0/24 => 64497
|
|
|
|
|
|
Announcements too specific for their ASNs:
|
|
|
|
192.168.0.0/24 => 64496
|
|
|
|
You may want to consider this alternative:
|
|
Authorize these announcements which are currently not covered:
|
|
192.168.0.0/24 => 64496
|
|
192.168.0.0/24 => 64497
|
|
192.168.1.0/24 => 64497
|
|
|
|
Example JSON response:
|
|
|
|
.. code-block:: json
|
|
|
|
{
|
|
"effect": [
|
|
{
|
|
"asn": 64496,
|
|
"prefix": "192.168.0.0/16",
|
|
"max_length": 16,
|
|
"state": "roa_disallowing",
|
|
"comment": null,
|
|
"roa_objects": [ ... ],
|
|
"disallows": [
|
|
{
|
|
"asn": 64496,
|
|
"prefix": "192.168.0.0/24"
|
|
},
|
|
{
|
|
"asn": 64497,
|
|
"prefix": "192.168.0.0/24"
|
|
},
|
|
{
|
|
"asn": 64497,
|
|
"prefix": "192.168.1.0/24"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"asn": 64496,
|
|
"prefix": "192.168.0.0/24",
|
|
"state": "announcement_invalid_length",
|
|
"disallowed_by": [
|
|
{
|
|
"asn": 64496,
|
|
"prefix": "192.168.0.0/16",
|
|
"max_length": 16
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"asn": 64497,
|
|
"prefix": "192.168.0.0/24",
|
|
"state": "announcement_invalid_asn",
|
|
"disallowed_by": [
|
|
{
|
|
"asn": 64496,
|
|
"prefix": "192.168.0.0/16",
|
|
"max_length": 16
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"asn": 64497,
|
|
"prefix": "192.168.1.0/24",
|
|
"state": "announcement_invalid_asn",
|
|
"disallowed_by": [
|
|
{
|
|
"asn": 64496,
|
|
"prefix": "192.168.0.0/16",
|
|
"max_length": 16
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"suggestion": {
|
|
"not_found": [
|
|
{
|
|
"asn": 64496,
|
|
"prefix": "192.168.0.0/24"
|
|
},
|
|
{
|
|
"asn": 64497,
|
|
"prefix": "192.168.0.0/24"
|
|
},
|
|
{
|
|
"asn": 64497,
|
|
"prefix": "192.168.1.0/24"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
|
|
|
|
The API call for this is the same as when posting a normal ROA delta, except that `/try` is
|
|
appended to the path, e.g.: `POST https://localhost:3000/api/v1/cas/newca/routes/try`
|
|
|
|
.. Important:: Krill does this analysis based on RIPE RIS BGP information. This information
|
|
may be outdated, or incomplete. More importantly it may also include erroneous or even
|
|
malicious announcements that are seen in the global BGP. So **ALWAYS** review the report
|
|
and suggestions returned by Krill! Note, we plan to support other ways of getting BGP
|
|
information into Krill in future - e.g. by parsing a local BGP feed or table.
|
|
|
|
* Dryrun
|
|
|
|
The ``dryrun`` option is similar to ``try``, except that, well, it doesn't even try to apply
|
|
a change. It just reports the effects of a change including positive effects.. so, actually,
|
|
it *is* different:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc roas update --ca newca --add "10.0.0.0/24 => 64496" --dryrun
|
|
Authorizations covering announcements seen:
|
|
|
|
Definition: 10.0.0.0/24-24 => 64496
|
|
|
|
Authorizes:
|
|
10.0.0.0/24 => 64496
|
|
|
|
Announcements which are valid:
|
|
|
|
Announcement: 10.0.0.0/24 => 64496
|
|
|
|
.. _cmd_krillc_roas_bgp:
|
|
|
|
krillc roas bgp
|
|
---------------
|
|
|
|
.. Important:: Krill does BGP analysis based on RIPE RIS BGP information. This information
|
|
may be outdated, or incomplete. More importantly it may also include erroneous or even
|
|
malicious announcements that are seen in the global BGP. So **ALWAYS** review the reports
|
|
and suggestions returned by Krill! Note, we plan to support other ways of getting BGP
|
|
information into Krill in future - e.g. by parsing a local BGP feed or table.
|
|
|
|
The ROA vs BGP analysis is used in the ``try`` and ``dryrun`` options when applying a
|
|
ROA delta, but this can also be accessed proactively. For this the CLI has the following
|
|
subcommands:
|
|
|
|
.. parsed-literal::
|
|
|
|
krillc roas bgp analyze Show full report of ROAs vs known BGP announcements
|
|
krillc roas bgp suggest Show ROA suggestions based on known BGP announcements
|
|
|
|
|
|
Example of the analyze function:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc roas bgp analyze --ca newca
|
|
Authorizations covering announcements seen:
|
|
|
|
Definition: 192.168.0.0/24-24 => 64496
|
|
|
|
Authorizes:
|
|
192.168.0.0/24 => 64496
|
|
|
|
Disallows:
|
|
192.168.0.0/24 => 64497
|
|
|
|
Authorizations disallowing announcements seen. You may want to use AS0 ROAs instead:
|
|
|
|
Definition: 192.168.0.0/16-16 => 64496
|
|
|
|
|
|
Disallows:
|
|
192.168.0.0/24 => 64497
|
|
192.168.1.0/24 => 64497
|
|
|
|
Announcements which are valid:
|
|
|
|
Announcement: 192.168.0.0/24 => 64496
|
|
|
|
Announcements from an unauthorized ASN:
|
|
|
|
Announcement: 192.168.0.0/24 => 64497
|
|
|
|
Disallowed by authorization(s):
|
|
192.168.0.0/16-16 => 64496
|
|
192.168.0.0/24-24 => 64496
|
|
|
|
Announcement: 192.168.1.0/24 => 64497
|
|
|
|
Disallowed by authorization(s):
|
|
192.168.0.0/16-16 => 64496
|
|
|
|
Announcements which are 'not found' (not covered by any of your authorizations):
|
|
|
|
Announcement: 10.0.0.0/21 => 64497
|
|
Announcement: 10.0.0.0/22 => 64496
|
|
Announcement: 10.0.0.0/22 => 64497
|
|
Announcement: 10.0.0.0/24 => 64496
|
|
Announcement: 10.0.2.0/23 => 64496
|
|
|
|
Example output of the "suggest" option:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc roas bgp suggest --ca newca
|
|
Remove the following ROAs which only disallow announcements (did you use the wrong ASN?), if this is intended you may want to use AS0 instead:
|
|
192.168.0.0/16-16 => 64496
|
|
|
|
Keep the following authorizations:
|
|
192.168.0.0/24-24 => 64496
|
|
|
|
Authorize these announcements which are currently not covered:
|
|
10.0.0.0/21 => 64497
|
|
10.0.0.0/22 => 64496
|
|
10.0.0.0/22 => 64497
|
|
10.0.0.0/24 => 64496
|
|
10.0.2.0/23 => 64496
|
|
|
|
Authorize these announcements which are currently invalid because they are not allowed for these ASNs:
|
|
192.168.0.0/24 => 64497
|
|
192.168.1.0/24 => 64497
|
|
|
|
....
|
|
|
|
|
|
.. _cmd_krillc_bgpsec:
|
|
|
|
krillc bgpsec
|
|
-------------
|
|
|
|
Manage BGPSec Router Certificates for your CA.
|
|
|
|
Krill lets users create :RFC:`8209` BGPSec Router Certificates. These
|
|
certificates are used in BGPSec to authorise a router key for an ASN
|
|
in the RPKI.
|
|
|
|
At the moment BGPSec deployment is virtually non-existent, so you are
|
|
unlikely to need this. However, this functionality is provided in the
|
|
hope that it will help the community gain operational experience that
|
|
may help BGPSec deployment.
|
|
|
|
Currently BGPSec Router Certificates can only be managed through the
|
|
API. If there is popular demand we will add this to the UI in future.
|
|
|
|
.. parsed-literal::
|
|
|
|
USAGE:
|
|
krillc bgpsec [SUBCOMMAND]
|
|
|
|
SUBCOMMANDS:
|
|
:ref:`list<cmd_krillc_bgpsec_list>` Show current BGPSec configurations
|
|
:ref:`add<cmd_krillc_bgpsec_add>` Add BGPSec configurations
|
|
:ref:`remove<cmd_krillc_bgpsec_remove>` Remove a BGPSec definition
|
|
|
|
|
|
.. _cmd_krillc_bgpsec_list:
|
|
|
|
krillc bgpsec list
|
|
------------------
|
|
|
|
Show the current BGPSec configurations.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ krillc bgpsec list
|
|
ASN, key identifier, CSR base64
|
|
AS211321, 17316903F0671229E8808BA8E8AB0105FA915A07, MIH.....
|
|
|
|
Example JSON response:
|
|
|
|
.. code-block:: json
|
|
|
|
[
|
|
{
|
|
"asn": 65000,
|
|
"key_identifier": "17316903F0671229E8808BA8E8AB0105FA915A07",
|
|
"csr": "MIH7...."
|
|
}
|
|
]
|
|
|
|
.. _cmd_krillc_bgpsec_add:
|
|
|
|
krillc bgpsec add
|
|
-----------------
|
|
|
|
Add a new BGPSec configurations. I.e. choose an ASN you hold and a
|
|
Certificate Sign Request (CSR) you got from your router so that Krill
|
|
can create a BGPSec Router Certificate for it.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: bash
|
|
|
|
$ krillc bgpsec add --asn AS65000 --csr ./router-csr.der
|
|
|
|
This will submit the following JSON to the API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc bgpsec add --asn AS65000 --csr ./router-csr.der --api
|
|
POST:
|
|
https://localhost:3000/api/v1/cas/local-testbed-child/bgpsec
|
|
Headers:
|
|
content-type: application/json
|
|
Authorization: Bearer secret
|
|
Body:
|
|
{
|
|
"add": [
|
|
{
|
|
"asn": 65000,
|
|
"csr": "MIH7MIGiAgEAMBoxGDAWBgNVBAMMD1JPVVRFUi0wMDAwM0NDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABE9dBTAcT+j96+mhvyAqX7JLae1+spSSGPCsnus5EITTrdMvnEc2J4B/DBs2N3Fzb2euM+AqWdtoH+LXsmxqvKOgJjAkBgkqhkiG9w0BCQ4xFzAVMBMGA1UdJQQMMAoGCCsGAQUFBwMeMAoGCCqGSM49BAMCA0gAMEUCIQCKJSWZeF7XHuHkFeAN7zOzhEgM+6WyaklaIo3J3lRPmgIgD9kPSO0AjVf1cEUnQrgC5D/5SMaUJ2hp3r8joKFq3hA="
|
|
}
|
|
],
|
|
"remove": []
|
|
}
|
|
|
|
|
|
.. _cmd_krillc_bgpsec_remove:
|
|
|
|
krillc bgpsec remove
|
|
--------------------
|
|
|
|
Note that Krill may actually create multiple BGPSec Router Certificates
|
|
based on the CSR *if* you hold the ASN multiple times. E.g. under
|
|
mutliple parents. In practice this is unlikely to happen, but this is
|
|
conceptually important when it comes to removal. You can remove any and
|
|
all BGPSec Router Certificate by asking Krill to remove the configuration
|
|
for a given ASN and router key identifier (as shown in the list command).
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc bgpsec remove --asn AS65000 --key 17316903F0671229E8808BA8E8AB0105FA915A07
|
|
|
|
This submits the following JSON to the API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc bgpsec remove --asn AS65000 --key 17316903F0671229E8808BA8E8AB0105FA915A07 --api
|
|
POST:
|
|
https://localhost:3000/api/v1/cas/local-testbed-child/bgpsec
|
|
Headers:
|
|
content-type: application/json
|
|
Authorization: Bearer secret
|
|
Body:
|
|
{
|
|
"add": [],
|
|
"remove": [
|
|
"ROUTER-00033979-17316903F0671229E8808BA8E8AB0105FA915A07"
|
|
]
|
|
}
|
|
|
|
Careful observers may have noticed that the API supports mutliple additions
|
|
and removals in a single update. However, such bulk changes are not yet
|
|
supported in the CLI.
|
|
|
|
|
|
.. _cmd_krillc_bulk:
|
|
|
|
krillc bulk
|
|
-----------
|
|
|
|
Manually trigger refresh/republish/resync for all CAs.
|
|
|
|
Normally there is no need to use these functions. Krill has background processes that
|
|
these functions run whenever they are needed. However, they may be useful in cases where
|
|
the connection between your CA(s) and their remote parents or repository may be broken
|
|
for example, and you want to debug the issue.
|
|
|
|
There are three "bulk" subcommands available:
|
|
|
|
.. parsed-literal::
|
|
|
|
USAGE:
|
|
krillc bulk [SUBCOMMAND]
|
|
|
|
SUBCOMMANDS:
|
|
:ref:`publish<cmd_krillc_bulk_publish>` Force that all CAs create new objects if needed (in which case they will also sync)
|
|
:ref:`refresh<cmd_krillc_bulk_refresh>` Force that all CAs ask their parents for updated certificates
|
|
:ref:`sync<cmd_krillc_bulk_sync>` Force that all CAs sync with their repo server
|
|
|
|
.. _cmd_krillc_bulk_publish:
|
|
|
|
krillc bulk publish
|
|
-------------------
|
|
|
|
Force that all CAs create new objects if needed (in which case they will also sync).
|
|
Note that this function is executed when Krill starts up and then again every 10
|
|
minutes.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc bulk publish
|
|
|
|
|
|
Example API call:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc bulk publish --api
|
|
POST:
|
|
https://localhost:3000/api/v1/bulk/cas/publish
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
Body:
|
|
<empty>
|
|
|
|
.. _cmd_krillc_bulk_refresh:
|
|
|
|
krillc bulk refresh
|
|
-------------------
|
|
|
|
Force that all CAs ask their parents for updated certificates. Note that this function
|
|
is executed when Krill starts up and then again every 10 minutes.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc bulk refresh
|
|
|
|
|
|
Example API call:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc bulk refresh --api
|
|
POST:
|
|
https://localhost:3000/api/v1/bulk/cas/sync/parent
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
Body:
|
|
<empty>
|
|
|
|
.. _cmd_krillc_bulk_sync:
|
|
|
|
krillc bulk sync
|
|
----------------
|
|
|
|
Force that all CAs sync with their publication server.
|
|
|
|
This function is executed when Krill starts up. When Krill is running then
|
|
CAs will synchronise with their publication server whenever there is new
|
|
content to publish. And if such a synchronisation fails, then Krill will
|
|
schedule another attempt every 5 minutes until synchronisation succeeds.
|
|
|
|
However, if you believe that there is an issue with the publication server,
|
|
or you wish to debug connection issues, then you can trigger this function
|
|
manually:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc bulk sync --api
|
|
POST:
|
|
https://localhost:3000/api/v1/bulk/cas/sync/repo
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
Body:
|
|
<empty>
|
|
|
|
....
|
|
|
|
|
|
.. _cmd_krillc_children:
|
|
|
|
krillc children
|
|
---------------
|
|
|
|
Manage children for a CA in Krill.
|
|
|
|
Most operators will not need this, but just like you can operate your Krill CA under
|
|
an RIR or NIR, you can delegate your resources to so-called child CAs. This may be
|
|
useful in case you need to authorise different units of your organisation or customers
|
|
to manage some of your prefixes.
|
|
|
|
.. parsed-literal::
|
|
|
|
USAGE:
|
|
krillc children [SUBCOMMAND]
|
|
|
|
SUBCOMMANDS:
|
|
:ref:`add<cmd_krillc_children_add>` Add a child to a CA
|
|
:ref:`info<cmd_krillc_children_info>` Show info for a child (id and resources)
|
|
:ref:`update<cmd_krillc_children_update>` Update an existing child of a CA
|
|
:ref:`response<cmd_krillc_children_response>` Show the RFC8183 Parent Response XML
|
|
:ref:`connections<cmd_krillc_children_connections>` Show connections stats for children of a CA
|
|
:ref:`suspend<cmd_krillc_children_suspend>` Suspend a child CA: hide certificate(s) issued to child
|
|
:ref:`unsuspend<cmd_krillc_children_unsuspend>` Suspend a child CA: republish certificate(s) issued to child
|
|
:ref:`remove<cmd_krillc_children_remove>` Remove an existing child from a CA
|
|
|
|
.. _cmd_krillc_children_add:
|
|
|
|
krillc children add
|
|
-------------------
|
|
|
|
Add a child to a CA. To add a child, you will need to:
|
|
1. Choose a unique local name (handle) that the parent will use for the child
|
|
2. Choose initial resources (asn, ipv4, ipv6)
|
|
3. Present the child's :rfc:`8183` request
|
|
|
|
The default response is the :rfc:`8183` parent response XML file. Or, if you set
|
|
``--format json`` you will get the plain API response.
|
|
|
|
If you need the response again, you can use the
|
|
:ref:`krillc children response<cmd_krillc_children_response>` command.
|
|
|
|
When you use the CLI you can provide a path to the Child Request XML and the CLI
|
|
will parse this, and convert it to the JSON that Krill expects when adding a child.
|
|
We chose to use a different format here because we needed to include other information
|
|
not contained in the XML. I.e. just submitting the plain XML would not work here.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc children add --ca testbed --child newca --ipv4 "10.0.0.0/8" --ipv6 "2001:db8::/32" --asn "AS65000" --request ./data/new-ca-child-request.xml
|
|
<parent_response xmlns="http://www.hactrn.net/uris/rpki/rpki-setup/" version="1" service_uri="https://localhost:3000/rfc6492/testbed" child_handle="newca" parent_handle="testbed">
|
|
<parent_bpki_ta>MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhFOTBDMjE3MzRDMkMzNzBBOTFBODQ3NUNCNEYwRTc1REE0RDBGMEJGMB4XDTIxMDMyOTA3NTg0NFoXDTM2MDMyOTA4MDM0NFowMzExMC8GA1UEAxMoRTkwQzIxNzM0QzJDMzcwQTkxQTg0NzVDQjRGMEU3NURBNEQwRjBCRjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANcL8DFS3AQyI8HewRH2Xkh6RNIfCSb7mJDaS6dHwp2Dns0VZ07SjA/vVYxq1F1w2yQ/VoTr1dvEHxJ+SDayMcFVktWCObiY8tcPhvWG+OdaX9ckDJhsOEEvdVEogwiGacNs7yXJPbqDBptJtbR8/CauF9OqMqjkB/8xkGmBoY5OI/V2832jkp7LPsbyET0RMQN7fgSpGbewvkaZVxGU3pHh5kT1nzPTXrwjxNMXgpunSEY7zR20vYCvsYYbxnSwFNbSMSL+Jgpa+HWPUc0ydqk2Dn3XneHqClu3O37URxcvI+th4+rECNp6/qlqlZK+tkppI2LkSBhTV5+n7cGA8ZsCAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU6Qwhc0wsNwqRqEdctPDnXaTQ8L8wHwYDVR0jBBgwFoAU6Qwhc0wsNwqRqEdctPDnXaTQ8L8wDQYJKoZIhvcNAQELBQADggEBAG9DNu26d2S9b15NzzaArLg3Ac/nVmqDlK/1sWZNUXFWP4dt1wLTjDWnceyS8mI7Yx8dH/Fez60m4lp4dD45eeaXfbjP2cWnh3n/PLGE70Nj+G0AnUhUmwiTl0H6Px1xn8fZouhv9MEheaZJA+M4NF77+Nmkp2P3WI4cvIS7Te7R/7XpwSr29lVNtYjmRlrBDXx/bMFSgFL61mrtj/l6G8OB40w+sAwO0XKUj1vUUpfIXc3ISCo0LNT9JSPcgy1SZWfmLb98q4HuvxekhkIPRzW7vlb/NBXGarZmKc+HQjE2aXcIewhen2OoTSNda2jSSuEWZuWzZu0aMCKwFBNHLqs=</parent_bpki_ta>
|
|
</parent_response>
|
|
|
|
Example API call:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc children add --ca testbed --child newca --ipv4 "10.0.0.0/8" --ipv6 "2001:db8::/32" --asn "AS65000" --request ./data/new-ca-child-request.xml --api
|
|
POST:
|
|
https://localhost:3000/api/v1/cas/testbed/children
|
|
Headers:
|
|
content-type: application/json
|
|
Authorization: Bearer secret
|
|
Body:
|
|
{
|
|
"handle": "newca",
|
|
"resources": {
|
|
"asn": "AS65000",
|
|
"ipv4": "10.0.0.0/8",
|
|
"ipv6": "2001:db8::/32"
|
|
},
|
|
"id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhFRjJENzgwRkNCRkU1QjZBMkExMjA1OUM0MDlDN0M5Mjc3NTQxOTU2MB4XDTIxMDQwNzE0MzUxNFoXDTM2MDQwNzE0NDAxNFowMzExMC8GA1UEAxMoRUYyRDc4MEZDQkZFNUI2QTJBMTIwNTlDNDA5QzdDOTI3NzU0MTk1NjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANuBsEO4C9n7PlYcDT0PTeZntR5l778lZQDsgxiB7ofLrg8lKcf8ugFiYI4vRqR+gDMHhR3t/X3Ho5gC7uuKf4LYqbJj+Z9ltr/236/hDYJfWMXZVcEuL+wUble1zhe2NKrgnAkpReVMSdiugoqZ9ICK2Fwkj5jCGc/qHiWOba7T78zfij8OlB/dGlJvkAY8b/XTNKsTrLozi1uVAC8GqDrV5MEgY/NfzUvgA024yxx/rC6QBDEoBjnP7wDFiaZ2lwvL2beVYu6/hVcXQzsVN+ijy7cGdkE6zi0meXJLTHPEpoA88hi3Pi+pIDBIQ3wTcpQIOqAq/SZuh4dbZK7BV8MCAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU7y14D8v+W2oqEgWcQJx8kndUGVYwHwYDVR0jBBgwFoAU7y14D8v+W2oqEgWcQJx8kndUGVYwDQYJKoZIhvcNAQELBQADggEBAArqsa/gpJtONdgIWV1EqwEzhKKA2EP6tLDF9ejsdMFNYrYr+2hVWaoLsSuarfwfLFSgKDFqR6sh3ljYq6mIz9gdkjBOJsR9JyHFEtsDsRpf8Hs1WlbIb8bWb73Cp/YPMPVBpmG15Z9iKantzC1tck+E1xYW5awvj+YZqGVqyFdPJOZWmaYoS83kWvg4g4IucXTH6wwy23MQ7+0gyoK4wxfXRQmWjlXpLueCOsJo7ZXopsDAmXHLoFKZVEXn1ocQNc91l521BEQ6t/d7srQA4IxZCRGh9B+JdAIOKuXBA0nncmMJLQN8Qpxlz2bxKKAgXBLdoDqjbTDVbXTPM8YLRgc="
|
|
}
|
|
|
|
.. _cmd_krillc_children_info:
|
|
|
|
krillc children info
|
|
--------------------
|
|
|
|
Show info for a child: state, id certificate info and resources. The
|
|
"state" can either be "active", or "suspended".
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc children info --ca testbed --child newca
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhFRjJE
|
|
NzgwRkNCRkU1QjZBMkExMjA1OUM0MDlDN0M5Mjc3NTQxOTU2MB4XDTIxMDQwNzE0
|
|
MzUxNFoXDTM2MDQwNzE0NDAxNFowMzExMC8GA1UEAxMoRUYyRDc4MEZDQkZFNUI2
|
|
QTJBMTIwNTlDNDA5QzdDOTI3NzU0MTk1NjCCASIwDQYJKoZIhvcNAQEBBQADggEP
|
|
ADCCAQoCggEBANuBsEO4C9n7PlYcDT0PTeZntR5l778lZQDsgxiB7ofLrg8lKcf8
|
|
ugFiYI4vRqR+gDMHhR3t/X3Ho5gC7uuKf4LYqbJj+Z9ltr/236/hDYJfWMXZVcEu
|
|
L+wUble1zhe2NKrgnAkpReVMSdiugoqZ9ICK2Fwkj5jCGc/qHiWOba7T78zfij8O
|
|
lB/dGlJvkAY8b/XTNKsTrLozi1uVAC8GqDrV5MEgY/NfzUvgA024yxx/rC6QBDEo
|
|
BjnP7wDFiaZ2lwvL2beVYu6/hVcXQzsVN+ijy7cGdkE6zi0meXJLTHPEpoA88hi3
|
|
Pi+pIDBIQ3wTcpQIOqAq/SZuh4dbZK7BV8MCAwEAAaNTMFEwDwYDVR0TAQH/BAUw
|
|
AwEB/zAdBgNVHQ4EFgQU7y14D8v+W2oqEgWcQJx8kndUGVYwHwYDVR0jBBgwFoAU
|
|
7y14D8v+W2oqEgWcQJx8kndUGVYwDQYJKoZIhvcNAQELBQADggEBAArqsa/gpJtO
|
|
NdgIWV1EqwEzhKKA2EP6tLDF9ejsdMFNYrYr+2hVWaoLsSuarfwfLFSgKDFqR6sh
|
|
3ljYq6mIz9gdkjBOJsR9JyHFEtsDsRpf8Hs1WlbIb8bWb73Cp/YPMPVBpmG15Z9i
|
|
KantzC1tck+E1xYW5awvj+YZqGVqyFdPJOZWmaYoS83kWvg4g4IucXTH6wwy23MQ
|
|
7+0gyoK4wxfXRQmWjlXpLueCOsJo7ZXopsDAmXHLoFKZVEXn1ocQNc91l521BEQ6
|
|
t/d7srQA4IxZCRGh9B+JdAIOKuXBA0nncmMJLQN8Qpxlz2bxKKAgXBLdoDqjbTDV
|
|
bXTPM8YLRgc=
|
|
-----END CERTIFICATE-----
|
|
|
|
SHA256 hash of PEM encoded certificate: 992ac17d85fef11d8be4aa37806586ce68b61fe9cf65c0965928dbce0c398a99
|
|
resources: asn: , v4: 10.0.0.0/8, 192.168.0.0/16, v6:
|
|
state: active
|
|
|
|
Example JSON response:
|
|
|
|
.. code-block:: json
|
|
|
|
{
|
|
"state": "active",
|
|
"id_cert": {
|
|
"pem": "-----BEGIN CERTIFICATE-----\nMIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhFRjJE\nNzgwRkNCRkU1QjZBMkExMjA1OUM0MDlDN0M5Mjc3NTQxOTU2MB4XDTIxMDQwNzE0\nMzUxNFoXDTM2MDQwNzE0NDAxNFowMzExMC8GA1UEAxMoRUYyRDc4MEZDQkZFNUI2\nQTJBMTIwNTlDNDA5QzdDOTI3NzU0MTk1NjCCASIwDQYJKoZIhvcNAQEBBQADggEP\nADCCAQoCggEBANuBsEO4C9n7PlYcDT0PTeZntR5l778lZQDsgxiB7ofLrg8lKcf8\nugFiYI4vRqR+gDMHhR3t/X3Ho5gC7uuKf4LYqbJj+Z9ltr/236/hDYJfWMXZVcEu\nL+wUble1zhe2NKrgnAkpReVMSdiugoqZ9ICK2Fwkj5jCGc/qHiWOba7T78zfij8O\nlB/dGlJvkAY8b/XTNKsTrLozi1uVAC8GqDrV5MEgY/NfzUvgA024yxx/rC6QBDEo\nBjnP7wDFiaZ2lwvL2beVYu6/hVcXQzsVN+ijy7cGdkE6zi0meXJLTHPEpoA88hi3\nPi+pIDBIQ3wTcpQIOqAq/SZuh4dbZK7BV8MCAwEAAaNTMFEwDwYDVR0TAQH/BAUw\nAwEB/zAdBgNVHQ4EFgQU7y14D8v+W2oqEgWcQJx8kndUGVYwHwYDVR0jBBgwFoAU\n7y14D8v+W2oqEgWcQJx8kndUGVYwDQYJKoZIhvcNAQELBQADggEBAArqsa/gpJtO\nNdgIWV1EqwEzhKKA2EP6tLDF9ejsdMFNYrYr+2hVWaoLsSuarfwfLFSgKDFqR6sh\n3ljYq6mIz9gdkjBOJsR9JyHFEtsDsRpf8Hs1WlbIb8bWb73Cp/YPMPVBpmG15Z9i\nKantzC1tck+E1xYW5awvj+YZqGVqyFdPJOZWmaYoS83kWvg4g4IucXTH6wwy23MQ\n7+0gyoK4wxfXRQmWjlXpLueCOsJo7ZXopsDAmXHLoFKZVEXn1ocQNc91l521BEQ6\nt/d7srQA4IxZCRGh9B+JdAIOKuXBA0nncmMJLQN8Qpxlz2bxKKAgXBLdoDqjbTDV\nbXTPM8YLRgc=\n-----END CERTIFICATE-----\n",
|
|
"hash": "992ac17d85fef11d8be4aa37806586ce68b61fe9cf65c0965928dbce0c398a99"
|
|
},
|
|
"entitled_resources": {
|
|
"asn": "",
|
|
"ipv4": "10.0.0.0/8, 192.168.0.0/16",
|
|
"ipv6": ""
|
|
}
|
|
}
|
|
|
|
Example API call:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc children info --ca testbed --child newca --api
|
|
GET:
|
|
https://localhost:3000/api/v1/cas/testbed/children/newca
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
.. _cmd_krillc_children_update:
|
|
|
|
krillc children update
|
|
----------------------
|
|
|
|
Update the resource entitlements of an existing child of a CA, or update the
|
|
identity certificate that they will use when sending :rfc:`6492` requests.
|
|
|
|
.. IMPORTANT:: When updating resources you need to specify the full new set
|
|
of resource entitlements for the child. This is not a delta. Also if you specify
|
|
one resource type only like ``--ipv4``, then ``--ipv6`` and ``--asn`` will be
|
|
assumed to be intentionally empty:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc children update --ca testbed --child newca --ipv4 "10.0.0.0/8" --api
|
|
POST:
|
|
https://localhost:3000/api/v1/cas/testbed/children/newca
|
|
Headers:
|
|
content-type: application/json
|
|
Authorization: Bearer secret
|
|
Body:
|
|
{
|
|
"id_cert": null,
|
|
"resources": {
|
|
"asn": "",
|
|
"ipv4": "10.0.0.0/8",
|
|
"ipv6": ""
|
|
}
|
|
}
|
|
|
|
|
|
When updating an ID certificate the CLI expects it to be DER encoded. It will
|
|
submit it in base64 encoded form to the API and leave the "resources" as `null`
|
|
then. The `null` value means that this is not updated:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc children update --ca testbed --child newca --idcert ./data/new-ca.cer --api
|
|
POST:
|
|
https://localhost:3000/api/v1/cas/testbed/children/newca
|
|
Headers:
|
|
content-type: application/json
|
|
Authorization: Bearer secret
|
|
Body:
|
|
{
|
|
"id_cert": "MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhFRjJENzgwRkNCRkU1QjZBMkExMjA1OUM0MDlDN0M5Mjc3NTQxOTU2MB4XDTIxMDQwNzE0MzUxNFoXDTM2MDQwNzE0NDAxNFowMzExMC8GA1UEAxMoRUYyRDc4MEZDQkZFNUI2QTJBMTIwNTlDNDA5QzdDOTI3NzU0MTk1NjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANuBsEO4C9n7PlYcDT0PTeZntR5l778lZQDsgxiB7ofLrg8lKcf8ugFiYI4vRqR+gDMHhR3t/X3Ho5gC7uuKf4LYqbJj+Z9ltr/236/hDYJfWMXZVcEuL+wUble1zhe2NKrgnAkpReVMSdiugoqZ9ICK2Fwkj5jCGc/qHiWOba7T78zfij8OlB/dGlJvkAY8b/XTNKsTrLozi1uVAC8GqDrV5MEgY/NfzUvgA024yxx/rC6QBDEoBjnP7wDFiaZ2lwvL2beVYu6/hVcXQzsVN+ijy7cGdkE6zi0meXJLTHPEpoA88hi3Pi+pIDBIQ3wTcpQIOqAq/SZuh4dbZK7BV8MCAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU7y14D8v+W2oqEgWcQJx8kndUGVYwHwYDVR0jBBgwFoAU7y14D8v+W2oqEgWcQJx8kndUGVYwDQYJKoZIhvcNAQELBQADggEBAArqsa/gpJtONdgIWV1EqwEzhKKA2EP6tLDF9ejsdMFNYrYr+2hVWaoLsSuarfwfLFSgKDFqR6sh3ljYq6mIz9gdkjBOJsR9JyHFEtsDsRpf8Hs1WlbIb8bWb73Cp/YPMPVBpmG15Z9iKantzC1tck+E1xYW5awvj+YZqGVqyFdPJOZWmaYoS83kWvg4g4IucXTH6wwy23MQ7+0gyoK4wxfXRQmWjlXpLueCOsJo7ZXopsDAmXHLoFKZVEXn1ocQNc91l521BEQ6t/d7srQA4IxZCRGh9B+JdAIOKuXBA0nncmMJLQN8Qpxlz2bxKKAgXBLdoDqjbTDVbXTPM8YLRgc=",
|
|
"resources": null
|
|
}
|
|
|
|
|
|
.. _cmd_krillc_children_response:
|
|
|
|
krillc children response
|
|
------------------------
|
|
|
|
Get the :rfc:`8183` Parent Response for a child. The child will need this to add your
|
|
CA as their parent.
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc children response --ca testbed --child newca
|
|
<parent_response xmlns="http://www.hactrn.net/uris/rpki/rpki-setup/" version="1" service_uri="https://localhost:3000/rfc6492/testbed" child_handle="newca" parent_handle="testbed">
|
|
<parent_bpki_ta>MIIDNDCCAhygAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhFOTBDMjE3MzRDMkMzNzBBOTFBODQ3NUNCNEYwRTc1REE0RDBGMEJGMB4XDTIxMDMyOTA3NTg0NFoXDTM2MDMyOTA4MDM0NFowMzExMC8GA1UEAxMoRTkwQzIxNzM0QzJDMzcwQTkxQTg0NzVDQjRGMEU3NURBNEQwRjBCRjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANcL8DFS3AQyI8HewRH2Xkh6RNIfCSb7mJDaS6dHwp2Dns0VZ07SjA/vVYxq1F1w2yQ/VoTr1dvEHxJ+SDayMcFVktWCObiY8tcPhvWG+OdaX9ckDJhsOEEvdVEogwiGacNs7yXJPbqDBptJtbR8/CauF9OqMqjkB/8xkGmBoY5OI/V2832jkp7LPsbyET0RMQN7fgSpGbewvkaZVxGU3pHh5kT1nzPTXrwjxNMXgpunSEY7zR20vYCvsYYbxnSwFNbSMSL+Jgpa+HWPUc0ydqk2Dn3XneHqClu3O37URxcvI+th4+rECNp6/qlqlZK+tkppI2LkSBhTV5+n7cGA8ZsCAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU6Qwhc0wsNwqRqEdctPDnXaTQ8L8wHwYDVR0jBBgwFoAU6Qwhc0wsNwqRqEdctPDnXaTQ8L8wDQYJKoZIhvcNAQELBQADggEBAG9DNu26d2S9b15NzzaArLg3Ac/nVmqDlK/1sWZNUXFWP4dt1wLTjDWnceyS8mI7Yx8dH/Fez60m4lp4dD45eeaXfbjP2cWnh3n/PLGE70Nj+G0AnUhUmwiTl0H6Px1xn8fZouhv9MEheaZJA+M4NF77+Nmkp2P3WI4cvIS7Te7R/7XpwSr29lVNtYjmRlrBDXx/bMFSgFL61mrtj/l6G8OB40w+sAwO0XKUj1vUUpfIXc3ISCo0LNT9JSPcgy1SZWfmLb98q4HuvxekhkIPRzW7vlb/NBXGarZmKc+HQjE2aXcIewhen2OoTSNda2jSSuEWZuWzZu0aMCKwFBNHLqs=</parent_bpki_ta>
|
|
</parent_response>
|
|
|
|
Example API call:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc children response --ca testbed --child newca --api
|
|
GET:
|
|
https://localhost:3000/api/v1/cas/testbed/children/newca/contact
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
Note that the API always returns the :rfc:`8183` Parent Response in JSON format, but
|
|
the CLI converts it. Other API endpoints support getting such files in either JSON or
|
|
RFC standard XML format. If there is desire to support this here as well, then we will
|
|
add this in a future release.
|
|
|
|
.. _cmd_krillc_children_connections:
|
|
|
|
krillc children connections
|
|
---------------------------
|
|
|
|
Show the connections stats for children of a CA. This can be useful for monitoring
|
|
for potentially deactivated child CAs. Furthermore the user-agent for the last known
|
|
connection from each child is shown. This can help to monitor for children running
|
|
potentially outdated RPKI CA implementations (old krill versions or other implementations).
|
|
|
|
Example CLI:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc children connections --ca testbed
|
|
handle,user_agent,last_exchange,result,state
|
|
CA2,krill/0.9.2-rc3,2021-09-24T10:00:00+00:00,success,active
|
|
ca,krill/0.9.2-rc3,2021-09-24T10:00:00+00:00,success,active
|
|
CA1,krill/0.9.2-rc1,2021-09-13T14:30:00+00:00,success,active
|
|
dummy_ca,n/a,never,n/a,active
|
|
|
|
|
|
Example API call:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc children connections --ca testbed --api
|
|
GET:
|
|
https://localhost:3000/api/v1/cas/testbed/stats/children/connections
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
Example JSON response:
|
|
|
|
.. code-block:: json
|
|
|
|
{
|
|
"children": [
|
|
{
|
|
"handle": "newca",
|
|
"last_exchange": {
|
|
"timestamp": 1632477600,
|
|
"result": "Success",
|
|
"user_agent": "krill/0.9.2"
|
|
},
|
|
"state": "active"
|
|
},
|
|
{
|
|
"handle": "oldca",
|
|
"last_exchange": {
|
|
"timestamp": 1632477600,
|
|
"result": "Success",
|
|
"user_agent": "krill"
|
|
},
|
|
"state": "active"
|
|
},
|
|
{
|
|
"handle": "brandnewca",
|
|
"last_exchange": null,
|
|
"state": "active"
|
|
},
|
|
]
|
|
}
|
|
|
|
Note that krill 0.9.1 and below use the user-agent "krill", while krill
|
|
0.9.2 and above include the version, e.g.: "krill/0.9.2". Other RPKI CA
|
|
implementation may or may not include user-agents strings in their requests.
|
|
|
|
Furthermore note that the "last_exchange" may be "null" in case a CA was
|
|
just added by the parent, but the child CA did not import the parent XML
|
|
response yet - or was otherwise unable to connect.
|
|
|
|
The "last_exchange" field will also be "null" after upgrading to krill 0.9.2.
|
|
This information was not kept prior to krill 0.9.2 so, after upgrading, this
|
|
will only be set when your existing child CAs connect for the first time.
|
|
|
|
|
|
.. _cmd_krillc_children_suspend:
|
|
|
|
krillc children suspend
|
|
-----------------------
|
|
|
|
If you believe that a child CA has been deactivated then you may wish to "suspend"
|
|
it, rather than remove it altogether. If you suspend a child CA, then any
|
|
certificate(s) issued to it by your CA will be withdrawn, and they will no longer
|
|
be processed by RPKI validation software. This is particularly useful if the
|
|
manifest and CRL of the child CA have expired, and presumably their ROAs are no
|
|
longer maintained either.
|
|
|
|
If and when a "suspended" child CA connects to your CA again, it will automatically
|
|
be "un-suspended". Meaning that any certificate(s) previously issued to this
|
|
child will be published again.
|
|
|
|
The main goal of this is to facilitate an easier recovery path in cases where
|
|
a child CA suffers a long outage. By "suspending" them until the child CA is
|
|
reactivated you suppress RPKI validation errors for their expired publication
|
|
point, while ensuring that the delegation to this CA will be re-enabled as soon
|
|
as it is successfully started.
|
|
|
|
Example CLI/API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc children suspend --ca testbed --child newca --api
|
|
|
|
POST:
|
|
https://localhost:3000/api/v1/cas/testbed/children/newca
|
|
Headers:
|
|
content-type: application/json
|
|
Authorization: Bearer secret
|
|
Body:
|
|
{
|
|
"suspend": true
|
|
}
|
|
|
|
.. Important:: It is not always trivial to figure out if a child CA has been
|
|
deactivated. The expiry of the child CA's manifest and CRL is
|
|
a strong indication of this, but this information is not available
|
|
to the krill CA parent. What it *does* have is the knowledge of
|
|
when a child CA connected for the last time.
|
|
|
|
If the child CA did not connect for a long time, then the parent
|
|
may be inclined to think that they have been deactived. This
|
|
is true for child CAs running Krill 0.9.2 or above, because here
|
|
the maximum configurable 'refresh' rate is one hour. So, if you
|
|
have not seen any connection attempts for such child CAs for, say
|
|
8 hours, then you can safely suspend them.
|
|
|
|
However, earlier krill versions, while using a default of 10 minutes,
|
|
would allow overriding this value without any upper bound. Other
|
|
RPKI CA implementations may also use longer cycles.
|
|
|
|
In short: be careful before deciding that a child CA is truly
|
|
deactived.
|
|
|
|
|
|
.. _cmd_krillc_children_unsuspend:
|
|
|
|
krillc children unsuspend
|
|
-------------------------
|
|
|
|
If needed you can manually "un-suspend" a "suspended" child CA. Generally speaking
|
|
there is no need do this, because a child will be un-suspended automatically whenever
|
|
it re-connects with your CA.
|
|
|
|
Example CLI/API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc children unsuspend --ca testbed --child newca --api
|
|
POST:
|
|
https://localhost:3000/api/v1/cas/testbed/children/newca
|
|
Headers:
|
|
content-type: application/json
|
|
Authorization: Bearer secret
|
|
Body:
|
|
{
|
|
"suspend": false
|
|
}
|
|
|
|
|
|
.. _cmd_krillc_children_remove:
|
|
|
|
krillc children remove
|
|
----------------------
|
|
|
|
Remove an existing child from a CA. This removes and revokes any certificate(s)
|
|
issued to this child CA. Furthermore this child CA, if still active or re-activated,
|
|
will no longer be allowed to connect to your CA. They will have to remove you as
|
|
a parent first and then re-do the XML exchange with you in order to be re-added
|
|
as a child.
|
|
|
|
if you think that the child CA may be temporarily disabled, then you may wish to
|
|
"suspend" them instead.
|
|
|
|
.. Important:: If the child CA was created in krill using the `krillc children add --ca testbed --child newca`
|
|
command, this command does not remove the child CA. You must still execute
|
|
`krillc delete --ca newca` in order to compelety remove the child CA.
|
|
|
|
Example CLI / API call:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc children remove --ca testbed --child newca --api
|
|
DELETE:
|
|
https://localhost:3000/api/v1/cas/testbed/children/newca
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
|
|
....
|
|
|
|
|
|
.. _cmd_krillc_keyroll:
|
|
|
|
krillc keyroll
|
|
--------------
|
|
|
|
Perform a key rollover for a CA.
|
|
|
|
Krill supports :rfc:`6489` Key Rollovers. The process is manual for now. I.e. it's up to the
|
|
operator to initiate a key rollover - there is no automation based on key age for example.
|
|
We expect that this is what operators would want. More importantly though, this also means
|
|
that operators should execute *both* steps in the process to start *and* finish the key
|
|
rollover:
|
|
|
|
.. parsed-literal::
|
|
|
|
:ref:`krillc keyroll init<cmd_krillc_keyroll_init>` Initialise roll for all keys held by this CA.
|
|
:ref:`krillc keyroll activate<cmd_krillc_keyroll_activate>` Finish roll for all keys held by this CA.
|
|
|
|
|
|
.. _cmd_krillc_keyroll_init:
|
|
|
|
krillc keyroll init
|
|
-------------------
|
|
|
|
Initialise roll for all keys held by this CA.
|
|
|
|
Example CLI/API call:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc keyroll init --ca newca --api
|
|
POST:
|
|
https://localhost:3000/api/v1/cas/newca/keys/roll_init
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
Body:
|
|
<empty>
|
|
|
|
.. _cmd_krillc_keyroll_activate:
|
|
|
|
krillc keyroll activate
|
|
^^^^^^^^^^^^^^^^^^^^^^^
|
|
|
|
Finish roll for all keys held by this CA.
|
|
|
|
Note that :rfc:`6489` says that you should wait 24 hours before doing this step. So, please
|
|
observe this period for planned key rollovers. For emergency rollovers where the old key is
|
|
compromised, or if this rollover is part of an emergency migration to a new publication server,
|
|
do this step as soon as possible.
|
|
|
|
Example CLI/API:
|
|
|
|
.. code-block:: text
|
|
|
|
$ krillc keyroll activate --ca newca --api
|
|
POST:
|
|
https://localhost:3000/api/v1/cas/newca/keys/roll_activate
|
|
Headers:
|
|
Authorization: Bearer secret
|
|
Body:
|
|
<empty>
|