Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 162 / 554

Chapter 5. Registration Authority
140
• Server Certificate — this is used to communicate with RA users. (This is the server identity of the
RA.)
• Subsystem Certificate — this is used to communicate with the CA. (This is the client identity of the
RA.)
Multiple RA instances can communicate with a single CA. Additional RA instances can be created
using the
/usr/bin/pkicreate
command.
Note
Unlike the CA, the RA uses
SQLite
as the persistent store for internal data such as
requests and user information.
5.2.2. Directory Structure
The following tables list and describe the principle files and directories that comprise the RA:
Directory Description
/var/lib/rhpki-ra Main instance directory
/var/lib/rhpki-ra/conf Configuration directory
/var/lib/rhpki-ra/logs Logs directory
/var/lib/rhpki-ra/alias NSS security database where keys and certificates are stored
/var/lib/rhpki-ra/docroot/ee CGIs and templates for end-users (EE)
/var/lib/rhpki-ra/docroot/agent CGIs and templates for agents
/var/lib/rhpki-ra/docroot/admin CGIs and templates for administrators
Table 5.1. Principle RA Directories
File Description
/etc/init.d/rhpki-ra Start/stop script
/var/lib/rhpki-ra/conf/CS.cfg Main configuration file
Table 5.2. Principle RA Files
Note
The paths described here are those used for a default RA instance. Administrators have
the option of using the
pkicreate
command to create further RA instances anywhere on
the system.
5.2.3. Configuration Parameters
This section describes various configuration parameters that are used when setting up the RA. These
parameters are specified in the
/var/lib/rhpki-ra/conf/CS.cfg
file.
admin.authorized_groups
Specifies the groups of users who have permission to access the Administration interface.
Example: