.\"/*
.\" * Copyright (C) 2016-2026 Red Hat, Inc.
.\" *
.\" * All rights reserved.
.\" *
.\" * Author: Jan Friesse <jfriesse@redhat.com>
.\" *
.\" * This software licensed under BSD license, the text of which follows:
.\" *
.\" * Redistribution and use in source and binary forms, with or without
.\" * modification, are permitted provided that the following conditions are met:
.\" *
.\" * - Redistributions of source code must retain the above copyright notice,
.\" *   this list of conditions and the following disclaimer.
.\" * - Redistributions in binary form must reproduce the above copyright notice,
.\" *   this list of conditions and the following disclaimer in the documentation
.\" *   and/or other materials provided with the distribution.
.\" * - Neither the name of Red Hat, Inc. nor the names of its
.\" *   contributors may be used to endorse or promote products derived from this
.\" *   software without specific prior written permission.
.\" *
.\" * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
.\" * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
.\" * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
.\" * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
.\" * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
.\" * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
.\" * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
.\" * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
.\" * THE POSSIBILITY OF SUCH DAMAGE.
.\" */
.TH COROSYNC-QDEVICE-NET-CERTUTIL 8 2026-08-13
.SH NAME
corosync-qdevice-net-certutil - tool to generate qdevice model net TLS certificates
.SH SYNOPSIS
.B "corosync-qdevice-net-certutil [-i|-M|-m|-Q|-r] [-C scp_command] [-c certificate] [-g keysize] [-k keytype] [-n cluster_name] [-S ssh_command] [-q paramset]"
.SH DESCRIPTION
.B corosync-qdevice-net-certutil
is a frontend for NSS certutil used for generating client certificate for the net model of
qdevice.
.SH OPTIONS
.TP
.B -i
Initialize the QDevice Net NSS certificate database.
The default directory for the database is /etc/corosync/qdevice/net/. This directory
has to be writable by the current user. It needs the QNetd CA certificate passed as the
.B -c
parameter. This certificate can be found on the server running QNetd in the file
/etc/corosync/qnetd/nssdb/qnetd-cacert.crt.
.TP
.B -M
Import a signed certificate and export a certificate with private key into
pk12 file.
.TP
.B -m
Import the cluster certificate and key from a pk12 file.
.TP
.B -Q
Use ssh/scp to properly set both
.B corosync-qnetd
and
.B corosync-qdevice
certificates on all nodes. It's highly recommended that you use an ssh agent,
or ssh/scp will keep asking for a password - roughly 8 times the number of nodes.
.TP
.B -r
Generate a certificate request. The certificate request is exported into
/etc/corosync/qdevice/net/qdevice-net-node.crq. It is necessary to
pass the cluster name using the
.B -n
parameter. The cluster name has to match the one defined in /etc/corosync/corosync.conf.
.TP
.B -C
Alternative remote copy command to be use in place of scp. If not specified, scp is used.
.TP
.B -c
File with certificate to load.
.TP
.B -g
Specify the key size to use when generating new public and private key pairs.
This option is passed directly to the
.B certutil
command. By default, this is left empty, meaning
.B -g
is not passed to
.B certutil
at all.
.TP
.B -k
Specify the key type to use when generating new public and private key pairs.
This option is passed directly to the
.B certutil
command. By default, this is left empty, meaning
.B -k
is not passed to
.B certutil
at all.
.TP
.B -n
Name of the cluster.
.TP
.B -S
Alternative remote shell command to be use in place of ssh. If not specified, ssh is used.
.TP
.B -q
Specify the curve-name or ml-dsa-parameter-set to use when generating new public
and private key pairs. This option is passed directly to the
.B certutil
command. By default, this is left empty, meaning
.B -q
is not passed to
.B certutil
at all.
.SH SEE ALSO
.BR corosync-qnetd (8)
.BR corosync-qdevice (8)
.BR certutil(1)
.SH AUTHOR
Jan Friesse
.PP