Minor fixes to pkispawn man page.

Updating the sample configuration file entries in
default CA and subordinate CA installation. Added
sample configuration files for each installation type
mentioned in the man page.

Tickets #509, #525

8 files changed, 101 insertions, 3 deletions

diff --git a/base/deploy/config/sample.cfg b/base/deploy/config/sample.cfg
index a4a6f68c2..f4b3e523d 100644
--- a/base/deploy/config/sample.cfg
+++ b/base/deploy/config/sample.cfg
@@ -3,4 +3,5 @@ pki_admin_password=
 pki_backup_password=
 pki_client_pkcs12_password=
 pki_ds_password=
-pki_security_domain_password=
+##Required for all subsystems that are not root CAs
+#pki_security_domain_password=
diff --git a/base/deploy/config/sampleCAclone.cfg b/base/deploy/config/sampleCAclone.cfg
new file mode 100644
index 000000000..afacc64a2
--- /dev/null
+++ b/base/deploy/config/sampleCAclone.cfg
@@ -0,0 +1,16 @@
+[DEFAULT]
+pki_admin_password=
+pki_backup_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+pki_security_domain_hostname=
+pki_security_domain_https_port=
+pki_security_domain_user=
+
+[CA]
+pki_clone=True
+pki_clone_pkcs12_password=
+pki_clone_pkcs12_path=
+pki_clone_replicate_schema=
+pki_clone_uri=
\ No newline at end of file
diff --git a/base/deploy/config/sampleExternalSignedCA-step1.cfg b/base/deploy/config/sampleExternalSignedCA-step1.cfg
new file mode 100644
index 000000000..7b72e5f83
--- /dev/null
+++ b/base/deploy/config/sampleExternalSignedCA-step1.cfg
@@ -0,0 +1,11 @@
+[DEFAULT]
+pki_admin_password=
+pki_backup_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+
+[CA]
+pki_external=True
+pki_external_csr_path=
+pki_ca_signing_subject_dn=
\ No newline at end of file
diff --git a/base/deploy/config/sampleExternalSignedCA-step2.cfg b/base/deploy/config/sampleExternalSignedCA-step2.cfg
new file mode 100644
index 000000000..b90d301c3
--- /dev/null
+++ b/base/deploy/config/sampleExternalSignedCA-step2.cfg
@@ -0,0 +1,13 @@
+[DEFAULT]
+pki_admin_password=
+pki_backup_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+
+[CA]
+pki_external=True
+pki_external_ca_cert_chain_path=
+pki_external_ca_cert_path=
+pki_external_step_two=True
+pki_ca_signing_subject_dn=
\ No newline at end of file
diff --git a/base/deploy/config/sampleKRA.cfg b/base/deploy/config/sampleKRA.cfg
new file mode 100644
index 000000000..9752e1077
--- /dev/null
+++ b/base/deploy/config/sampleKRA.cfg
@@ -0,0 +1,13 @@
+[DEFAULT]
+pki_admin_password=
+pki_backup_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+pki_security_domain_hostname=
+pki_security_domain_https_port=
+pki_security_domain_user=
+pki_issuing_ca_uri=
+
+[KRA]
+pki_import_admin_cert=
\ No newline at end of file
diff --git a/base/deploy/config/sampleKRAclone.cfg b/base/deploy/config/sampleKRAclone.cfg
new file mode 100644
index 000000000..3584c41a9
--- /dev/null
+++ b/base/deploy/config/sampleKRAclone.cfg
@@ -0,0 +1,17 @@
+[DEFAULT]
+pki_admin_password=
+pki_backup_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+pki_security_domain_hostname=
+pki_security_domain_https_port=
+pki_security_domain_user=
+
+[KRA]
+pki_clone=True
+pki_clone_pkcs12_password=
+pki_clone_pkcs12_path=
+pki_clone_replicate_schema=
+pki_clone_uri=
+pki_issuing_ca=
\ No newline at end of file
diff --git a/base/deploy/config/sampleSubordinateCA.cfg b/base/deploy/config/sampleSubordinateCA.cfg
new file mode 100644
index 000000000..e42a42ff8
--- /dev/null
+++ b/base/deploy/config/sampleSubordinateCA.cfg
@@ -0,0 +1,14 @@
+[DEFAULT]
+pki_admin_password=
+pki_backup_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+pki_security_domain_hostname=
+pki_security_domain_https_port=
+pki_security_domain_user=
+
+[CA]
+pki_subordinate=True
+pki_issuing_ca=
+pki_ca_signing_subject_dn=
\ No newline at end of file
diff --git a/base/deploy/man/man8/pkispawn.8 b/base/deploy/man/man8/pkispawn.8
index c5361c3b0..b2a0134f3 100644
--- a/base/deploy/man/man8/pkispawn.8
+++ b/base/deploy/man/man8/pkispawn.8
@@ -94,7 +94,6 @@ pki_admin_password=\fIpassword123\fP
 pki_backup_password=\fIpassword123\fP
 pki_client_pkcs12_password=\fIpassword123\fP
 pki_ds_password=\fIpassword123\fP
-pki_security_domain_password=\fIpassword123\fP
 .fi
 .PP
 Prior to running this command, a Directory Server instance should be created and running. This command assumes that the Directory Server instance is using its default configuration:
@@ -115,7 +114,18 @@ To access the agent pages, first import the CA certificate by accessing the CA E
 .SS KRA, OCSP, or TKS using default configuration
 \x'-1'\fBpkispawn -s <subsystem> -f myconfig.txt\fR
 .PP
-where subsystem is KRA, OCSP, or TKS, and \fImyconfig.txt\fP is the same as the one used for the default CA example.  This command should be run after a CA is installed.  This installs another subsystem within the same default instance using the certificate generated for the CA administrator for the subsystem's administrator.  This allows a user to access both subsystems on the browser with a single administrator certificate.  To access the new subsystem's functionality, simply point the browser to https://<hostname>:8443 and click the relevant top-level links.
+where subsystem is KRA, OCSP, or TKS, and \fImyconfig.txt\fP contains the following text: 
+.IP
+.nf
+[DEFAULT]
+pki_admin_password=\fIpassword123\fP
+pki_backup_password=\fIpassword123\fP
+pki_client_pkcs12_password=\fIpassword123\fP
+pki_ds_password=\fIpassword123\fP
+pki_security_domain_password=\fIpassword123\fP
+.fi
+.PP
+The \fBpki_security_domain_password\fP is the admin password of the CA installed in the same default instance. This command should be run after a CA is installed.  This installs another subsystem within the same default instance using the certificate generated for the CA administrator for the subsystem's administrator.  This allows a user to access both subsystems on the browser with a single administrator certificate.  To access the new subsystem's functionality, simply point the browser to https://<hostname>:8443 and click the relevant top-level links.
 .SS KRA, OCSP, or TKS connecting to a remote CA
 \x'-1'\fBpkispawn -s <subsystem> -f myconfig.txt\fR
 .PP
@@ -217,9 +227,12 @@ pki_security_domain_user=caadmin
 [CA]
 pki_subordinate=True
 pki_issuing_ca=https://<master_ca_hostname>:<master_ca_https_port>
+pki_ca_signing_subject_dn=cn=CA Subordinate Signing ,o=example.com
 .fi
 .PP
 A sub-CA derives its certificate configuration -- such as allowed extensions and validity periods -- from a superior or root CA. Otherwise, the configuration of the CA is independent of the root CA, so it is its own instance rather than a clone. A sub-CA is configured using the pki_subordinate parameter and a pointer to the CA which issues the sub-CA's certificates.
+.PP
+\fBNote:\fP The value of \fBpki_ca_signing_subject_dn\fP of a subordinate CA should be different from the root CA's signing subject DN.
 .SS Installing an externally signed CA
 \x'-1'\fBpkispawn -s CA -f myconfig.txt\fR
 .PP