Configuring CA Database Pruning

Overview

Note	This page is still under construction.

This page describes the process to configure CA database pruning in PKI 11.3.

Configuration

The pruning configuration is stored in /etc/pki/pki-tomcat/ca/CS.cfg. It is necessary to restart the CA after making configuration changes.

Enabling pruning job

To enable the pruning job:

$ pki-server ca-config-set jobsScheduler.job.pruning.enabled false

Configuring certificate pruning

To configure certificate retention:

$ pki-server ca-config-set jobsScheduler.job.pruning.certRetentionTime 30
$ pki-server ca-config-set jobsScheduler.job.pruning.certRetentionUnit day

Configuring request pruning

To configure request retention:

$ pki-server ca-config-set jobsScheduler.job.pruning.requestRetentionTime 30
$ pki-server ca-config-set jobsScheduler.job.pruning.requestRetentionUnit day

Triggering Pruning

Manual Trigger

To trigger pruning job manually as an administrator, execute the following command:

$ pki -n caadmin ca-job-start pruning

To trigger pruning job manually as another user, specify the user as the job owner, then restart the CA:

$ pki-server ca-config-set jobsScheduler.job.pruning.owner <user>

Then the command can be executed as follows:

$ pki -n <client cert> ca-job-start pruning

Automatic Trigger

To trigger pruning job automatically using the internal scheduler, add the following parameter, then restart the CA:

$ pki-server ca-config-set jobsScheduler.job.pruning.cron "0 0 * * *"

To trigger pruning job automatically using an external scheduler (e.g. cron), execute the following command as in the manual trigger:

$ pki -n <client cert> ca-job-start pruning