Configuring CA Database Pruning

Overview

Note	This page is still under construction.

This page describes the process to configure CA database pruning in PKI 11.3.

Configuration

The pruning configuration is stored in /etc/pki/pki-tomcat/ca/CS.cfg. It is necessary to restart the CA after making configuration changes.

Enabling pruning job

By default the pruning job is disabled. To enable the pruning job:

$ pki-server ca-config-set jobsScheduler.job.pruning.enabled true

Configuring certificate pruning

By default an expired certificate will be retained for 30 days before it will be pruned. When an expired certificate is pruned, the corresponding request will also be pruned. To configure certificate retention period:

$ pki-server ca-config-set jobsScheduler.job.pruning.certRetentionTime 30
$ pki-server ca-config-set jobsScheduler.job.pruning.certRetentionUnit day

Valid retention units: minute, hour, day, year.

Configuring request pruning

By default an incomplete request will be retained for 30 days before it will be pruned. To configure request retention period:

$ pki-server ca-config-set jobsScheduler.job.pruning.requestRetentionTime 30
$ pki-server ca-config-set jobsScheduler.job.pruning.requestRetentionUnit day

Valid retention units: minute, hour, day, year.

Triggering Pruning

Manual Trigger

To trigger pruning job manually as an administrator, execute the following command:

$ pki -n caadmin ca-job-start pruning

To trigger pruning job manually as another user, specify the user as the job owner, then restart the CA:

$ pki-server ca-config-set jobsScheduler.job.pruning.owner <user>

Then the command can be executed as follows:

$ pki -n <client cert> ca-job-start pruning

Automatic Trigger

To trigger pruning job automatically using the internal scheduler, add the following parameter, then restart the CA:

$ pki-server ca-config-set jobsScheduler.job.pruning.cron "0 0 * * *"

To trigger pruning job automatically using an external scheduler (e.g. cron), configure the scheduler to execute the following command:

$ pki -n <client cert> ca-job-start pruning