Your company here — click to reach over 10,000 unique daily visitors

corosync-qnetd-certutil - Man Page

tool to generate qnetd TLS certificates


corosync-qnetd-certutil [-i|-s] [-c certificate] [-n cluster_name]


corosync-qnetd-certutil is a frontend for the NSS certutil, it is used for generating the QNetd CA (Certificate Authority),  server certificate and signing cluster certificate used by corosync-qdevice when using the model 'net'.



Initialize the QNetd NSS certificate database and generate the QNetd CA and server certificates. The default directory for the database is /etc/corosync/qnetd. This directory must be writeable by the current user. The QNetd CA certificate is also exported into the file /etc/corosync/qnetd/nssdb/qnetd-cacert.crt.


Sign the cluster certificate. It is necessary to pass the cluster name (as configured in corosync.conf) and the certificate request file - see options below. The signed certificate will be written to the  file /etc/corosync/qnetd/nssdb/cluster-$ClusterName.crt


Certificate request file to sign.


Do not set group write bit for new files. This option has effect only when used together with -i option. It is useful when extended security is needed and it's viable to prohibit daemon to change its configuration. Expected usage is to first set owner of the /etc/corosync/qnetd directory to root:$COROQNETD with permissions 0750 and then create database (as a root):

# corosync-qnetd-certutil -i -G

Name of the cluster.


If qnetd is executed by a non root user, /etc/corosync/qnetd and its subdirectories must be owned by (or have group access for) the given user. If corosync-qnetd-certutil is executed as root it tries to copy the owner and group of /etc/corosync/qnetd to all of the created files.

See Also

corosync-qnetd(8) corosync-qdevice(8)


Jan Friesse

Referenced By