27.2. Displaying the Current PKINIT Configuration

IdM provides multiple commands you can use to query the PKINIT configuration in your domain.
To determine the PKINIT status in your domain, use the ipa pkinit-status command: 
$ ipa pkinit-status
  Server name: server1.example.com
  PKINIT status: enabled
  [...output truncated...]
  Server name: server2.example.com
  PKINIT status: disabled
  [...output truncated...]
To determine the PKINIT status on the server where you are logged in, use the ipa-pkinit-manage status command: 
# ipa-pkinit-manage status
PKINIT is enabled
The ipa-pkinit-manage command was successful
The commands display the PKINIT configuration status as enabled or disabled:
To display the IdM servers with active Kerberos key distribution centers (KDCs) that support PKINIT for IdM clients, use the ipa config-show command on any server: 
$ ipa config-show
  Maximum username length: 32
  Home directory base: /home
  Default shell: /bin/sh
  Default users group: ipausers
  [...output truncated...]
  IPA masters capable of PKINIT: server1.example.com
  [...output truncated...]

Additional Resources

  • For more details on the command-line tools for reporting the PKINIT status, use the ipa help pkinit command.