PKI & Certificates

The pki command group manages Suricatavel’s internal Certificate Authority (CA) used to authenticate communications with sensors, agents, and external integrations via mutual TLS (mTLS).

---

Available actions

Action	Description
status	Display the Certificate Authority status, fingerprint, and validity dates.
init	Initialize an internal self-signed Root CA.
import	Import an external or corporate CA certificate and private key.

---

Check CA status

suricatavel pki status

Displays whether the CA is initialized, its SHA-256 fingerprint, subject DN, and expiration date.

---

Initialize internal Root CA

To generate a new internal Root CA:

suricatavel pki init --cn="Suricatavel Root CA" --org="SecOps" --days=3650

Options

• --cn: Common Name for the CA certificate (default: Suricatavel Root CA).
• --org: Organization name (default: Suricatavel).
• --days: Certificate validity in days (default: 3650 - 10 years).

Private keys are automatically encrypted at rest using Ansible Vault or application encryption keys.

---

Import external CA

To use an existing enterprise PKI:

suricatavel pki import --cert=/path/to/ca.crt --key=/path/to/ca.key --passphrase="secret"

Options

• --cert (required): Path to the PEM-encoded CA certificate.
• --key (required): Path to the PEM-encoded private key file.
• --passphrase: Passphrase used to decrypt the private key if password-protected.