tlscertificate create

This command adds a TLS certificate to the VMS.

If you're going to use options that upload files, ensure that the files to be uploaded are available via VAST CLI on the management CNode. To do so:

Identify the CNode that hosts the VMS by running the ssh <username>@<CNode> "docker ps | grep vast_vms" command for each CNode. The VMS CNode will produce output similar to:

899662f162a2   vastdata.registry.local:5000/dev/orion:release-5-4-0-1947156-vms      "/usr/bin/dumb-init …"   3 days ago    Up 3 days              vast_vms

Copy the file to be uploaded to the /vast/bundles directory on the VMS CNode, for example:
```
scp <local filepath> <username>@<CNode>:/vast/bundles/
```

Usage

tlscertificate create {--ca-certificate TEXT|--ca-certificate-file FILEPATH}
                      --protocols NFS|KAFKA
                     [--ca-certificate-name NAME]
                     [--revocation-list TEXT|--revocation-file FILEPATH]
                     [--revocations-name NAME]
                     [--tenant-id ID]|[--tenant-associate-param SAN]

Required Parameters

--ca-certificate TEXT

--ca-certificate-file FILEPATH

Supply the certificate as plain text on the --ca-certificate option, or use the -ca-certificate-file option to specify the path to the certificate file.

When uploading a file, the file size cannot exceed 1MB.

--protocols NFS|KAFKA

Determines the protocol to be authenticated with the certificate. Valid values:

NFS for NFSv3 and NFSv4 connections.
KAFKA for Kafka connections.

Options

`--ca-certificate-name NAME`	Sets a name for the certificate specified on `--ca-certificate` or `--ca-certificate-file`.
`--revocation-list TEXT`	Use this option to supply the list of revoked certificates as plain text.
`--revocation-file FILEPATH`	Use this option to specify a path to the CRL file containing the list of revoked certificates.
`--revocations-name NAME`	Sets a name for the revocation list specified on `--revocation-list` or `--revocation-file`.
`--tenant-id ID`	If a tenant ID is included in the command, the certificate will be used for tenant-level authentication (applied for the particular tenant only). If no tenant ID is specified, the certificate will be used for cluster-wide authentication (applied to all tenants). The `tenant-id` option cannot be specified together with `--tenant-associate-param`.
`--tenant-associate-param OID`	If specified, the certificate will be used for cluster-wide mTLS authentication of NFS connections. This option determines an `otherName` field within the certificate's Subject Alternative Name (SAN) extension that will be used for tenant identification. The cluster will compare the value within this field to the tenant's mTLS identifier. Specify the field with its Object Identifier (OID), for example: `1.3.6.1.2.1.25.2.1.2.3.4.5.6.100`. This value must be unique across the SAN `otherName` fields. The `--tenant-associate-param` option cannot be specified together with `--tenant-id`.

Example

To add a CA certificate to be used to authenticate NFS connections, together with a CRL file:

vcli: admin> tlscertificate create --protocols NFS --ca-certificate-file /vast/bundles/full-CA.pem --revocation-file /vast/bundles/66.crl