cm trust-domain¶

cm trust-domain(1) BIG-IP TMSH Manual cm trust-domain(1)

NAME
trust-domain - Manages a CM trust domain by providing control of object failover.

MODULE
cm

SYNTAX
Manage the trust-domain component within the cm module using the syntax shown in the following sections. The
trust-domain name 'Root' is optional beginning with version 13.0.0. The 'create cm trust-domain' command is
not allowed beginning version 13.0.0.

MODIFY
modify trust-domain [Root]
options:
add-device {
[ ca-device [true | false] | non-ca-device [true | false] ]
device-ip [string]
device-port [port_number]
device-name [string]
username [string]
password [string]
sha1-fingerprint [string]
}
devices delete {
[ device names ]
}
remove-device [string]

deprecated since v13.0.0:
ca-devices [add | delete | modify | replace-all-with] {
[ device_name | ip address ]
}
md5-fingerprint [string]
name [string]
non-ca-devices [add | delete | modify | replace-all-with] {
[ device_name | ip address ]
}
password [string]
serial [string]
sha1-fingerprint [string]
username [string]

DISPLAY
list trust-domain
list trust-domain [ [ [name] | [glob] | [regex] ] ... ]
show running-config trust-domain
show running-config trust-domain [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
app-service
ca-cert
ca-cert-bundle
ca-key
ca-devices
non-ca-devices
non-default-properties
one-line
partition
recursive
status
trust-group

DELETE/RESTART
restart trust-domain
delete trust-domain
options:
keep-current-certificate-authority
import-user-defined-cert [string]
import-user-defined-key [string]

DESCRIPTION
You can use the trust-domain component to manage the behavior of objects during fail over.

DELETE/RESTART operations
When applied to a trust-domain these operations reset the trust and make this device standalone.

EXAMPLES
Adds a certificate authority:

modify trust-domain add-device { ca-device true device-ip 192.168.1.245 device-name myDevice1 device-port 1234
username admin password admin }

Adds a non-authoritative certificate:

modify trust-domain add-device { ca-device false ip 192.168.1.248 device-name myDevice2 username admin
password admin sha1-fingerprint ab7012e8d834e639f497b2b1c9f1e855a4dbe232}

Removes a device from the trust domain:

modify trust-domain devices delete { myDevice1 myDevice2}

Resets the trust and makes this device standalone:

restart cm trust-domain

delete cm trust-domain

EXAMPLES (deprecated since V13.0.0)
Adds a certificate authority:

modify trust-domain Root ca-devices add { 192.168.1.245 } name myDevice1 username admin password admin

Adds a non-authoritative certificate:

modify trust-domain Root non-ca-devices add { 192.168.1.245 } name myDevice1 username admin password admin

Removes a device from the trust domain:

modify trust-domain Root ca-devices delete { myDevice1 }

OPTIONS
add-device
Adds a device to the trust domain.

device-ip
Device IP address when adding new device.

device-port
Device port number if other than 443 when adding new device. This parameter is optional.

device-name
Device name when adding new device.

username
Specifies the user name required to log on to a device when adding the device to the trust domain.

password
Specifies the password corresponding to the username required to log on to a device when adding the
device to the trust domain.

sha1-fingerprint
Specifies the SSL certificate (DER format) sha1 fingerprint when verifying the identity of a new
device. This field is optional.

app-service
Displays the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify or
delete the object. Only the Application Service can modify or delete the object.

ca-cert
Displays the certificate authority device trust certificate.

ca-cert-bundle
Displays the bundled certificate authority device trust certificates used to authenticate incoming
connections.

ca-devices
Create and modify operations are deprecated since v13.0.0. List operation is still supported. Set of
certificate authority devices in the trust domain.

ca-key
Displays the certificate authority device trust key. This key only displays for certificate authorities.

devices
Removes one or more devices from the trust domain. It takes the name of the device as the identifier.

glob Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.

import-user-defined-cert
Specifies the certificate to import and use as the trust domain's new certificate authority. You must
also use the import-user-defined-key option to specify the corresponding key. This option cannot be
specified alongside keep-current-certificate-authority.

import-user-defined-key
Specifies the key to import and use as the trust domain's new certificate authority key. You must also
use the import-user-defined-cert option to specify the corresponding certificate. This option cannot be
specified alongside keep-current-certificate-authority.

keep-current-certificate-authority
By default, resetting trust will generate a new certificate authority. Adding this option to the delete
command will instead keep the current certificate authority. This option cannot be specified alongside
import-user-defined-cert or import-user-defined-key.

md5-fingerprint
Deprecated since v13.0.0. Specifies the SSL certificate fingerprint when verifying the identity of a new
device.

name Deprecated since v13.0.0. Option used to specify the name of a new device.

non-ca-devices
Create and modify operations are deprecated since v13.0.0. List operation is still supported. Set of
subordinate devices in the trust domain.

password
Deprecated since v13.0.0. Specifies the password for a new device.

recursive
Displays all objects of the specified type and the folder that contains the object.

regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identifier is a regular expression. See help regex for
a description of regular expression syntax.

remove-device
Removes a single device from the trust domain. It takes the name of the device as the identifier.

serial
Deprecated since v13.0.0. Specifies the SSL certificate serial number when verifying the identity of a
new device.

sha1-fingerprint
Deprecated since v13.0.0. Specifies the SSL certificate fingerprint when verifying the identity of a new
device.

signature
Deprecated since v13.0.0. Specifies the SSL certificate signature, when verifying the identity of a new
device.

status
Displays the status of the trust domain.

trust-group
Displays the device group associated with the trust domain.

username
Deprecated since v13.0.0. Specifies the user name required to log on to a device when adding the device
to the trust domain.

SEE ALSO
delete, edit, glob, list, modify, regex, restart, tmsh

COPYRIGHT
No part of this program may be reproduced or transmitted in any form or by any means, electronic or
mechanical, including photocopying, recording, or information storage and retrieval systems, for any purpose
other than the purchaser's personal use, without the express written permission of F5 Networks, Inc.

BIG-IP 2016-10-11 cm trust-domain(1)