shc ca reprovision

re-issue an existing tenant CA from a new source (simple swap)

Synopsis

Re-issue (SWAP) an existing tenant CA in place from a new source — either a ca-signer connection (—signer) or an operator-supplied PEM chain (—root + —intermediate + —key). Exactly one source must be given. This is a SIMPLE re-issue (no dual-root grace overlap): every served leaf is re-signed off the new intermediate on the next renewal tick, and any client pinned to the old root must install the new one.

shc ca reprovision [flags]

Options

  -h, --help                  help for reprovision
      --intermediate string   path to the intermediate cert PEM (manual source)
      --key string            path to the intermediate private-key PEM (manual source)
      --root string           path to the root CA cert PEM (manual source)
      --signer string         ca-signer connection name (conn source)
  -t, --tenant string         owning tenant (defaults to the active tenant)
  -y, --yes                   skip confirmation prompt

Options inherited from parent commands

      --config stringArray   extra YAML config file to layer on top of auto-discovered config; repeatable, later files win
  -d, --debug                enable debug mode (default: $SHC_DEBUG)
  -e, --environment string   environment name (default: $SHC_ENVIRONMENT)
      --exclude string       comma-separated dotted paths to drop
      --fields string        comma-separated columns/keys to show (and their order)
      --filter string        comma-separated dotted paths to keep (drops everything else)
  -o, --output string        output format: tty|text|json|yaml (default: $SHC_OUTPUT)
  -s, --stack string         stack name (default: $SHC_STACK)
  -v, --verbose              verbose output (default: $SHC_VERBOSE)

shc ca reprovision

shc ca reprovision

Synopsis

Options

Options inherited from parent commands

SEE ALSO