Docker Operations

This page lists the available commands for the keymanager script. Additionally, it provides details for commonly used commands.

The keymanager script, created by the installer, runs all post-installation tasks.

tip

The sample commands below are always shown for a Linux installation. On Windows, substitute .\keymanager.ps1 -Command with the same operations.

Commands

Command	Purpose
status	Show service status and health checks
services	Toggle optional services (MCP, Discovery, Compliance, KMIP)
add-tsb	Onboard an additional on-prem TSB instance
tls-rotate	Re-create the self-signed TLS key and certificate of the Key Manager UI and restart the gateway
uninstall	Remove everything (containers, volumes, configuration, data)
start [svc]	Start services, all or a specific one
stop [svc]	Stop services, all or a specific one
logs [svc]	View service logs, all services or a specific one
restart [svc]	Restart services, all or a specific one
update	Pull the latest images and restart the stack
check-updates	Check the registry for newer images (KMS, TSB, KMIP)
self-update	Update the keymanager script itself to the latest version
version	Show version and image info
help	Show the help message

tls-rotate accepts --cn <common-name> and --san <dns1,ip1,...>. Without flags, it prompts for the common name and the subject alternative names.

warning

Restarting the auth service seals the KMS. This applies to keymanager restart, keymanager restart auth, and keymanager update. Unseal the instance via /unseal.

Status

keymanager status reports the container states followed by the service health checks:

Health Checks:
  Auth        healthy
  Keycore     healthy
  Dashboard   healthy

To verify the instance is reachable from outside the stack, call the gateway directly:

curl -k https://localhost:8443

Logs

Pass a service name to narrow the output to the component you are investigating:

keymanager logs auth         # authentication requests and activity
keymanager logs tsb-rest-api # TSB connections to your HSM Partition, on-prem TSB only

Updates

Run keymanager check-updates to see whether newer images exist, then keymanager update to pull them and restart the stack. After the update, you should:

1. Check container status
2. Unseal the KMS
3. Verify the gateway and key workflows

keymanager self-update updates the script itself and does not touch the running stack.

Uninstall

keymanager uninstall removes containers, volumes, configuration, and data. The KMS UI keeps all state in HSM data objects (nothing is stored in container volumes). These objects are not deleted by keymanager uninstall. Therefore, the KMS UI can be reinstalled without data loss, as long as you connect it to the same Base Partition.

danger

If you manually delete the objects storing the KMS state from the Base Partition via an API (REST, JCE, PKCS#11, ...), the KMS needs to be reinstalled from scratch.