Go to main content

man pages section 8: System Administration Commands

Exit Print View

Updated: Wednesday, February 10, 2021



identity - System Identity configuration




The SMF service svc:/system/identity configures the basic network identity (names) of the Oracle Solaris instance. This includes its nodename, RPC domainname and the default set of X.509 certificates used for the Remote Administration Daemon (RAD) and WebUI.

The service is composed of multiple instances:

  • svc:/system/identity:node

    Sets the hostname/nodename.

  • svc:/system/identity:domain

    Sets the RPC domainname.

  • svc:/system/identity:cert

    Deploys or creates the X.509 certificates for WebUI and RAD connections using the TLS transport.

  • svc:/system/identity:cert-expiry

    X.509Certificate Expiry Check.

  • svc:/system/identity:version

    Updates the value used for 'uname -v'.


The following configuration properties apply to the cert instance:


Generate a new local Certificate Authority and host certifiate issued by the host CA. This option is true by default and is automatically set to false after the certificates have been generated and loaded into the SMF service.


Include IP address Subject Alternative Name entries in the CSR and local CA generated X.509 certificate. This option is set to true by default. Note that RFC 6125 generally advises against the use of IP addresses in X.509 certificates.


Example 1 Regenerating the local host CA and host keys and certificates
# svccfg -s system/identity:cert delcust
# svcadm refresh system/identity:cert
# svcadm restart -s system/identity:cert
Example 2 View the host X.509 certificate
# pktool list keystore=file dir=/etc/certs/localhost
        Filename: /etc/certs/localhost/host.crt
        Subject: CN=myhost.example.com
        Issuer: O=Host Root CA, CN=myhost
        Not Before: Jun 25 16:03:00 2019 GMT
        Not After: Jun 22 16:03:00 2029 GMT
        Serial: 0xF84CDC4E7326
        Signature Algorithm: sha256WithRSAEncryption
        X509v3 Subject Alternative Name:
                IP Address:
                IP Address:
        X509v3 Extended Key Usage:
                TLS Web Server Authentication
        SHA1 Certificate Fingerprint:
Example 3 Specifying a certificate DN For the case where the host can not determine its own fully qualified domain name its self, maybe because it is behind NAT or uses a different DNS to the clients, the value of the DN can be provided:
# svccfg -s system/identity:cert delcust
# svccfg -s system/identity:cert setprop certificate/subject = service.example.com
# svcadm refresh system/identity:cert
# svcadm restart -sr system/identity:cert
Example 4 Setting CA issued X.509 Certificates By default the system will generate a local Certificate Authority (CA) and issue a host certificate from it. This is used as the the default TLS server certificate for svc:/system/webui/server and svc:/system/rad:remote services.

Deployments that can have a certificate issued from a Certificate Authority (CA) should use the following procedure to use that certificate instead, substituting appropriate filenames:

# SVC=svc:/system/identity:cert
# svccfg -s $SVC setprop certificate/cert/pem_value
  = astring: "$(cat /path/to/signed/certificate.crt )"
# svccfg -s $SVC setprop certificate/cert/private_key/pem_value
  = astring: "$(cat /path/to/signed/certificate.key )"
# svccfg -s $SVC setprop certificate/ca/pem_value
  = astring: "$(cat /path/to/issuer/certificate.crt )"
# svcadm refresh $SVC
# svcadm restart -s $SVC

Restarting svc:/system/identity:cert results in svc:/system/webui/server and svc:/system/rad:remote also being started.

See Also

uname(1), hostname(1), domainname(8), webui-service(7)