Get-ZrClusterCaCert
Provisions the cluster CA if it does not yet exist, then returns or writes its public root certificate (PEM) with the SHA-256 thumbprint — the trust anchor you distribute to client machines.
Syntax
Get-ZrClusterCaCert
[-OutFile <string>]
[-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
Description
Get-ZrClusterCaCert asks the connected manager to provision the cluster certificate authority if it does not already exist (idempotent), then returns its public root certificate in PEM form along with the SHA-256 thumbprint. This is the trust anchor you hand to client machines so they can validate node certificates — verify the printed thumbprint out of band before you trust it, then point clients at it with Connect-ZrStore -TlsCaCert or ZarisClientOptions.Tls.TrustAnchor.
With -OutFile the PEM is written to disk; otherwise it is emitted to the pipeline. The file contains only the public certificate, never the private key. Requires an active workspace or an explicit -Managers list.
For the client side of distributing and trusting this file, see Secured client connect.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
-OutFile | string | No | Path to write the PEM trust file to; when omitted the PEM is emitted to the pipeline. |
-Managers | string[] | No | Management Service endpoints to target; when omitted the active workspace's managers are used. |
-Port | int | No | Management Service port for bare-host managers. Default 7801. |
-Token | string | No | Admin bearer token for authenticated control-plane calls. |
-TimeoutSec | int | No | Per-request timeout in seconds. Default 30. |
Examples
Provision the cluster CA if needed and write the public trust file for distribution to clients.
Get-ZrClusterCaCert -OutFile cluster-ca.crt
Capture the PEM into a variable without writing a file.
$caPem = Get-ZrClusterCaCert