Import-ZrClusterCa
Adopts an operator-provided certificate authority (a PKCS#12 holding the CA certificate and its private key) as the cluster CA on every connected manager, so Clustron signs node leaf certificates from your CA instead of a generated one — bring-your-own-CA.
Syntax
Import-ZrClusterCa
-CaFile <string>
[-CaPassword <SecureString>]
[-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
[-WhatIf] [-Confirm]
Description
Import-ZrClusterCa reads the CA PKCS#12 you supply, validates locally that it carries a private key, and adopts it as the cluster CA on every connected manager — replacing any generated CA. From then on, node leaf certificates are signed by your CA rather than a Clustron-generated one. The CA can be a root (leaves chain straight to it) or an intermediate that chains to your enterprise root.
Run this before Enable-ZrStoreTls; that cmdlet keeps the imported CA and only generates one when none exists. When more than one manager is connected the same CA is applied to each, so a multi-machine cluster shares one signing authority. Requires an active workspace or an explicit -Managers list.
This is the bring-your-own-CA (M1) mode described in the CA trust modes guide.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
-CaFile | string | Yes | Path to the CA PKCS#12 (.pfx/.p12) containing the CA certificate and its private key. Position 0. |
-CaPassword | SecureString | No | Password protecting the CA PKCS#12, if any. |
-Managers | string[] | No | Management Service endpoints to target; when omitted the active workspace's managers are used. |
-Port | int | No | Management Service port for bare-host managers. Default 7801. |
-Token | string | No | Admin bearer token for authenticated control-plane calls. |
-TimeoutSec | int | No | Per-request timeout in seconds. Default 30. |
Supports -WhatIf and -Confirm.
Examples
Adopt an enterprise CA as the cluster CA, entering the PKCS#12 password interactively.
Import-ZrClusterCa -CaFile enterprise-ca.pfx -CaPassword (Read-Host -AsSecureString)
Import a password-less CA bundle, then enable TLS on a store so its node leaves are signed by your CA.
Import-ZrClusterCa -CaFile enterprise-ca.pfx
Enable-ZrStoreTls -Store orders -Restart