Restore-ZrClusterCaKey
Restores the cluster CA private key from a passphrase-encrypted backup produced by Backup-ZrClusterCaKey, installing the CA on the connected manager.
Syntax
Restore-ZrClusterCaKey
-InFile <string>
-Passphrase <SecureString>
[-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
[-WhatIf] [-Confirm]
Description
Restore-ZrClusterCaKey reads a passphrase-encrypted CA-key backup created by Backup-ZrClusterCaKey, decrypts it with the supplied passphrase, and installs the CA on the connected manager, reporting the restored thumbprint. A wrong passphrase or a corrupt backup fails the restore. Requires an active workspace or an explicit -Managers list.
This installs the cluster CA private key — the signing authority for every node certificate — onto the target manager. Run it only when recovering or migrating the cluster CA to a new issuer host, against the manager you intend to make the issuer. Handle the backup file and passphrase as top secrets: never commit them, and remove the backup from the host once the restore succeeds.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
-InFile | string | Yes | Path to the encrypted CA-key backup file to restore. Position 0. |
-Passphrase | SecureString | Yes | Passphrase that was used to encrypt the backup file. |
-Managers | string[] | No | Management Service endpoints to target; when omitted the active workspace's managers are used. |
-Port | int | No | Management Service port for bare-host managers. Default 7801. |
-Token | string | No | Admin bearer token for authenticated control-plane calls. |
-TimeoutSec | int | No | Per-request timeout in seconds. Default 30. |
Supports -WhatIf and -Confirm.
Examples
Restore the cluster CA from an encrypted backup using an interactively entered passphrase.
Restore-ZrClusterCaKey -InFile cluster-ca-key.enc -Passphrase (Read-Host -AsSecureString)