从 config.ini 文件获取配置信息，而不是从正在运行的 ndb_mgmd 获取Obtaining configuration information from a config.ini file rather than a running ndb_mgmd

如果尚不存在，则创建集群的证书颁发机构（CA）Creating the cluster' certificate authority (CA) if it does not yet exist

创建私钥Creating private keys

将密钥和证书保存为待定状态，而非激活状态Saving keys and certificates as pending rather than active

使用本节后面描述的命令行选项为指定的单个节点签署密钥Signing the key for a single node as specified using command-line options described later in this section

请求位于远程主机的 CA 为本地密钥签署Requesting a CA located on a remote host to sign a local key

--bind-host

创建一个证书，并绑定到指定的节点类型主机名列表，这些节点类型应来自 (mgmd,db,api) 集合。Create a certificate bound to a hostname list of node types that should have certificate hostname bindings, from the set (mgmd,db,api).

--bound-hostname

创建一个绑定到传递给此选项的主机名的证书。Create a certificate bound to the hostname passed to this option.

--CA-cert

使用传递给此选项的名称作为 CA 证书文件。Use the name passed to this option for the CA Certificate file.

--CA-days

将证书的有效期设置为此天数。默认值相当于 4 年加 1 天。-1 表示证书永不过期。Set the lifetime of the certificate to this many days. The default is equivalent to 4 years plus 1 day. -1 means the certificate never expires.

此选项在 NDB 8.4.1 中添加。This option was added in NDB 8.4.1.

--CA-key

使用传递给此选项的名称作为 CA 私钥文件名。Use the name passed to this option for the CA private key file.

--CA-ordinal

设置序号 CA 名称；默认值为 First 对于 --create-CA，以及 Second 对于 --rotate-CA。CA 证书中的通用名称为 “MySQL NDB Cluster ordinal Certificate”，其中 ordinal 是传递给此选项的序号名称。Set the ordinal CA name; defaults to First for --create-CA and Second for --rotate-CA. The Common Name in the CA certificate is “MySQL NDB Cluster ordinal Certificate”, where ordinal is the ordinal name passed to this option.

--CA-search-path

指定用于搜索 CA 文件的目录列表。在 Unix 平台上，目录名称用冒号 (:) 分隔；在 Windows 系统上，使用分号 (;) 作为分隔符。目录引用可以是相对路径或绝对路径；它可以包含一个或多个环境变量，每个变量以美元符号 ($) 开头，并在使用前进行展开。Specify a list of directories to search for a CA file. On Unix platforms, the directory names are separated by colons (:); on Windows systems, the semicolon character (;) is used as the separator. A directory reference may be relative or absolute; it may contain one or more environment variables, each denoted by a prefixed dollar sign ($), and expanded prior to use.

搜索从最左边的命名目录开始，从左到右进行，直到找到文件为止。空字符串表示空搜索路径，这会导致所有搜索失败。由单个点（.）组成的字符串表示搜索路径仅限于当前工作目录。Searching begins with the leftmost named directory and proceeds from left to right until a file is found. An empty string denotes an empty search path, which causes all searches to fail. A string consisting of a single dot (.) indicates that the search path is limited to the current working directory.

如果未提供搜索路径，将使用编译时的默认值。此值取决于所使用的平台：在 Windows 上，为 $HOMEPATH\ndb-tls；在其他平台（包括 Linux）上，为 $HOME/ndb-tls。可以通过在编译 NDB Cluster 时使用 -DWITH_NDB_TLS_SEARCH_PATH 来覆盖此默认值。If no search path is supplied, the compiled-in default value is used. This value depends on the platform used: On Windows, this is $HOMEPATH\ndb-tls; on other platforms (including Linux), it is $HOME/ndb-tls. This default can be overridden by compiling NDB Cluster using -DWITH_NDB_TLS_SEARCH_PATH.

--CA-tool

指定一个可执行的辅助工具，包括其路径。Designate an executable helper tool, including the path.

--check

检查证书到期日期。Check certificate expiry dates.

--config-file

提供集群配置文件的路径（通常是config.ini）。Supply the path to the cluster configuration file (usually config.ini).

--connect-retries

设置 ndb_sign_keys 尝试连接集群的次数。如果使用 -1，程序会持续尝试连接，直到成功或被迫停止。Set the number of times that ndb_sign_keys attempts to connect to the cluster. If you use -1, the program keeps trying to connect until it succeeds or is forced to stop.

--connect-retry-delay

设置在连接尝试失败后，ndb_sign_keys 在再次尝试之前等待的秒数，最多尝试次数由 --connect-retries 决定。Set the number of seconds after a failed connection attempt which ndb_sign_keys waits before trying again, up to the number of times determined by --connect-retries.

--create-CA

创建 CA 密钥和证书。Create the CA key and certificate.

--create-key

创建或替换私钥。Create or replace private keys.

--curve

使用指定的曲线加密节点密钥。Use the named curve for encrypting node keys.

--defaults-extra-file

在读取全局文件后读取此选项文件。Read this option file after the global files are read.

--defaults-file

只读取此选项文件。Read this option file only.

--defaults-group-suffix

不仅读取通常的选项组，还读取具有通常名称并带有string后缀的组。Read not only the usual option groups, but also groups with the usual names and a suffix of string.

--duration

设置证书或签名请求的有效期，单位为秒。Set the lifetime of certificates or signing requests, in seconds.

--help

打印帮助文本并退出。Print help text and exit.

--keys-to-dir

指定私钥的输出目录（仅限私钥）；为此，它会覆盖为 --to-dir 设置的任何值。Specify output directory for private keys (only); for this purpose, it overrides any value set for --to-dir.

--login-path

从登录文件读取此路径。Read this path from the login file.

--ndb-connectstring

设置用于连接 ndb_mgmd 的连接字符串，使用语法 [nodeid=id;][host=]hostname[:port]。如果设置了此选项，它将覆盖 NDB_CONNECTSTRING（如果有）中设置的值，以及 my.cnf 文件中配置的任何值。Set the connection string to use for connecting to ndb_mgmd, using the syntax [nodeid=id;][host=]hostname[:port]. If this option is set, it overrides the value set for NDB_CONNECTSTRING (if any), as well as any value set in a my.cnf. file.

--ndb-mgm-tls

设置 ndb_mgm 客户端所需的 TLS 支持级别；可选择 relaxed 或 strict。relaxed（默认）表示尝试建立 TLS 连接，但不要求成功；strict 表示必须通过 TLS 才能连接。Sets the level of TLS support required for the ndb_mgm client; one of relaxed or strict. relaxed (the default) means that a TLS connection is attempted, but success is not required; strict means that TLS is required to connect.

--ndb-tls-search-path

指定包含 TLS 密钥和证书的目录列表。Specify a list of directories containing TLS keys and certificates.

有关语法，请参阅 --CA-search-path 选项的描述。For syntax, see the description of the --CA-search-path option.

--no-config

不获取集群配置；基于提供的选项（包括未指定选项的默认值）创建单个证书。Do not obtain the cluster configuration; create a single certificate based on the options supplied (including defaults for those not specified).

--no-defaults

除了登录文件，不从任何选项文件读取默认选项。Do not read default options from any option file other than the login file.

--no-login-paths

不要从登录路径文件中读取登录路径。Do not read login paths from the login path file.

--passphrase

指定 CA 密钥密码短语。Specify a CA key pass phrase.

--node-id

为具有指定节点 ID 的节点创建或签署密钥。Create or sign a key for the node having the specified node ID.

--node-type

为集合(mgmd,db,api)中指定的类型创建或签署密钥。Create or sign keys for the specified type or types from the set (mgmd,db,api).

--pending

将密钥和证书保存为待定状态，而不是激活状态。Save keys and certificates as pending, rather than active.

--print-defaults

打印程序参数列表，然后退出。Print the program argument list, then exit.

--promote

将待处理的文件提升为活动状态，然后退出。Promote pending files to active, then exit.

--remote-CA-host

指定远程 CA 主机的地址或主机名。Specify the address or hostname of a remote CA host.

--remote-exec-path

提供在使用 --remote-CA-host 指定的远程 CA 主机上的可执行文件的完整路径。Provide the full path to an executable on the remote CA host specified with --remote-CA-host.

--remote-openssl

在使用 --remote-CA-host 指定的远程 CA 主机上使用 OpenSSL 对密钥进行签名。Use OpenSSL for signing of keys on the remote CA host specified with --remote-CA-host.

--replace-by

建议一个周期性检查的证书更换日期，以 CA 到期日后的天数表示。使用负数表示在到期日前的天数。Suggest a certificate replacement date for periodic checks, as a number of days after the CA expiration date. Use a negative number to indicate days before expiration.

--rotate-CA

用较新的 CA 替换旧的 CA。新 CA 可以使用 OpenSSL 创建，或者您可以允许 ndb_sign_keys 创建新 CA，在这种情况下，新 CA 会通过中间 CA 证书创建，并由旧 CA 签名。Replace an older CA with a newer one. The new CA can be created using OpenSSL, or you can allow ndb_sign_keys to create the new one, in which case the new CA is created with an intermediate CA certificate, signed by the old CA.

--schedule

为证书分配到期日的计划。该计划定义为由六个整数组成的逗号分隔列表，格式如下所示：Assign a schedule of expiration dates to certificates. The schedule is defined as a comma-delimited list of six integers, in the format shown here:

api_valid,api_extra,dn_valid,dn_extra,mgm_valid,mgm_extra

这些值定义如下：These values are defined as follows:

换句话说，对于每种节点类型（API 节点、数据节点、管理节点），证书的有效期为一个固定的整天数，加上一个不超过额外天数的随机时间。默认计划如下：In other words, for each node type (API node, data node, management node), certificates are created with a lifetime equal to a whole fixed number of days, plus some random amount of time less than or equal to the number of extra days. The default schedule is shown here:

--schedule=120,10,130,10,150,0

Following the default schedule, client certificates begin expiring on the 120^th day, and expire at random intervals over the next 10 days; data node certificates expire at random times between the 130^th and 140^th days; and management node certificates expire on the 150^th day (with no random interval following).

--sign

创建已签名的证书；默认启用。使用 --skip-sign 来创建证书签名请求。Create signed certificates; enabled by default. Use --skip-sign to create certificate signing requests instead.

--skip-sign

创建证书签名请求，而不是已签名的证书。Create certificate signing requests instead of signed certificates.

--stdio

从 stdin 读取证书签名请求，并将 X.509 写入 stdout。Read certificate signing requests from stdin, and write X.509 to stdout.

--to-dir

指定已创建文件的输出目录。对于私钥文件，可以使用 --keys-to-dir 覆盖此设置。Specify the output directory for created files. For private key files, this can be overriden using --keys-to-dir.

--usage

打印帮助文本，然后退出（--help 的别名）。Print help text, then exit (alias for --help).

--version

打印版本信息，然后退出。Print version information, then exit.