> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/virtual-hsm/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/virtual-hsm/cli/security-and-encryption/vhsm-pki.md).

# vhsm pki

This command allows you to manage and interact with the PKI Secrets Engine in vHSM. It includes functionalities such as checking PKI mount health, issuing certificates, verifying signatures, and managing certificate chains.

### **Usage**

```shell
vhsm pki <subcommand> [options] [args]
```

The `vhsm pki` command provides subcommands for interacting with vHSM’s PKI Secrets Engine.

For detailed usage of each subcommand, use:

```shell
vhsm pki <subcommand> --help
```

### **Examples**

Check the health of a PKI mount:

```shell
vhsm pki health-check pki
```

### **Subcommands**

| Subcommand                                                                                               | Description                                                                                    |
| -------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| [`health-check`](/virtual-hsm/cli/security-and-encryption/vhsm-pki/vhsm-pki-health-check.md)             | Checks the health and operational status of a PKI Secrets Engine mount.                        |
| [`issue`](/virtual-hsm/cli/security-and-encryption/vhsm-pki/vhsm-pki-issue.md)                           | Generates an issuer on a specified mount using a parent certificate and generation parameters. |
| [`list-intermediates`](/virtual-hsm/cli/security-and-encryption/vhsm-pki/vhsm-pki-list-intermediates.md) | Determines which certificates in a list were issued by a given parent certificate.             |
| [`reissue`](/virtual-hsm/cli/security-and-encryption/vhsm-pki/vhsm-pki-reissue.md)                       | Creates a new issuer on a child mount using a parent certificate and a template certificate.   |
| [`verify-sign`](/virtual-hsm/cli/security-and-encryption/vhsm-pki/vhsm-pki-verify-sign.md)               | Checks whether one certificate validates another specified certificate.                        |