Frequently Asked Questions
================================================================================


.. _connect-to-cluster:

How do I run commands on my Kubernetes cluster?
--------------------------------------------------------------------------------
If you want to run ``kubectl`` commands on your Kubernetes Cluster, connect your
terminal to your cluster.

.. note::

   To only run ``kubectl`` commands, it is not necessary to have the File Share
   mounted. If you are trying to set up the solution, please follow the
   instructions in :ref:`connect-to-file-share` instead.

#. In the Azure `portal <https://portal.azure.com/>`_, enter ``Kubernetes Services`` in the search box. Select **Kubernetes Services**.
#. Click ``inoQulate``.
#. Click ``Connect``.
#. Follow the instructions in the panel.
#. Run the commands.

.. _get-admin-object-id:

How do I retrieve the Object ID of the administrator?
--------------------------------------------------------------------------------
#. In the Azure `portal <https://portal.azure.com/>`_, enter ``Microsoft Entra ID`` in the search box. Select **Microsoft Entra ID**.
#. In the left panel, under **Manage**, select **Users**.
#. Click the Administrator's account.
#. Copy the **Object ID**.


.. _access-admin-webpages:

How do I access the admin webpages of EJBCA and Signserver?
--------------------------------------------------------------------------------
The address of admin webpages of EJBCA and Signserver can be found in
:ref:`address-references`.

If the setup has been completed, you need the client certificate installed on
your computer for authentication to the admin webpages.

#. Download the client certificate from ``config/superadmin.p12`` in the :ref:`Azure File Share <access-file-share>`.
#. Retrieve the client certificate password by command line. See :ref:`connect-to-cluster` and :ref:`Client Cert Password <client-cert-password>`.
#. Install ``superadmin.p12`` into your Operating System, entering the password above. On Windows, double-click the file to install.

   .. note:: Accessing the admin webpages from Chrome/Firefox
  
      If you are accessing the admin webpages on Chrome, Firefox or one of the
      similar derivatives, the client certificate should **not** be installed on
      your Operating System, but in the browser's certificate store directly. See
      :ref:`chrome-firefox-client-cert`.

#. Access the EJBCA or Signserver admin webpage by entering the address in your browser.
#. You should be prompted to select a certificate. Select the certificate you just installed.


.. _address-references:

What's the web address for the EJBCA Admin Page / Signserver Admin Page?
--------------------------------------------------------------------------------
You can retrieve the addresses of EJBCA and Signserver Admin pages specific to
your deployment in the **Deployment Output** page:

#. Navigate to the resource group (typically ``inoQulate``).
#. Click the ``inoQulate`` Managed Application resource.
#. In the left panel, expand **Settings** and click **Parameters and Outputs**.

``caAdminPage`` and ``signerAdminPage`` are the addresses for the EJBCA and
Signserver Admin Pages respectively.


Constructing the Address
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The following table summarises how the URL is constructed, for your information.

.. list-table:: Admin Page Addresses
   :widths: auto

   * - EJBCA Admin Page ``caAdminPage``
     - | ``https://<CA Domain Name Label>.<location>.cloudapp.azure.com/ejbca/adminweb/``
       | e.g., ``https://demo-inoqulate-ca.southeastasia.cloudapp.azure.com/ejbca/adminweb/``
   * - | Signserver Admin Page ``signerAdminPage``
     - | ``https://<Signer Domain Name Label>.<location>.cloudapp.azure.com/signserver/adminweb/``
       | e.g., ``https://demo-inoqulate-signer.southeastasia.cloudapp.azure.com/signserver/adminweb/``

- Substitute ``<CA Domain Name Label>`` for the **CA Domain Name Label** value configured in :ref:`CA Domain Name Label <ca-domain-name-label>`. The default value is ``<domain-prefix>-inoqulate-ca``.
- Substitute ``<Signer Domain Name Label>`` for the **Signer Domain Name Label** value configured in :ref:`Signer Domain Name Label <signer-domain-name-label>`. The default value is ``<domain-prefix>-inoqulate-signer``.
- Substitute ``<location>`` for the region code name of the Kubernetes cluster deployment.


How do I fully uninstall the solution?
--------------------------------------------------------------------------------
You may fully uninstall the solution by deleting the Managed Application
``inoQulate``. Alternatively, if you created a new resource group for inoQulate,
you may delete the resource group, which also deletes the Managed Application.

If you also installed the inoQulate PDF Verifier, you may uninstall it from
**Installed Apps** in your Windows computer.