---
title: "oz0 server provisioner issue"
description: "Issue a key and a provisioner certificate valid for 90 days, and a CLI context, and add the provisioner if the cluster has none of that name."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/server/provisioner/issue"
---
# oz0 server provisioner issue

> Issue a key and a provisioner certificate valid for 90 days, and a CLI context, and add the provisioner if the cluster has none of that name.

For: Operators and developers looking up a command.

Issue a key and a provisioner certificate valid for 90 days, and a CLI context, and add the provisioner if the cluster has none of that name. --provider names each identity provider it may act for (repeat it), replacing the ones it had. It runs on a server's machine: it reads the database and the master key. The provisioner renews its certificate with oz0 operator renew in its context.

## Usage

```bash
oz0 server provisioner issue NAME --provider ID [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --advertise
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        127.0.0.1
      </code>
    </td>
    
    <td>
      server address for a new CLI context
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --ca-signer-command
      </code>
    </td>
    
    <td>
      command
    </td>
    
    <td>
      
    </td>
    
    <td>
      a command that signs with the cluster CA's key outside the server, such as in an HSM or a KMS: "COMMAND public-key" prints the key as PEM, "COMMAND sign sha256" signs the digest on stdin
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --data-dir
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        ~/.local/share/orchestrator-zero
      </code>
    </td>
    
    <td>
      server data directory
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --db-file
      </code>
    </td>
    
    <td>
      file
    </td>
    
    <td>
      
    </td>
    
    <td>
      a file (- for stdin) holding the PostgreSQL URL of the management database, such as postgres://oz0:PASSWORD@db:5432/oz0 (or set OZ0_DB); the URL can carry a password, so it never goes on the command line
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --dev
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      a dev server's data directory (--data-dir): its database and master key
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --dir
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        &lt;config dir>/orchestrator-zero/provisioner-&lt;name>
      </code>
    </td>
    
    <td>
      where to write the credentials
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --master-key-command
      </code>
    </td>
    
    <td>
      command
    </td>
    
    <td>
      
    </td>
    
    <td>
      a command that unwraps the master key from --master-key-file when the file holds it wrapped, such as with an HSM or a KMS: "COMMAND unwrap" prints the key from the wrapped document on stdin, "COMMAND wrap" wraps one, "COMMAND describe" says what holds the wrapping key (see the docs on key commands) (or set OZ0_MASTER_KEY_COMMAND)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --master-key-file
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        &lt;data-dir>/master.key
      </code>
    </td>
    
    <td>
      master key file
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --provider
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      an identity provider it may act for (repeat it)
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.