Red Hat CERTIFICATE SYSTEM 6.0 - MIGRATION GUIDE Manual page 41

# chown user:group caSigningCert.b64
7. Log out as , and log back into the system as the Certificate System user.
root
8. Set the file permissions.
chmod 00600 ServerCert.p12
chmod 00600 kraStorageCert.p12
chmod 00600 kraTransportCert.p12
chmod 00600 caSigningCert.b64
9. Register the new HSM in the 7.3 token database.
modutil -nocertdb -dbdir . -add new_HSM_token_name -libfile
new_HSM_library_path/new_HSM_library
10. I dentify the new HSM slot name.
modutil -dbdir . -nocertdb -list
11. I mport the public/private key pairs of each entry from the PKCS #12 files into the new HSM.
pk12util -i ServerCert.p12 -d . -h new_HSM_slot_name
Enter Password or Pin for "new_HSM_slot_name":********
Enter password for PKCS12 file: ********
pk12util: PKCS12 IMPORT SUCCESSFUL
pk12util -i kraStorageCert.p12 -d . -h new_HSM_slot_name
Enter Password or Pin for "new_HSM_slot_name":********
Enter password for PKCS12 file: ********
pk12util: PKCS12 IMPORT SUCCESSFUL
pk12util -i kraTransportCert.p12 -d . -h new_HSM_slot_name
Enter Password or Pin for "new_HSM_slot_name":********
Enter password for PKCS12 file: ********
pk12util: PKCS12 IMPORT SUCCESSFUL
12. O ptionally, delete the PKCS #12 files.
rm ServerCert.p12
rm kraStorageCert.p12
rm kraTransportCert.p12
Option 4: HSM to HSM Migration
35