Red Hat CERTIFICATE SYSTEM 7.0 - MIGRATION GUIDE Manual page 49

# chown user:group caSigningCert.b64
7. Log out as . As the Certificate System user, set the file permissions.
root
chmod 00600 ServerCert.p12
chmod 00600 ocspSigningCert.p12
chmod 00600 caSigningCert.b64
8. Import the public/private key pairs of each entry from the PKCS #12 files into the 7.3 security
databases.
pk12util -i ServerCert.p12 -d .
Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
pk12util: PKCS12 IMPORT SUCCESSFUL
pk12util -i ocspSigningCert.p12 -d .
Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
pk12util: PKCS12 IMPORT SUCCESSFUL
9. Optionally, delete the PKCS #12 files.
rm ServerCert.p12
rm ocspSigningCert.p12
10. S et the trust bits on the public/private key pairs that were imported into the 7.3 security
databases.
certutil -M -n "Server-Cert cert-old_OCSP_instance" -t "cu,cu,cu" -d .
certutil -M -n "ocspSigningCert cert-old_OCSP_instance" -t "cu,cu,cu" -d .
11. I mport the public key from the base-64 file, and set the trust bits.
certutil -A -n "caSigningCert cert-old_OCSP_instance" -t "CT,c," -d . -i
caSigningCert.b64
12. O ptionally, delete the base-64 file.
rm caSigningCert.b64
Migration
43