Case Ii: Security Databases To Hsm Migration - Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Manual

6. List the certificates in the old security databases by using the certutil tool. In this example, -L lists the certific-
ates.
certutil -L -d .
Server-Cert cert-old_DRM_instance cu,cu,cu
caSigningCert cert-old_DRM_instance CT,c,
kraStorageCert cert-old_DRM_instance u,u,u
kraTransportCert cert-old_DRM_instance u,u,u
7. Open the CS.cfg configuration file.
cd /var/lib/instance_ID/conf/
vi CS.cfg
8. Edit the kra.storageUnit.nickname and kra.transportUnit.nickname attribute to reflect the new
DRM instance.
kra.storageUnit.nickname=
kraStorageCert cert-old_DRM_instance
kra.transportUnit.nickname=
kraTransportCert cert-old_DRM_instance
NOTE
The caSigningCert is not referenced in the CS.cfg file.
9. In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.conf
Server-Cert cert-old_DRM_instance

5.2.2. Case II: Security Databases to HSM Migration

1. Remove all the security databases in the new Certificate System which will receive migrated data.
rm /var/lib/instance_ID/alias/cert8.db
rm /var/lib/instance_ID/alias/key3.db
2. Copy the certificate and key security databases from the old server to the new server.
cp old_server_root/alias/cert-old_DRM_instance-cert8.db
/var/lib/instance_ID/alias/cert8.db
cp old_server_root/alias/cert-old_DRM_instance-key3.db
/var/lib/instance_ID/alias/key3.db
3. Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
4. Log in as root, and set the file user and group to the Certificate System user and group.
5.2. 6.1 and 6.2 Data Recovery
Manager (DRM) Migration
Databases