Import The Public/Private Key Pairs Of Each Entry From The Pkcs #12 Files Into The New Hsm; Pk12Util -I Servercert.p12 -D . -H New_Hsm_Slot_Name; Enter Password Or Pin For "New_Hsm_Slot_Name; Enter Password For Pkcs12 File - Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Manual

rm cert8.db
rm key3.db
10. Register the new HSM in the new token database.
modutil -nocertdb -dbdir . -add new_HSM_token_name -libfile
new_HSM_library_path/new_HSM_library
11. Identify the new HSM slot name.
modutil -dbdir . -nocertdb -list
12. Create new security databases.
certutil -N -d .

13. Import the public/private key pairs of each entry from the PKCS #12 files into the new HSM.

pk12util -i ServerCert.p12 -d . -h new_HSM_slot_name

Enter Password or Pin for "new_HSM_slot_name":********

Enter password for PKCS12 file: ********

pk12util: PKCS12 IMPORT SUCCESSFUL

pk12util -i kraStorageCert.p12 -d . -h new_HSM_slot_name
Enter Password or Pin for "new_HSM_slot_name":********
Enter password for PKCS12 file: ********
pk12util: PKCS12 IMPORT SUCCESSFUL
pk12util -i kraTransportCert.p12 -d . -h new_HSM_slot_name
Enter Password or Pin for "new_HSM_slot_name":********
Enter password for PKCS12 file: ********
pk12util: PKCS12 IMPORT SUCCESSFUL
14. Optionally, delete the PKCS #12 files.
rm ServerCert.p12
rm kraStorageCert.p12
rm kraTransportCert.p12
15. Set the trust bits on the public/private key pairs that were imported into the new HSM.
certutil -M -n "new_HSM_slot_name:Server-Cert cert-old_DRM_instance"
-t "cu,cu,cu" -d . -h new_HSM_token_name
certutil -M -n "new_HSM_slot_name:kraStorageCert cert-old_DRM_instance"
-t "u,u,u" -d . -h new_HSM_token_name
certutil -M -n "new_HSM_slot_name:kraTransportCert cert-old_DRM_instance"
-t "u,u,u" -d . -h new_HSM_token_name
16. Import the public key from the base-64 file into the new HSM, and set the trust bits.
5.2. 6.1 and 6.2 Data Recovery
Manager (DRM) Migration
97 Chapter 7. Step 4: Migrating Security