Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Manual page 120

2. Copy the certificate and key security databases from the old server to the new server.
cp old_server_root/alias/cert-old_CA_instance-cert8.db
/var/lib/instance_ID/alias/cert8.db
cp old_server_root/alias/cert-old_CA_instance-key3.db
/var/lib/instance_ID/alias/key3.db
3. Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
4. Log in as root, and set the file user and group to the Certificate System user and group.
su
chown user:group cert8.db
chown user:group key3.db
5. Log out as root. As the Certificate System user, set the file permissions.
chmod 00600 cert8.db
chmod 00600 key3.db
6. List the certificates stored in the old security databases by using the certutil command. In this example, -L lists
the certificates.
certutil -L -d .
Server-Cert cert-old_CA_instance cu,cu,cu
caSigningCert cert-old_CA_instance cu,cu,cu
ocspSigningCert cert-old_CA_instance CTu,Cu,Cu
subsystemCert cert-old_CA_instance cu,cu,cu
7. Export the public/private key pairs of each entry in the Certificate System databases using the pk12util tool; -o
exports the key pairs to a PKCS #12 file, and -n sets the name of the certificate and the old database prefix.
pk12util -o ServerCert.p12 -n "Server-Cert cert-old_CA_instance" -d .
Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
Re-enter password: ********
pk12util: PKCS12 EXPORT SUCCESSFUL
pk12util -o caSigningCert.p12 -n "caSigningCert cert-old_CA_instance" -d .
Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
Re-enter password: ********
pk12util: PKCS12 EXPORT SUCCESSFUL
pk12util -o ocspSigningCert.p12 -n "ocspSigningCert cert-old_CA_instance" -d .
Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
Re-enter password: ********
pk12util: PKCS12 EXPORT SUCCESSFUL
pk12util -o subsystemCert.p12 -n "subsystemCert cert-old_CA_instance" -d .
Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
Re-enter password: ********
6.1. 7.0 and 7.1 Certificate Author-
ity (CA) Migration
114 Chapter 7. Step 4: Migrating Security