Case Iv: Hsm To Hsm Migration - Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Manual

certutil -M -n "Server-Cert cert-old_CA_instance"
-t "cu,cu,cu" -d .
certutil -M -n "caSigningCert cert-old_CA_instance"
-t "CTu,CTu,CTu" -d .
certutil -M -n "ocspSigningCert cert-old_CA_instance"
-t "CTu,Cu,Cu" -d .
certutil -M -n "subsystemCert cert-old_CA_instance"
-t "cu,cu,cu" -d .
9. Open the CS.cfg configuration file.
cd /var/lib/instance_ID/conf/
vi CS.cfg
10. Edit the ca.signing.cacertnickname and ca.ocsp_signing.cacertnickname attributes to reflect
the new subsystem information.
ca.signing.cacertnickname=
caSigningCert cert-old_CA_instance
ca.ocsp_signing.cacertnickname=
ocspSigningCert cert-old_CA_instance
11. If there is CA-DRM connectivity, then also modify the ca.connector.KRA.nickname attribute.
ca.connector.KRA.nickname=caSigningCert cert-old_CA_instance
12. In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.conf
Server-Cert cert-old_CA_instance

6.1.4. Case IV: HSM to HSM Migration

1. Extract the public/private key pairs from the HSM. The format for the extracted key pairs should be portable, such as
a PKCS #12 file.
The pk12util tool provided by the Certificate System cannot extract public/private key pairs from an HSM be-
cause of requirements in the FIPS 140-1 standard which protect the private key portion of an entry. To extract this in-
formation, contact the HSM vendor for more information. The extracted keys should not have any dependencies, such
as nickname prefixes, on the HSM.
2. Copy the extracted public/private key pairs from the old server to the new server.
cp old_server_root/alias/ServerCert.p12
/var/lib/instance_ID/alias/ServerCert.p12
cp old_server_root/alias/caSigningCert.p12
/var/lib/instance_ID/alias/caSigningCert.p12
cp old_server_root/alias/ocspSigningCert.p12
/var/lib/instance_ID/alias/ocspSigningCert.p12
cp old_server_root/alias/subsystemCert.p12
/var/lib/instance_ID/alias/subsystemCert.p12
6.1. 7.0 and 7.1 Certificate Author-
ity (CA) Migration
118 Chapter 7. Step 4: Migrating Security