Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Manual page 134

LD_LIBRARY_PATH=old_server_root/bin/cert/lib
export LD_LIBRARY_PATH
5. Use the old Certificate System certutil tool to identify the old HSM slot name:
old_server_root/bin/cert/tools/certutil -U -d .
6. Use the old Certificate System certutil tool to extract the public key from the security databases and save the
base-64 output to a file:
old_server_root/bin/cert/tools/certutil -L
-n "old_HSM_slot_name:caSigningCert cert-old_DRM_instance"
-d . -h old_HSM_token_name -a > caSigningCert.b64
7. Copy the key information from the old server to the new server.
cp old_server_root/alias/caSigningCert.b64
/var/lib/instance_ID/alias/caSigningCert.b64
8. Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
9. Log in as root, and set the file user and group to the Certificate System user and group.
su
chown user:group ServerCert.p12
chown user:group kraStorageCert.p12
chown user:group kraTransportCert.p12
chown user:group caSigningCert.b64
10. Log out as root. As the Certificate System user, set the file permissions.
chmod 00600 ServerCert.p12
chmod 00600 kraStorageCert.p12
chmod 00600 kraTransportCert.p12
chmod 00600 caSigningCert.b64
11. Register the new HSM in the new token database.
modutil -nocertdb -dbdir . -add new_HSM_token_name -libfile
new_HSM_library_path/new_HSM_library
12. Identify the new HSM slot name.
modutil -dbdir . -nocertdb -list
13. Import the public/private key pairs of each entry from the PKCS #12 files into the new HSM.
6.2. 7.0 and 7.1 Data Recover Man-
ager (DRM) Migration
Databases