Case Iii: Hsm To Security Databases Migration - Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Manual

cd /var/lib/instance_ID/conf/
vi CS.cfg
16. Modify the value for the ca.signing.cacertnickname and ca.ocsp_signing.cacertnickname at-
tributes to reflect the new HSM information.
ca.signing.cacertnickname=
new_HSM_slot_name:caSigningCert cert-old_CA_instance
ca.ocsp_signing.cacertnickname=
new_HSM_slot_name:caSigningCert cert-old_CA_instance
17. In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.conf
new_HSM_slot_name:Server-Cert cert-old_CA_instance

1.3. Case III: HSM to Security Databases Migration

1. Extract the public/private key pairs from the HSM. The format for the extracted key pairs should be portable, such as
a PKCS #12 file.
The pk12util tool provided by the Certificate System cannot extract public/private key pairs from an HSM be-
cause of requirements in the FIPS 140-1 standard which protect the private key portion of an entry. To extract this in-
formation, contact the HSM vendor for more information. The extracted keys should not have any dependencies, such
as nickname prefixes, on the HSM.
2. Copy this PKCS #12 file from the old server to the new server.
cp old_server_root/cert-old_CA_instance/config/ServerCert.p12
/var/lib/instance_ID/alias/ServerCert.p12
cp old_server_root/cert-old_CA_instance/config/caSigningCert.p12
/var/lib/instance_ID/alias/caSigningCert.p12
3. Log into the new server machine as the Certificate System user account. Open the new server alias/ directory.
cd /var/lib/instance_ID/alias/
4. Log in as root and change the file user and group to the Certificate System user and group.
su
chown user:group ServerCert.p12
chown user:group caSigningCert.p12
5. Log out as root. As the regular Certificate System user, change the permissions on the key pair files.
chmod 00600 ServerCert.p12
chmod 00600 caSigningCert.p12
6. Import the public/private key pairs from the PKCS #12 files into the security databases; -i imports the designated
file.
1.3. Case III: HSM to Security
Databases Migration
Databases