Step 1: Preparing The Old Server; Step 2: Creating A New Certificate System Installation; Step 3: Stopping All New Certificate System Instances; Step 4: Migrating Security Databases - Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Manual

2.1. Step 1: Preparing the Old Server

Since a complete backup of all Certificate Management System 6.1 (SP 4) instances was made during the CA subsystem
migration, it is not required to make another backup during the DRM subsystem migration.
NOTE
All the Certificate System 6.1 subsystems should still be stopped from the previous migration.

2.2. Step 2: Creating a New Certificate System Installation

1. Install a new Certificate System 7.2 DRM on the Red Hat Enterprise Linux 4 (AS) machine, serv-
er.example.com.
a. Download the Certificate System packages from the Red Hat Network or through the up2date command.
b. To install the subsystems, run the install utility; this is not necessary if the subsystems were installed through
up2date.
rhpki-install -pki-subsystem=kra
-pki_package_path=/media/cdrom/RedHat/RPMS -force
2. Configure the DRM instance. It is possible to change the names of migrated Certificate System subsystem instances,
but greater care must be taken when extracting and renaming certain portions of the data. Because port numbers are
stored in the server.xml file, which is unaffected by subsystem migration, port numbers can be changed between
instances without difficulty.
Go through the HTML configuration wizard. When the installation process is completed, the server returns a URL
pointing to the configuration wizard. For example:
http://server.example.com:10080/kra/admin/console/config/
login?pin=Yc6EuvuY2OeezKeX7REk
For more information on the panels in the configuration wizard, see chapter 2, "Installation and Configuration," in the
Certificate System Administration Guide.

2.3. Step 3: Stopping All New Certificate System Instances

1. Stop the 7.2 DRM and CA instances.
/etc/init.d/rhpki-kra stop
/etc/init.d/rhpki-ca stop
2. Stop the Directory Server instance.
cd /opt/redhat-ds/slapd-ds
./stop-slapd

2.4. Step 4: Migrating Security Databases

NOTE
In order to recover the archived keys stored in the 6.1 (SP4) DRM, obtain a migration patch from Red Hat ser-
vices. This patch will recover the PIN needed to access the storage token where the DRM private key resides.
Do the following to migrate the Certificate Management System 6.1 (SP4) DRM data to the Certificate System 7.2 DRM
2.2. Step 2: Creating a New Certi-
ficate System Installation
Certificate System Migration