Case Iv: Hsm To Hsm Migration - Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Manual

certutil -A -n "caSigningCert cert-old_DRM_instance"
-t "CT,c," -d . -i caSigningCert.b64
11. Optionally, delete the base-64 file.
rm caSigningCert.b64
12. Open the CS.cfg configuration file.
cd /var/lib/instance_ID/conf/
13. Modify the kra.storageUnit.nickname and kra.transportUnit.nickname attributes to reflect the
new DRM instance.
kra.storageUnit.nickname=
kraStorageCert cert-old_DRM_instance
kra.transportUnit.nickname=
kraTransportCert cert-old_DRM_instance
NOTE
The caSigningCert attribute is not referenced in the CS.cfg file.
14. In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.conf
Server-Cert cert-old_DRM_instance

2.2.4. Case IV: HSM to HSM Migration

1. Extract the public/private key pairs from the HSM. The format for the extracted key pairs should be portable, such as
a PKCS #12 file.
The pk12util tool provided by the Certificate System cannot extract public/private key pairs from an HSM be-
cause of requirements in the FIPS 140-1 standard which protect the private key portion of an entry. To extract this in-
formation, contact the HSM vendor for more information. The extracted keys should not have any dependencies, such
as nickname prefixes, on the HSM.
2. Copy the data from the old server to the new server.
cp old_server_root/cert-old_DRM_instance/config/ServerCert.p12
/var/lib/instance_ID/alias/ServerCert.p12
cp old_server_root/cert-old_DRM_instance/config/kraStorageCert.p12
/var/lib/instance_ID/alias/kraStorageCert.p12
cp old_server_root/cert-old_DRM_instance/config/kraTransportCert.p12
/var/lib/instance_ID/alias/kraTransportCert.p12
3. Extract the public key of the old_HSM_slot_name:caSigningCert cert-old_DRM_instance entry from the
old security databases, and save the base-64 encoded output to a file called caSigningCert.b64.
a. Open the old Certificate System's configuration directory.
cd old_server_root/cert-old_DRM_instance/config/
2.2. 4.2 Data Recovery Manager
(DRM) Migration
33 Chapter 7. Step 4: Migrating Security