Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Manual page 52

3. Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
4. Log in as root, and set the file user and group to the Certificate System user and group.
su
chown user:group cert7.db
chown user:group key3.db
5. Log out as root. As the Certificate System user, set the file permissions on the certificate and key databases.
chmod 00600 cert7.db
chmod 00600 key3.db
6. Use the certutil tool to list all of the old Certificate System certificates. In this example, -L lists the certificates,
and -X forces them to be read/write.
certutil -L -X -d .
Server-Cert cert-old_DRM_instance cu,cu,cu
caSigningCert cert-old_DRM_instance cT,c,
kraStorageCert cert-old_DRM_instance u,u,u
kraTransportCert cert-old_DRM_instance u,u,u
NOTE
The certificate database is automatically converted from cert7.db to cert8.db.
7. Export the public/private key pairs of each entry in the Certificate System databases using the pk12util tool; -o
exports the key pairs to a PKCS #12 file, and -n sets the name of the certificate and the old database prefix.
pk12util -o ServerCert.p12 -n "Server-Cert cert-old_DRM_instance" -d .
Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
Re-enter password: ********
pk12util: PKCS12 EXPORT SUCCESSFUL
pk12util -o kraStorageCert.p12 -n "kraStorageCert cert-old_DRM_instance" -d .
Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
Re-enter password: ********
pk12util: PKCS12 EXPORT SUCCESSFUL
pk12util -o kraTransportCert.p12 -n "kraTransportCert cert-old_DRM_instance" -d .
Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
Re-enter password: ********
pk12util: PKCS12 EXPORT SUCCESSFUL
NOTE
The old security databases may contain additional public/private key pairs; these can also be extracted using
pk12util.
8. Export the public key using the certutil tool; -L lists the named certificate, -n sets the name of the file and the
old prefix, and -a outputs the information to a base-64 file.
3.2. 4.2SP2, 4.5, and 4.7 Data Re-
covery Manager (DRM) Migration
46 Chapter 7. Step 4: Migrating Security