Case Iii: Hsm To Security Databases Migration - Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Manual

-t "cu,cu,cu" -d . -h new_HSM_token_name
certutil -M -n "new_HSM_slot_name:kraStorageCert cert-old_DRM_instance"
-t "u,u,u" -d . -h new_HSM_token_name
certutil -M -n "new_HSM_slot_name:kraTransportCert cert-old_DRM_instance"
-t "u,u,u" -d . -h new_HSM_token_name
16. Import the public key from the base-64 file into the new HSM, and set the trust bits.
certutil -A -n "new_HSM_slot_name:caSigningCert cert-old_DRM_instance"
-t "CT,c," -d . -h new_HSM_token_name -i caSigningCert.b64
17. Optionally, delete the base-64 file.
rm caSigningCert.b64
18. Open the CS.cfg configuration file.
cd /var/lib/instance_ID/conf/
vi CS.cfg
19. Edit the kra.storageUnit.nickname and kra.transportUNit.nickname attributes to reflect the new
DRM information.
kra.storageUnit.nickname=
new_HSM_slot_name:kraStorageCert cert-old_DRM_instance
kra.transportUnit.nickname=
new_HSM_slot_name:kraTransportCert cert-old_DRM_instance
NOTE
The caSigningCert is not referenced in the CS.cfg file.
20. In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.conf
new_HSM_slot_name:Server-Cert cert-old_DRM_instance

3.2.3. Case III: HSM to Security Databases Migration

1. Extract the public/private key pairs from the HSM. The format for the extracted key pairs should be portable, such as
a PKCS #12 file.
The pk12util tool provided by the Certificate System cannot extract public/private key pairs from an HSM be-
cause of requirements in the FIPS 140-1 standard which protect the private key portion of an entry. To extract this in-
formation, contact the HSM vendor for more information. The extracted keys should not have any dependencies, such
as nickname prefixes, on the HSM.
2. Copy the extracted public/private key pairs from the old server to the new server.
cp old_server_root/cert-old_DRM_instance/config/ServerCert.p12
/var/lib/instance_ID/alias/ServerCert.p12
cp old_server_root/cert-old_DRM_instance/config/kraStorageCert.p12
/var/lib/instance_ID/alias/kraStorageCert.p12
cp old_server_root/cert-old_DRM_instance/config/kraTransportCert.p12
3.2. 4.2SP2, 4.5, and 4.7 Data Re-
covery Manager (DRM) Migration
Databases