Case Iv: Hsm To Hsm Migration - Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Manual

vi serverCertNick.conf
Server-Cert cert-old_DRM_instance

3.2.4. Case IV: HSM to HSM Migration

1. Extract the public/private key pairs from the HSM. The format for the extracted key pairs should be portable, such as
a PKCS #12 file.
The pk12util tool provided by the Certificate System cannot extract public/private key pairs from an HSM be-
cause of requirements in the FIPS 140-1 standard which protect the private key portion of an entry. To extract this in-
formation, contact the HSM vendor for more information. The extracted keys should not have any dependencies, such
as nickname prefixes, on the HSM.
2. Copy the extracted public/private key pairs from the old server to the new server.
cp old_server_root/cert-old_DRM_instance/config/ServerCert.p12
/var/lib/instance_ID/alias/ServerCert.p12
cp old_server_root/cert-old_DRM_instance/config/kraStorageCert.p12
/var/lib/instance_ID/alias/kraStorageCert.p12
cp old_server_root/cert-old_DRM_instance/config/kraTransportCert.p12
/var/lib/instance_ID/alias/kraTransportCert.p12
3. Extract the public key of the old_HSM_slot_name:caSigningCert cert-old_DRM_instance from the old se-
curity databases and save the base-64 encoded output to a file called caSigningCert.b64.
a. Open the old Certificate System's configuration directory.
cd old_server_root/cert-old_DRM_instance/config/
b. Use the old Certificate System's certutil tool to identify the old HSM slot name.
old_server_root/bin/cert/tools/certutil -U -d .
c. Use the old Certificate System's certutil tool to extract the public key from the security databases and save
the base-64 output to a file.
old_server_root/bin/cert/tools/certutil -L
-n "old_HSM_slot_name:caSigningCert cert-old_DRM_instance"
-d . -h old_HSM_token_name -a > caSigningCert.b64
d. Copy the key information from the old server to the new server.
cp old_server_root/cert-old_DRM_instance/config/caSigningCert.b64
/var/lib/instance_ID/alias/caSigningCert.b64
4. Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
5. Log in as root, and set the file user and group to the Certificate System user and group.
su
chown user:group ServerCert.p12
3.2. 4.2SP2, 4.5, and 4.7 Data Re-
covery Manager (DRM) Migration
Databases