Case Iv: Hsm To Hsm Migration - Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Manual

ocspSigningCert cert-old_CA_instance
11. If there is CA-DRM connectivity, then also modify the ca.connector.KRA.nickname attribute.
ca.connector.KRA.nickname=caSigningCert cert-old_CA_instance
12. In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.conf
Server-Cert cert-old_CA_instance

4.1.4. Case IV: HSM to HSM Migration

1. Extract the public/private key pairs from the HSM. The format for the extracted key pairs should be portable, such as
a PKCS #12 file.
The pk12util tool provided by the Certificate System cannot extract public/private key pairs from an HSM be-
cause of requirements in the FIPS 140-1 standard which protect the private key portion of an entry. To extract this in-
formation, contact the HSM vendor for more information. The extracted keys should not have any dependencies, such
as nickname prefixes, on the HSM.
2. Copy the extracted key pairs from the old server to the new server.
cp old_server_root/alias/ServerCert.p12
/var/lib/instance_ID/alias/ServerCert.p12
cp old_server_root/alias/caSigningCert.p12
/var/lib/instance_ID/alias/caSigningCert.p12
cp old_server_root/alias/ocspSigningCert.p12
/var/lib/instance_ID/alias/ocspSigningCert.p12
3. Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
4. Log in as root, and set the file user and group to the Certificate System user and group.
su
chown user:group ServerCert.p12
chown user:group caSigningCert.p12
chown user:group ocspSigningCert.p12
5. Log out as root. As the Certificate System user, set the file permissions on the PKCS #12 files.
chmod 00600 ServerCert.p12
chmod 00600 caSigningCert.p12
chmod 00600 ocspSigningCert.p12
6. Register the new HSM in the new token database.
modutil -nocertdb -dbdir . -add new_HSM_token_name -libfile
new_HSM_library_path/new_HSM_library
4.1. 6.0 Certificate Authority (CA)
Migration
Databases