Red Hat CERTIFICATE SYSTEM 8 Install Manual page 44

Chapter 3. Installation and Configuration
Having unique certificate nicknames is vital for using an HSM, since any nickname
conflicts (even for subsystems on different servers) will cause configuration to fail.
10. The next panels generate and show certificate requests, certificates, and key pairs.
If an external CA is used to issue the certificates, configuration cannot go forward until they are
received from the external CA. When they are issued, paste the certificates into this panel to
add them to the CA database, and then proceed with the installation. Click Apply to view the
certificates as they are imported.
11. If the subsystem will ever be cloned, or as a protection if keys or certificates are ever lost, back up
the keys and certificates when prompted. It is also possible to extract these keys later, as long as
they are not stored on an HSM.
NOTE
It is not possible to export keys and certificates stored on an HSM to a .p12 file. It is
also not necessary to extract keys from the HSM to clone a subsystem. The keys are
already stored on the HSM and accessible to any cloned instances.
34