Testing The Key Archival And Recovery Setup - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

3. Edit the two recovery scheme parameters.
kra.noOfRequiredRecoveryAgents=3
kra.recoveryAgentGroup=Data Recovery Manager Agents
4. Restart the server.
service pki-kra start
The default key agent scheme requires a single agent from the Data Recovery Manager Agents group
to be in charge of authorizing key recovery.
It is also possible to customize the appearance of the key recovery form. Key recovery agents need
an appropriate page to initiate the key recovery process. By default, the DRM's agent services page
includes the appropriate HTML form to allow key recovery agents to initiate key recovery, authorize
key recovery requests, and retrieve the encryption keys. This form is located in the /var/lib/pki-
kra/webapps/kra/agent/kra/ directory, called confirmRecover.html.
IMPORTANT
If the key recovery confirmation form is customized, do not to delete any of the information
for generating the response. This is vital to the functioning of the form. Restrict any
changes to the content in and appearance of the form.

3.4. Testing the Key Archival and Recovery Setup

To test whether a key can be successfully archived:
1. Enroll for dual certificates using the CA's Manual User Signing & Encryption Certificates
Enrollment form.
2. Submit the request. Log in to the agent services page, and approve the request.
3. Log into the end-entities page, and check to see if the certificates have been issued. In the list of
certificates, there should be two new certificates with consecutive serial numbers.
4. Import the certificates into the web browser.
5. Confirm that the key has been archived. In the DRM's agent services page, select Show
completed requests. If the key has been archived successfully, there will be information about
that key. If the key is not shown, check the logs, and correct the problem. If the key has been
successfully archived, close the browser window.
6. Verify the key. Send a signed and encrypted email. When the email is received, open it, and check
the message to see if it is signed and encrypted. There should be a security icon at the top-right
corner of the message window that indicates that the message is signed and encrypted.
7. Delete the certificate. Check the encrypted email again; the mail client should not be able to
decrypt the message.
8. Test whether an archived key can be recovered successfully:
Testing the Key Archival and Recovery Setup
73