Red Hat SYSTEM 8.0 - MIGRATION GUIDE 7.X TO 8.0 Manual page 28

Chapter 3. Migrating a CA Instance to Certificate System 8.0
rm /var/lib/new_CA_instance/alias/key3.db
2. Copy the certificate and key security databases from the 7.x server to the 8.0 server.
cp old_server_root/alias/cert-old_instance-cert8.db /var/lib/new_CA_instance/alias/
cert8.db
cp old_server_root/alias/cert-old_instance-key3.db /var/lib/new_CA_instance/alias/key3.db
WARNING
Changing either the instance name or the fully-qualified domain name is not
supported for migration. The fully-qualified domain name of the host machine for the
new instance must be the same as the fully-qualified domain name of the original
instance. Likewise, the new instance name must also be the same as the original
instance name.
The instance and domain information has to be the same for both instances because
the certificate and key material — among other instance and database information —
has to be the same.
3. Open the Certificate System /alias directory.
cd /var/lib/new_CA_instance/alias/
4. Log into the 8.0 server as root.
5. Set the file user and group to the Certificate System user and group.
# chown user:group cert8.db
# chown user:group key3.db
6. Log out as root and change to the Certificate System user login.
7. Set the file permissions.
chmod 00600 cert8.db
chmod 00600 key3.db
8. List the contents of the certificate database using the certutil tool. In this example, -L lists the
certificates in the database.
certutil -L -d .
Server-Cert cert-old_CA_instance cu,cu,cu
caSigningCert cert-old_CA_instance cu,cu,cu
ocspSigningCert cert-old_CA_instance CTu,Cu,Cu
subsystemCert cert-old_CA_instance cu,cu,cu
9. Open the CS.cfg configuration file in the /var/lib/instance_ID/conf/ directory.
18