7.2.2.3. Case III: HSM to Security Databases Migration

Extract the public/private key pairs from the HSM. The format for the extracted key pairs should be portable, such as a PKCS #12 file.

The pk12util tool provided by the Certificate System cannot extract public/private key pairs from an HSM because of requirements in the FIPS 140-1 standard which protect the private key portion of an entry. To extract this information, contact the HSM vendor for more information. The extracted keys should not have any dependencies, such as nickname prefixes, on the HSM.

Copy the extracted key pairs from the old server to the new server.

cp old_server_root/cert-old_DRM_instance/config/ServerCert.p12 
/var/lib/instance_ID/alias/ServerCert.p12

cp old_server_root/cert-old_DRM_instance/config/kraStorageCert.p12 
/var/lib/instance_ID/alias/kraStorageCert.p12

cp old_server_root/cert-old_DRM_instance/config/kraTransportCert.p12 
/var/lib/instance_ID/alias/kraTransportCert.p12

Extract the public key of the old_HSM_slot_name:caSigningCert cert-old_DRM_instance certificate from the old security databases, and save the base-64 encoded output to a file called caSigningCert.b64.
1. Open the old Certificate System's configuration directory.
```
cd old_server_root/cert-old_DRM_instance/config/
```
2. Use the certutil tool from the old Certificate System installation to identify the old HSM slot name.
```
old_server_root/bin/cert/tools/certutil -U -d .
```
3. Extract the public key using the certutil tool, and save the output to a base 64 file. In this example, -L lists the named certificate, -n names the certificate and old Certificate System directory prefix, -h gives the name of the old HSM, and -a saves it to the base 64 file.
```
old_server_root/bin/cert/tools/certutil -L
 -n "old_HSM_slot_name:caSigningCert cert-old_DRM_instance"
 -d . -h old_HSM_token_name -a > caSigningCert.b64
```
4. Copy the base 64 file from the old server to the new server.
```
cp old_server_root/cert-old_DRM_instance/config/caSigningCert.b64 
/var/lib/instance_ID/alias/caSigningCert.b64
```
Log into the new server as the Certificate System user, and open the alias/ directory.
```
cd /var/lib/instance_ID/alias/
```

su

chown user:group ServerCert.p12

chown user:group kraStorageCert.p12

chown user:group kraTransportCert.p12

chown user:group caSigningCert.b64

Log out as root. As the Certificate System user, set the file permissions on the certificate files.

chmod 00600 ServerCert.p12

chmod 00600 kraStorageCert.p12

chmod 00600 kraTransportCert.p12

chmod 00600 caSigningCert.b64

Import the public/private key pairs from the PKCS #12 files into the new security databases.

pk12util -i ServerCert.p12 -d . 

Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
pk12util: PKCS12 IMPORT SUCCESSFUL

pk12util -i kraStorageCert.p12 -d . 

Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
pk12util: PKCS12 IMPORT SUCCESSFUL

pk12util -i kraTransportCert.p12 -d . 

Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
pk12util: PKCS12 IMPORT SUCCESSFUL

Optionally, delete the PKCS #12 files.

rm ServerCert.p12

rm kraStorageCert.p12

rm kraTransportCert.p12

Set the trust bits on the public/private key pairs that were imported into the new security databases.

certutil -M -n "Server-Cert cert-old_DRM_instance" 
-t "cu,cu,cu" -d . 

certutil -M -n "kraStorageCert cert-old_DRM_instance" 
-t "u,u,u" -d .

certutil -M -n "kraTransportCert cert-old_DRM_instance" 
-t "u,u,u" -d .

Import the public key from the base-64 file, and set the trust bits.

certutil -A -n "caSigningCert cert-old_DRM_instance"
 -t "CT,c," -d . -i caSigningCert.b64

Optionally, delete the base-64 file.
```
rm caSigningCert.b64
```
Open the CS.cfg configuration file.
```
cd /var/lib/instance_ID/conf/
```
Modify the kra.storageUnit.nickname and kra.transportUnit.nickname attributes to reflect the new DRM instance.
```
kra.storageUnit.nickname=
 kraStorageCert cert-old_DRM_instance 
kra.transportUnit.nickname=
 kraTransportCert cert-old_DRM_instance
```
NOTE

The caSigningCert attribute is not referenced in the CS.cfg file.
In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
```
vi serverCertNick.conf

Server-Cert cert-old_DRM_instance
```

7.2.2.3. Case III: HSM to Security Databases Migration

NOTE