Chapter 9. Step 6: Migrating Internal Databases

Chapter 9. Step 6: Migrating Internal Databases

9.1. Migrating Internal Databases for 4.1
9.2. Migrating Internal Databases for 4.2
9.3. Migrating Internal Databases for 4.2 (SP 2)
9.4. Migrating Internal Databases for 4.5
9.5. Migrating Internal Databases for 4.7
9.6. Migrating Internal Databases for 6.0
9.7. Migrating Internal Databases for 6.01
9.8. Migrating Internal Databases for 6.1
9.9. Migrating Internal Databases for 6.2
9.10. Migrating Internal Databases for 7.0
9.11. Migrating Internal Databases for 7.1

Every old Certificate System subsystem contains LDIF data in an associated internal database which must be migrated to the corresponding new Certificate System subsystem internal database. The procedure is the same for each subsystem type but is different between Certificate System versions.

9.1. Migrating Internal Databases for 4.1

  1. Log into the Directory Server for the new Certificate System, and export the new internal database content to LDIF. The database name is in the internaldb.database parameter in the CS.cfg file. 

    cd /opt/redhat-ds/slapd-DS-instance/db

db2ldif -n server.example.com-rhpki-ca

    The location and name of the created LDIF file is given when the database to LDIF conversion is complete. 

    ldif file: /opt/redhat-ds/slapd-DS-instance/ldif/dated_#_file.ldif

  2. Go to the location listed, and rename the LDIF file new.ldif.

    cd /opt/redhat-ds/slapd-DS-instance/ldif

mv dated_#_file.ldif new.ldif

  3. Copy the latest version of the migration utility from the new Certificate System to the old Certificate System.

    The migration utility is available as an independent RPM, which can be downloaded through the Certificate System Red Hat Network channel. The migration utilities are installed in the directory /usr/share/rhpki/migrate.

    1. Open the migration directory. 

      cd /usr/share/rhpki

    2. Package the latest version of the Certificate System migration utility zip or tar.

      tar -cvf migrate.tar migrate

      NOTE

      Regardless of the packaging tool used, the corresponding tool must be present on the old server machine. If the platforms are identical and the zip utility is used, copy the unzip utility to the old_server_root/bin/cert/ directory so that the zip and unzip versions match.

    3. Copy the package from the new server to the old server, and delete the compressed file from the new server.

      cp /usr/share/rhpki/migrate.tar old_server_root/bin/cert

rm /usr/share/rhpki/migrate.tar

    4. Log into the old server as the Certificate System user for that machine, and open the Certificate System bin/cert/ directory. 

      cd old_server_root/bin/cert

    5. Log in as root, and set the file user and group to the Certificate System user and group.

      su
chown user:group migrate.tar

    6. Log out as root. As the Certificate System user, change the permissions on the file.

      chmod 00600 migrate.tar

    7. Unpackage the latest version of the Certificate System migration utility unzip or tar.

      tar -xvf migrate.tar

    8. Remove the migration utility package and any additional utilities, such as the unzip utility, that were copied to the old Certificate System server.

      rm migrate.tar

  4. Export the old internal database content to LDIF. 

    cd old_server_root/slapd-old_instance-db db2ldif

  5. The location and name of the new LDIF file is shown when the database to LDIF conversion is complete. 

    ldif file: old_server_root/slapd-old_instance-db/ldif/dated_#_file.ldif

  6. Go to the specified location, and rename the LDIF file old.ldif.

    cd old_server_root/slapd-old_instance-db/ldif

mv dated_#_file.ldif old.ldif

  7. Adjust the LDIF content of old.ldif.

    NOTE

    When using a text editor to perform the substitution, use an editor that supports file sizes greater than 2 to 4 Gb, such as vim, because some LDIF files may be larger that 4 Gb in some deployments.

    1. Delete the first two entries in old.ldif which list the old domain name and the old LDAP port and domain name. For example:

      Entry 1: dc=cert,dc=redhat,dc=com
Entry 2: cn=ldap://:38900,dc=cert,dc=redhat,dc=com

    2. Replace the following entry with the value for internaldb.basedn parameter in the CS.cfg file. For example: 

      cn=aclResource,dc=server.example.com-rhpki-ca

    3. Add new groups for the the security domains. 

      cn=Security Domain Administrators,ou=groups,basedn
cn=Enterprise CA Administrators,ou=groups, basedn
cn=Enterprise KRA Administrators,ou=groups, basedn
cn=Enterprise OCSP Administrators,ou=groups, basedn
cn=Enterprise TKS Administrators,ou=groups, basedn
cn=Enterprise TPS Administrators,ou=groups, basedn

  8. Convert the old.ldif file into a text file.

    1. Open the version to text directory in the migration directory. 

      cd old_server_root/bin/cert/migrate/41ToTxt

    2. In the run.sh file, uncomment and give the values for the following lines:

      • SERVER_ROOT= old_server_root

      • export SERVER_ROOT

      • INSTANCE=old_instance

      • export INSTANCE

    3. Run run.sh. The old.ldif file is directed to create the old.txt file. 

      run.sh old_server_root/slapd-old_instance-db/ldif/old.ldif >
 old_server_root/slapd-old_instance-db/ldif/old.txt

  9. Open the old LDIF directory, and copy the old.txt file into the new Certificate System server instance internal database LDIF directory. 

    cd old_server_root/slapd-old_instance-db/ldif

cp old_server_root/slapd-old_instance-db/ldif/old.txt
 /opt/redhat-ds/slapd-DS-instance/ldif

  10. Log into the new server as the Certificate System user, and open the Certificate System ldif/ directory. 

    cd /opt/redhat-ds/slapd-DS-instance/ldif

  11. Log in as root, and set the file user and group to the Certificate System user and group. 

    su

chown user:group old.txt

  12. Log out as root. As the Certificate System user, change the permissions on the file. 

    chmod 00600 old.txt

  13. Convert the old.txt file to an LDIF file compatible with the new server instance.

    1. Open the version to text directory in the migration directory of the new server. 

      cd /usr/share/rhpki/migrate/TxtTo72

    2. In the run.sh file, uncomment the following lines, and set the new server values. For example:

      • SERVER_ROOT=/var/lib

      • export SERVER_ROOT

      • INSTANCE=rhpki-ca

      • export INSTANCE

    3. Run the run.sh tool. The old.txt is directed to create old.ldif. 

      run.sh /opt/redhat-ds/slapd-DS-instance/ldif/old.txt >
 /opt/redhat-ds/slapd-DS-instance/ldif/old.ldif

  14. Import the old.ldif LDIF file into the new Certificate System instance internal database.

    1. Open the new Certificate System database directory. 

      cd /opt/redhat-ds/slapd-DS-instance/db

    2. Run the ldif2db command to import the LDIF file into the database. The internal database name for the Certificate System instance is in the internaldb.database parameter in the CS.cfg file. For example: 

      ldif2db -n server.example.com-rhpki-ca
 -i /opt/redhat-ds/slapd-DS-instance/ldif/old.ldif

    3. Force the virtual list views (VLV) indexes to be re-indexed. 

      db2index