9.3. Migrating Internal Databases for 4.2 (SP 2)

Log into the Directory Server for the new Certificate System instance, and export the new internal database content to LDIF.
```
cd /opt/redhat-ds/slapd-DS-instance/db db2ldif -n server.example.com-rhpki-ca
```
The location and name of the LDIF file is shown once the conversion from the database to LDIF is complete.
```
ldif file: 
/opt/redhat-ds/slapd-DS-instance/ldif/dated_#_file.ldif
```

Open the given location, and rename the LDIF file to new.ldif.

cd /opt/redhat-ds/slapd-DS-instance/ldif

mv dated_#_file.ldif new.ldif

The migration utility is available as an independent RPM, which can be downloaded through the Certificate System Red Hat Network channel. The migration utilities are installed in the directory /usr/share/rhpki/migrate.
1. Open the migration directory.
```
cd /usr/share/rhpki
```
2. Package the the latest version of the Certificate System migration utility using zip or tar.
```
tar -cvf migrate.tar migrate
```
  NOTE
  
  Regardless of the packaging tool used, the corresponding tool must be present on the old server machine. If the platforms are identical and the zip utility is used, copy the unzip utility to the old_server_root/bin/cert/ directory so that the zip and unzip versions match.
3. Copy the package from the new server to the old server, and remove the package from the new server.
```
cp /usr/share/rhpki/migrate.tar old_server_root/bin/cert

rm /usr/share/rhpki/migrate.tar
```
4. Log into the old server as the Certificate System user, and open the Certificate System bin/cert/ directory.
```
cd old_server_root/bin/cert
```
5. Log in as root, and set the file user and group to the Certificate System user and group.
```
su
chown user:group migrate.tar
```
6. Log out as root. As the Certificate System user, change the permissions on the files.
```
chmod 00600 migrate.tar
```
7. Unpackage the latest version of the migration utility using unzip or tar.
```
tar -xvf migrate.tar
```
8. Remove the package and any additional utilities, such as the unzip utility, that have been copied to the old Certificate System server.
```
rm migrate.tar
```
Export the database contents to LDIF using the db2ldif command.
```
cd old_server_root/slapd-old_instance-db2ldif
```
The location and name of the LDIF file is shown once the conversion from the database to LDIF is complete.
```
ldif file: 
old_server_root/slapd-old_instance-db/ldif/dated_#_file.ldif
```

Open the given location, and rename the LDIF file to old.ldif.

cd old_server_root/slapd-old_instance-db/ldif

mv dated_#_file.ldif old.ldif

Adjust the LDIF content of old.ldif.

NOTE

If using a text editor to perform the substitution instead of a script, be sure to use an editor that supports file sizes greater than 2 to 4 Gb, such as vim, because the LDIF files may be larger than 2 Gb in some deployments.
1. Delete the first two entries in old.ldif for the old machine domain name and the LDAP port and domain.
```
Entry 1: dc=cert,dc=redhat,dc=com
Entry 2: cn=ldap://:38900,dc=cert,dc=redhat,dc=com
```
2. Replace the following entry with the value for internaldb.basedn parameter in the CS.cfg file. For example:
```
cn=aclResources,dc=server.example.com-rhpki-ca
```
3. Add new groups for the the security domains.
```
cn=Security Domain Administrators,ou=groups,basedn
cn=Enterprise CA Administrators,ou=groups, basedn
cn=Enterprise KRA Administrators,ou=groups, basedn
cn=Enterprise OCSP Administrators,ou=groups, basedn
cn=Enterprise TKS Administrators,ou=groups, basedn
cn=Enterprise TPS Administrators,ou=groups, basedn
```
Convert the old.ldif file to a text file.
1. Open the version to text directory in the migration directory.
```
cd old_server_root/bin/cert/migrate/42SP2ToTxt
```
2. Open the run.sh file, and uncomment and set the values for the following lines:
  - SERVER_ROOT=old_server_root
  - export SERVER_ROOT
  - INSTANCE=old_instance
  - export INSTANCE
3. Run run.sh, which converts the LDIF file to a text file.
```
run.sh old_server_root/slapd-old_instance-db/ldif/old.ldif >
 old_server_root/slapd-old_instance-db/ldif/old.txt
```

Open the old LDIF directory, and copy the old.txt file to the new Certificate System server instance internal database LDIF directory.

cd old_server_root/slapd-old_instance-db/ldif

cp old_server_root/slapd-old_instance-db/ldif/old.txt
 /opt/redhat-ds/slapd-DS-instance/ldif

Log into the new server as the Certificate System user, and open the Certificate System ldif/ directory.
```
cd /opt/redhat-ds/slapd-DS-instance/ldif
```
Log in as root, and set the file user and group to the Certificate System user and group.
```
su

chown user:group old.txt
```
Log out as root. As the Certificate System user, change the permissions on the files.
```
chmod 00600 old.txt
```
Convert the old.txt file to LDIF.
1. Open the text to version directory in the migration directory.
```
cd /usr/share/rhpki/migrate/TxtTo72
```
2. Edit the run.sh file; uncomment and set the values for the following lines. For example:
  - SERVER_ROOT=/var/lib
  - export SERVER_ROOT
  - INSTANCE=rhpki-ca
  - export INSTANCE
3. Run the run.sh tool. The old.txt is directed to create old.ldif.
```
run.sh /opt/redhat-ds/slapd-DS-instance/ldif/old.txt >
 /opt/redhat-ds/slapd-DS-instance/ldif/old.ldif
```
Import the old.ldif LDIF file into the new Certificate System instance internal database.
1. Open the new Certificate System database directory.
```
cd /opt-redhat-ds/slapd-DS-instance/db
```
2. Import the LDIF into the database using the ldif2db utility.
  
  The internal database name for the Certificate System instance is in the internaldb.database parameter in the CS.cfg file. For example:
```
ldif2db -n server.example.com-rhpki-ca
 -i /opt/redhat-ds/slapd-DS-instance/ldif/old.ldif
```
3. Force the virtual list views (VLV) indexes to be re-indexed.
```
db2index
```

9.3. Migrating Internal Databases for 4.2 (SP 2)

NOTE

NOTE