There are three subsystems that can be migrated from Netscape Certificate Management System 4.2 (SP2) and 4.5 and iPlanet Certificate Management System 4.7 to a later version of the Certificate System: the Certificate Authority (CA), Data Recovery Manager (DRM), and Online Certificate Status Protocol (OCSP). Each subsystem has different migration procedures.
Determine if the Certificate Management System Certificate Authority (CA) being migrated uses security databases, HSM, or both. There are four possible migration scenarios; follow the appropriate process for the deployment scenario being migrated.
Remove all the security databases in the new Certificate System which will receive migrated data.
rm /var/lib/instance_ID/alias/cert8.db rm /var/lib/instance_ID/alias/key3.db
Copy the certificate and key security databases from the old server to the new server.
cpold_server_root/cert-old_CA_instance/config/cert-old_CA_instance-cert7.db /var/lib/instance_ID/alias/cert7.db cpold_server_root/cert-old_CA_instance/config/cert-old_CA_instance-key3.db /var/lib/instance_ID/alias/key3.db
Log into the new Certificate System server as the Certificate System user, and open the alias/ directory.
cd /var/lib/instance_ID/alias/
Log in as root, and set the file user and group to the Certificate System user and group.
su chownuser:groupcert7.db chownuser:groupkey3.db
Log out as root. As the Certificate System user, set the file permissions on the certificate and key databases.
chmod 00600 cert7.db
chmod 00600 key3.db
Use the certutil tool to list all of the old certificates. In this example, -L lists the certificates, and -X forces them to be read/write.
certutil -L -X -d .Server-Cert cert-old_CA_instancecu,cu,cu caSigningCert cert-old_CA_instancecu,cu,cu ocspSigningCert cert-old_CA_instanceCTu,Cu,Cu
Remove the cert7.db database from the alias/ directory.
rm cert7.db
Open the CS.cfg configuration file.
cd /var/lib/instance_ID/conf/ vi CS.cfg
Edit the ca.signing.cacertnickname and ca.ocsp_signing.cacertnickname attributes to reflect the new CA information.
ca.signing.cacertnickname= caSigningCert cert-old_CA_instanceca.ocsp_signing.cacertnickname= ocspSigningCert cert-old_CA_instance
If there is CA-DRM connectivity, then also edit the ca.connector.KRA.nickname attribute to reflect the new CA certificate information.
ca.connector.KRA.nickname=caSigningCert cert-old_CA_instance
In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.conf Server-Cert cert-old_CA_instance
Remove all the security databases in the new Certificate System which will receive migrated data.
rm /var/lib/instance_ID/alias/cert8.db rm /var/lib/instance_ID/alias/key3.db
Copy the certificate and key security databases from the old server to the new server.
cpold_server_root/cert-old_CA_instance/config/cert-old_CA_instance-cert7.db /var/lib/instance_ID/alias/cert7.db cpold_server_root/cert-old_CA_instance/config/cert-old_CA_instance-key3.db /var/lib/instance_ID/alias/key3.db
Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
Log in as root, and set the file user and group to the Certificate System user and group.
su chownuser:groupcert7.db chownuser:groupkey3.db
Log out as root. As the Certificate System user, change the permissions on the files.
chmod 00600 cert7.db
chmod 00600 key3.db
Use the certutil tool to list all of the old Certificate System certificates. In this example, -L lists the certificates, and -X forces them to be read/write.
Use the certutil tool to list the contents of the old security databases.
certutil -L -X -d .Server-Cert cert-old_CA_instancecu,cu,cu caSigningCert cert-old_CA_instancecu,cu,cu ocspSigningCert cert-old_CA_instanceCTu,Cu,Cu
Export the public/private key pairs of each entry in the Certificate System databases using the pk12util tool; -o exports the key pairs to a PKCS #12 file, and -n sets the name of the certificate and the old database prefix.
pk12util -o ServerCert.p12 -n "Server-Cert cert-old_CA_instance" -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** Re-enter password: ******** pk12util: PKCS12 EXPORT SUCCESSFULpk12util -o caSigningCert.p12 -n "caSigningCert cert-old_CA_instance" -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** Re-enter password: ******** pk12util: PKCS12 EXPORT SUCCESSFULpk12util -o ocspSigningCert.p12 -n "ocspSigningCert cert-old_CA_instance" -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** Re-enter password: ******** pk12util: PKCS12 EXPORT SUCCESSFUL
The old security databases may contain additional public/private key pairs; these can also be extracted using pk12util.
Delete the old security databases.
rm cert7.db
rm cert8.db
rm key3.db
Register the new HSM in the new token database.
modutil -nocertdb -dbdir . -addnew_HSM_token_name-libfilenew_HSM_library_path/new_HSM_library
Identify the new HSM slot name.
modutil -dbdir . -nocertdb -list
Create new security databases.
certutil -N -d .
Import the public/private keypairs of each entry from the PKCS #12 files into the new HSM.
pk12util -i ServerCert.p12 -d . -hnew_HSM_slot_nameEnter Password or Pin for "new_HSM_slot_name":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFULpk12util -i caSigningCert.p12 -d . -hnew_HSM_slot_nameEnter Password or Pin for "new_HSM_slot_name":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFULpk12util -i ocspSigningCert.p12 -d . -hnew_HSM_slot_nameEnter Password or Pin for "new_HSM_slot_name":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFUL
Optionally, delete the PKCS #12 files.
rm ServerCert.p12
rm caSigningCert.p12
rm ocspSigningCert.p12
Set the trust bits on the public/private key pairs that were imported into the new HSM.
certutil -M -n "new_HSM_slot_name:Server-Cert cert-old_CA_instance" -t "cu,cu,cu" -d . -hnew_HSM_token_namecertutil -M -n "new_HSM_slot_name:caSigningCert cert-old_CA_instance" -t "CTu,CTu,CTu" -d . -hnew_HSM_token_namecertutil -M -n "new_HSM_slot_name:ocspSigningCert cert-old_CA_instance" -t "CTu,Cu,Cu" -d . -hnew_HSM_token_name
Open the CS.cfg configuration file.
cd /var/lib/instance_ID/conf/
Edit the ca.signing.cacertnickname and ca.ocsp_signing.cacertnickname attributes to reflect the new CA information.
ca.signing.cacertnickname=new_HSM_slot_name:caSigningCert cert-old_CA_instanceca.ocsp_signing.cacertnickname=new_HSM_slot_name:ocspSigningCert cert-old_CA_instance
If there is CA-DRM connectivity, then also edit the ca.connector.KRA.nickname attribute for the new CA information.
ca.connector.KRA.nickname=new_HSM_slot_name:caSigningCert cert-old_CA_instance
In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.confnew_HSM_slot_name:Server-Cert cert-old_CA_instance
Extract the public/private key pairs from the HSM. The format for the extracted key pairs should be portable, such as a PKCS #12 file.
The pk12util tool provided by the Certificate System cannot extract public/private key pairs from an HSM because of requirements in the FIPS 140-1 standard which protect the private key portion of an entry. To extract this information, contact the HSM vendor for more information. The extracted keys should not have any dependencies, such as nickname prefixes, on the HSM.
Copy the extracted public/private key pairs from the old server to the new server.
cpold_server_root/cert-old_CA_instance/config/ServerCert.p12 /var/lib/instance_ID/alias/ServerCert.p12 cpold_server_root/cert-old_CA_instance/config/caSigningCert.p12 /var/lib/instance_ID/alias/caSigningCert.p12 cpold_server_root/cert-old_CA_instance/config/ocspSigningCert.p12 /var/lib/instance_ID/alias/ocspSigningCert.p12
Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
Log in as root, and set the file user and group to the Certificate System user and group.
su chownuser:groupServerCert.p12 chownuser:groupcaSigningCert.p12 chownuser:groupocspSigningCert.p12
Log out as root. As the Certificate System user, set the file permissions on the PKCS #12 files.
chmod 00600 ServerCert.p12
chmod 00600 caSigningCert.p12
chmod 00600 ocspSigningCert.p12
Import the public/private key pairs of each entry from the PKCS #12 files into the new security databases.
pk12util -i ServerCert.p12 -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFULpk12util -i caSigningCert.p12 -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFULpk12util -i ocspSigningCert.p12 -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFUL
Optionally, delete the PKCS #12 files.
rm ServerCert.p12
rm caSigningCert.p12
rm ocspSigningCert.p12
Set the trust bits on the public/private key pairs that were imported into the new security databases.
certutil -M -n "Server-Cert cert-old_CA_instance" -t "cu,cu,cu" -d .certutil -M -n "caSigningCert cert-old_CA_instance" -t "CTu,CTu,CTu" -d .certutil -M -n "ocspSigningCert cert-old_CA_instance" -t "CTu,Cu,Cu" -d .
Open the CS.cfg configuration file.
cd /var/lib/instance_ID/conf/
Edit the ca.signing.cacertnickname and ca.ocsp_signing.cacertnickname attributes to reflect the new CA information.
ca.signing.cacertnickname= caSigningCert cert-old_CA_instanceca.ocsp_signing.cacertnickname= ocspSigningCert cert-old_CA_instance
If there is CA-DRM connectivity, then also edit the ca.connector.KRA.nickname attribute.
ca.connector.KRA.nickname=caSigningCert cert-old_CA_instance
In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.conf Server-Cert cert-old_CA_instance
Extract the public/private key pairs from the HSM. The format for the extracted key pairs should be portable, such as a PKCS #12 file.
The pk12util tool provided by the Certificate System cannot extract public/private key pairs from an HSM because of requirements in the FIPS 140-1 standard which protect the private key portion of an entry. To extract this information, contact the HSM vendor for more information. The extracted keys should not have any dependencies, such as nickname prefixes, on the HSM.
Copy the extracted public/private key pairs from the old server to the new server.
cpold_server_root/cert-old_CA_instance/config/ServerCert.p12 /var/lib/instance_ID/alias/ServerCert.p12 cpold_server_root/cert-old_CA_instance/config/caSigningCert.p12 /var/lib/instance_ID/alias/caSigningCert.p12 cpold_server_root/cert-old_CA_instance/config/ocspSigningCert.p12 /var/lib/instance_ID/alias/ocspSigningCert.p12
Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
Log in as root, and set the file user and group to the Certificate System user and group.
su chownuser:groupServerCert.p12 chownuser:groupcaSigningCert.p12 chownuser:groupocspSigningCert.p12
Log out as root. As the Certificate System user, set the file permissions on the PKCS #12 files.
chmod 00600 ServerCert.p12
chmod 00600 caSigningCert.p12
chmod 00600 ocspSigningCert.p12
Register the new HSM in the new token database.
modutil -nocertdb -dbdir . -addnew_HSM_token_name-libfilenew_HSM_library_path/new_HSM_library
Identify the new HSM slot name.
modutil -dbdir . -nocertdb -list
Import the public/private key pairs of each entry from the PKCS #12 files into the new HSM.
pk12util -i ServerCert.p12 -d . -hnew_HSM_slot_nameEnter Password or Pin for "new_HSM_slot_name":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFULpk12util -i caSigningCert.p12 -d . -hnew_HSM_slot_nameEnter Password or Pin for "new_HSM_slot_name":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFULpk12util -i ocspSigningCert.p12 -d . -hnew_HSM_slot_nameEnter Password or Pin for "new_HSM_slot_name":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFUL
Optionally, delete the PKCS #12 files.
rm ServerCert.p12
rm caSigningCert.p12
rm ocspSigningCert.p12
Set the trust bits on the public/private key pairs that were imported into the new HSM.
certutil -M -n "new_HSM_slot_name:Server-Cert cert-old_CA_instance" -t "cu,cu,cu" -d . -hnew_HSM_token_namecertutil -M -n "new_HSM_slot_name:caSigningCert cert-old_CA_instance" -t "CTu,CTu,CTu" -d . -hnew_HSM_token_namecertutil -M -n "new_HSM_slot_name:ocspSigningCert cert-old_CA_instance" -t "CTu,Cu,Cu" -d . -hnew_HSM_token_name
Open the CS.cfg configuration file.
cd /var/lib/instance_ID/conf/ vi CS.cfg
Edit the values of the ca.signing.cacertnickname and ca.ocsp_signing.cacertnickname attributes to reflect the new HSM information.
ca.signing.cacertnickname=new_HSM_slot_name:caSigningCert cert-old_CA_instanceca.ocsp_signing.cacertnickname=new_HSM_slot_name:ocspSigningCert cert-old_CA_instance
If there is CA-DRM connectivity, then also edit the ca.connector.KRA.nickname attribute.
ca.connector.KRA.nickname=new_HSM_slot_name:caSigningCert cert-old_CA_instance
In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.confnew_HSM_slot_name:Server-Cert cert-old_CA_instance
Determine if the Certificate System Data Recover Manager (DRM) being migrated uses security databases, HSM, or both. There are four possible migration scenarios; follow the appropriate process for the deployment scenario being migrated.
Remove all the security databases in the new Certificate System which will receive migrated data.
rm /var/lib/instance_ID/alias/cert8.db rm /var/lib/instance_ID/alias/key3.db
Copy the certificate and key security databases from the old server to the new server.
cpold_server_root/cert-old_DRM_instance/config/cert-old_DRM_instance-cert7.db /var/lib/instance_ID/alias/cert7.db cpold_server_root/cert-old_DRM_instance/config/cert-old_DRM_instance-key3.db /var/lib/instance_ID/alias/key3.db
Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
Log in as root, and set the file user and group to the Certificate System user and group.
su chownuser:groupcert7.db chownuser:groupkey3.db
Log out as root. As the Certificate System user, set the file permissions on the certificate and key databases.
chmod 00600 cert7.db
chmod 00600 key3.db
Use the certutil tool to list all of the old Certificate System certificates. In this example, -L lists the certificates, and -X forces them to be read/write.
certutil -L -X -d .Server-Cert cert-old_DRM_instancecu,cu,cu caSigningCert cert-old_DRM_instanceCT,c, kraStorageCert cert-old_DRM_instanceu,u,u kraTransportCert cert-old_DRM_instanceu,u,u
rm cert7.db
Open the CS.cfg configuration file.
cd /var/lib/instance_ID/conf/ vi CS.cfg
Edit the kra.storageUnit.nickname and kra.transportUnit.nickname attributes to reflect the new DRM information.
kra.storageUnit.nickname= kraStorageCert cert-old_DRM_instancekra.transportUnit.nickname= kraTransportCert cert-old_DRM_instance
In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.conf Server-Cert cert-old_DRM_instance
Remove all the security databases in the new Certificate System which will receive migrated data.
rm /var/lib/instance_ID/alias/cert8.db rm /var/lib/instance_ID/alias/key3.db
Copy the certificate and key security databases from the old server to the new server.
cpold_server_root/cert-old_DRM_instance/config/cert-old_DRM_instance-cert7.db /var/lib/instance_ID/alias/cert7.db cpold_server_root/cert-old_DRM_instance/config/key3.db /var/lib/instance_ID/alias/key3.db
Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
Log in as root, and set the file user and group to the Certificate System user and group.
su chownuser:groupcert7.db chownuser:groupkey3.db
Log out as root. As the Certificate System user, set the file permissions on the certificate and key databases.
chmod 00600 cert7.db
chmod 00600 key3.db
Use the certutil tool to list all of the old Certificate System certificates. In this example, -L lists the certificates, and -X forces them to be read/write.
certutil -L -X -d .Server-Cert cert-old_DRM_instancecu,cu,cu caSigningCert cert-old_DRM_instancecT,c, kraStorageCert cert-old_DRM_instanceu,u,u kraTransportCert cert-old_DRM_instanceu,u,u
Export the public/private key pairs of each entry in the Certificate System databases using the pk12util tool; -o exports the key pairs to a PKCS #12 file, and -n sets the name of the certificate and the old database prefix.
pk12util -o ServerCert.p12 -n "Server-Cert cert-old_DRM_instance" -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** Re-enter password: ******** pk12util: PKCS12 EXPORT SUCCESSFULpk12util -o kraStorageCert.p12 -n "kraStorageCert cert-old_DRM_instance" -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** Re-enter password: ******** pk12util: PKCS12 EXPORT SUCCESSFULpk12util -o kraTransportCert.p12 -n "kraTransportCert cert-old_DRM_instance" -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** Re-enter password: ******** pk12util: PKCS12 EXPORT SUCCESSFUL
The old security databases may contain additional public/private key pairs; these can also be extracted using pk12util.
Export the public key using the certutil tool; -L lists the named certificate, -n sets the name of the file and the old prefix, and -a outputs the information to a base-64 file.
certutil -L -n "caSigningCert cert-old_DRM_instance" -d . -a > caSigningCert.b64
The old security databases may contain additional public keys; these can also be extracted using certutil.
Delete the old security databases.
rm cert7.db
rm cert8.db
rm key3.db
Register the new HSM in the new token database.
modutil -nocertdb -dbdir . -addnew_HSM_token_name-libfilenew_HSM_library_path/new_HSM_library
Identify the new HSM slot name.
modutil -dbdir . -nocertdb -list
Create new security databases.
certutil -N -d .
Import the public/private key pairs of each entry from the PKCS #12 files into the new HSM.
pk12util -i ServerCert.p12 -d . -hnew_HSM_slot_nameEnter Password or Pin for "new_HSM_slot_name":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFULpk12util -i kraStorageCert.p12 -d . -hnew_HSM_slot_nameEnter Password or Pin for "new_HSM_slot_name":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFULpk12util -i kraTransportCert.p12 -d . -hnew_HSM_slot_nameEnter Password or Pin for "new_HSM_slot_name":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFUL
Optionally, delete the PKCS #12 files.
rm ServerCert.p12
rm kraStorageCert.p12
rm kraTransportCert.p12
Set the trust bits on the public/private key pairs that were imported into the new HSM.
certutil -M -n "new_HSM_slot_name:Server-Cert cert-old_DRM_instance" -t "cu,cu,cu" -d . -hnew_HSM_token_namecertutil -M -n "new_HSM_slot_name:kraStorageCert cert-old_DRM_instance" -t "u,u,u" -d . -hnew_HSM_token_namecertutil -M -n "new_HSM_slot_name:kraTransportCert cert-old_DRM_instance" -t "u,u,u" -d . -hnew_HSM_token_name
Import the public key from the base-64 file into the new HSM, and set the trust bits.
certutil -A -n "new_HSM_slot_name:caSigningCert cert-old_DRM_instance" -t "CT,c," -d . -hnew_HSM_token_name-i caSigningCert.b64
Optionally, delete the base-64 file.
rm caSigningCert.b64
Open the CS.cfg configuration file.
cd /var/lib/instance_ID/conf/ vi CS.cfg
Edit the kra.storageUnit.nickname and kra.transportUNit.nickname attributes to reflect the new DRM information.
kra.storageUnit.nickname=new_HSM_slot_name:kraStorageCert cert-old_DRM_instancekra.transportUnit.nickname=new_HSM_slot_name:kraTransportCert cert-old_DRM_instance
In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.confnew_HSM_slot_name:Server-Cert cert-old_DRM_instance
Extract the public/private key pairs from the HSM. The format for the extracted key pairs should be portable, such as a PKCS #12 file.
The pk12util tool provided by the Certificate System cannot extract public/private key pairs from an HSM because of requirements in the FIPS 140-1 standard which protect the private key portion of an entry. To extract this information, contact the HSM vendor for more information. The extracted keys should not have any dependencies, such as nickname prefixes, on the HSM.
Copy the extracted public/private key pairs from the old server to the new server.
cpold_server_root/cert-old_DRM_instance/config/ServerCert.p12 /var/lib/instance_ID/alias/ServerCert.p12 cpold_server_root/cert-old_DRM_instance/config/kraStorageCert.p12 /var/lib/instance_ID/alias/kraStorageCert.p12 cpold_server_root/cert-old_DRM_instance/config/kraTransportCert.p12 /var/lib/instance_ID/alias/kraTransportCert.p12
Extract the public key of the old_HSM_slot_name:caSigningCert cert-old_DRM_instance from the old security databases and save the base-64 encoded output to a file called caSigningCert.b64.
Open the old Certificate System configuration directory.
cdold_server_root/cert-old_DRM_instance/config
Use the old Certificate System's certutil tool to identify the old HSM slot name.
old_server_root/bin/cert/tools/certutil -U -d .
Use the old Certificate System's certutil tool to extract the public key from the security databases and save the base-64 output to a file. In this example, -l lists the named certificate, -n names the certificate, -h gives the old HSM name, and -a saves the information to a base-64 file.
old_server_root/bin/cert/tools/certutil -L -n "old_HSM_slot_name:caSigningCert cert-old_DRM_instance" -d . -hold_HSM_token_name-a > caSigningCert.b64
Copy the key data from the old server to the new server.
cpold_server_root/cert-old_DRM_instance/config/caSigningCert.b64 /var/lib/instance_ID/alias/caSigningCert.b64
Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
Log in as root, and set the file user and group to the Certificate System user and group.
su chownuser:groupServerCert.p12 chownuser:groupkraStorageCert.p12 chownuser:groupkraTransportCert.p12 chownuser:groupcaSigningCert.b64
Log out as root. As the Certificate System user, set the file permissions.
chmod 00600 ServerCert.p12
chmod 00600 kraStorageCert.p12
chmod 00600 kraTransportCert.p12
chmod 00600 caSigningCert.b64
Import the public/private key pairs of each entry from the PKCS #12 files into the new security databases.
pk12util -i ServerCert.p12 -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFULpk12util -i kraStorageCert.p12 -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFULpk12util -i kraTransportCert.p12 -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFUL
Optionally, delete the PKCS #12 files.
rm ServerCert.p12
rm kraStorageCert.p12
rm kraTransportCert.p12
Set the trust bits on the imported public/private key pairs.
certutil -M -n "Server-Cert cert-old_DRM_instance" -t "cu,cu,cu" -d .certutil -M -n "kraStorageCert cert-old_DRM_instance" -t "u,u,u" -d .certutil -M -n "kraTransportCert cert-old_DRM_instance" -t "u,u,u" -d .
Import the public key from the base-64 file, and set the trust bits.
certutil -A -n "caSigningCert cert-old_DRM_instance" -t "CT,c," -d . -i caSigningCert.b64
Optionally, delete the base-64 file.
rm caSigningCert.b64
Open the CS.cfg configuration file.
cd /var/lib/instance_ID/conf/ vi CS.cfg
Edit the kra.storageUnit.nickname and kra.transportUnit.nickname attributes to reflect the new DRM information.
kra.storageUnit.nickname= kraStorageCert cert-old_DRM_instancekra.transportUnit.nickname= kraTransportCert cert-old_DRM_instance
In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.conf Server-Cert cert-old_DRM_instance
Extract the public/private key pairs from the HSM. The format for the extracted key pairs should be portable, such as a PKCS #12 file.
The pk12util tool provided by the Certificate System cannot extract public/private key pairs from an HSM because of requirements in the FIPS 140-1 standard which protect the private key portion of an entry. To extract this information, contact the HSM vendor for more information. The extracted keys should not have any dependencies, such as nickname prefixes, on the HSM.
Copy the extracted public/private key pairs from the old server to the new server.
cpold_server_root/cert-old_DRM_instance/config/ServerCert.p12 /var/lib/instance_ID/alias/ServerCert.p12 cpold_server_root/cert-old_DRM_instance/config/kraStorageCert.p12 /var/lib/instance_ID/alias/kraStorageCert.p12 cpold_server_root/cert-old_DRM_instance/config/kraTransportCert.p12 /var/lib/instance_ID/alias/kraTransportCert.p12
Extract the public key of the old_HSM_slot_name:caSigningCert cert-old_DRM_instance from the old security databases and save the base-64 encoded output to a file called caSigningCert.b64.
Open the old Certificate System's configuration directory.
cdold_server_root/cert-old_DRM_instance/config/
Use the old Certificate System's certutil tool to identify the old HSM slot name.
old_server_root/bin/cert/tools/certutil -U -d .
Use the old Certificate System's certutil tool to extract the public key from the security databases and save the base-64 output to a file.
old_server_root/bin/cert/tools/certutil -L -n "old_HSM_slot_name:caSigningCert cert-old_DRM_instance" -d . -hold_HSM_token_name-a > caSigningCert.b64
Copy the key information from the old server to the new server.
cpold_server_root/cert-old_DRM_instance/config/caSigningCert.b64 /var/lib/instance_ID/alias/caSigningCert.b64
Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
Log in as root, and set the file user and group to the Certificate System user and group.
su chownuser:groupServerCert.p12 chownuser:groupkraStorageCert.p12 chownuser:groupkraTransportCert.p12 chownuser:groupcaSigningCert.b64
Log out as root. As the Certificate System user, set the file permissions.
chmod 00600 ServerCert.p12
chmod 00600 kraStorageCert.p12
chmod 00600 kraTransportCert.p12
chmod 00600 caSigningCert.b64
Register the new HSM in the new token database.
modutil -nocertdb -dbdir . -addnew_HSM_token_name-libfilenew_HSM_library_path/new_HSM_library
Identify the new HSM slot name.
modutil -dbdir . -nocertdb -list
Import the public/private key pairs of each entry from the PKCS #12 files into the new HSM.
pk12util -i ServerCert.p12 -d . -hnew_HSM_slot_nameEnter Password or Pin for "new_HSM_slot_name":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFULpk12util -i kraStorageCert.p12 -d . -hnew_HSM_slot_nameEnter Password or Pin for "new_HSM_slot_name":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFULpk12util -i kraTransportCert.p12 -d . -hnew_HSM_slot_nameEnter Password or Pin for "new_HSM_slot_name":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFUL
Optionally, delete the PKCS #12 files.
rm ServerCert.p12
rm kraStorageCert.p12
rm kraTransportCert.p12
Set the trust bits on the public/private key pairs that were imported into the new HSM.
certutil -M -n "new_HSM_slot_name:Server-Cert cert-old_DRM_instance" -t "cu,cu,cu" -d . -hnew_HSM_token_namecertutil -M -n "new_HSM_slot_name:kraStorageCert cert-old_DRM_instance" -t "u,u,u" -d . -hnew_HSM_token_namecertutil -M -n "new_HSM_slot_name:kraTransportCert cert-old_DRM_instance" -t "u,u,u" -d . -hnew_HSM_token_name
Import the public key from the base-64 file into the new HSM, and set the trust bits.
certutil -A -n "new_HSM_slot_name:caSigningCert cert-old_DRM_instance" -t "CT,c," -d . -hnew_HSM_token_name-i caSigningCert.b64
Optionally, delete the base-64 file.
rm caSigningCert.b64
Open the CS.cfg configuration file.
cd /var/lib/instance_ID/conf/ vi CS.cfg
Edit the kra.storageUnit.nickname and kra.transportUnit.nickname attributes to reflect the new DRM information.
kra.storageUnit.nickname=new_HSM_slot_name:kraStorageCert cert-old_DRM_instancekra.transportUnit.nickname=new_HSM_slot_name:kraTransportCert cert-old_DRM_instance
In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.confnew_HSM_slot_name:Server-Cert cert-old_DRM_instance
Determine if the Online Certificate Status Protocol (OCSP) being migrated uses security databases, an HSM, or both. There are four possible migration scenarios; follow the appropriate process for the deployment scenario being migrated.
Remove all the security databases in the new Certificate System which will receive migrated data.
rm cert8.db
rm key3.db
Copy the certificate and key security databases from the old server to the new server.
cpold_server_root/cert-old_OCSP_instance/config/cert-old_OCSP_instance-cert7.db /var/lib/instance_ID/alias/cert7.db cpold_server_root/cert-old_OCSP_instance/config/cert-old_OCSP_instance-key3.db /var/lib/instance_ID/alias/key3.db
Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
Log in as root, and set the file user and group to the Certificate System user and group.
su chownuser:groupcert7.db chownuser:groupkey3.db
Log out as root. As the Certificate System user, set the file permissions on the security databases.
chmod 00600 cert7.db
chmod 00600 key3.db
Use the certutil tool to list all of the old Certificate System certificates. In this example, -L lists the certificates, and -X forces them to be read/write.
certutil -L -X -d .Server-Cert cert-old_OCSP_instancecu,cu,cu caSigningCert cert-old_OCSP_instanceCT,c, ocspSigningCert cert-old_OCSP_instancecu,cu,cu
rm cert7.db
Open the CS.cfg configuration file.
cd /var/lib/instance_ID/conf/ vi CS.cfg
Edit the ocsp.signing.certnickname attribute to reflect the new OCSP information.
ocsp.signing.certnickname=ocspSigningCert cert-old_OCSP_instance
In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.conf Server-Cert cert-old_OCSP_instance
Remove all the security databases in the new Certificate System which will receive migrated data.
rm /var/lib/instance_ID/alias/cert8.db rm /var/lib/instance_ID/alias/key3.db
Copy the certificate and key security databases from the old server to the new server.
cpold_server_root/cert-old_OCSP_instance/config/cert-old_OCSP_instance-cert7.db /var/lib/instance_ID/alias/cert7.db cpold_server_root/cert-old_OCSP_instance/config/cert-old_OCSP_instance-key3.db /var/lib/instance_ID/alias/key3.db
Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
Log in as root, and set the file user and group to the Certificate System user and group.
su chownuser:groupcert7.db chownuser:groupkey3.db
Log out as root. As the Certificate System user, set the file permissions on the security databases.
chmod 00600 cert7.db
chmod 00600 key3.db
Use the certutil tool to list all of the old Certificate System certificates. In this example, -L lists the certificates, and -X forces them to be read/write.
certutil -L -X -d .Server-Cert cert-old_OCSP_instancecu,cu,cu caSigningCert cert-old_OCSP_instanceCT,c, ocspSigningCert cert-old_OCSP_instancecu,cu,cu
Export the public/private key pairs of each entry in the Certificate System databases using the pk12util tool; -o exports the key pairs to a PKCS #12 file, and -n sets the name of the certificate and the old database prefix.
pk12util -o ServerCert.p12 -n "Server-Cert cert-old_OCSP_instance" -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** Re-enter password: ******** pk12util: PKCS12 EXPORT SUCCESSFULpk12util -o ocspSigningCert.p12 -n "ocspSigningCert cert-old_OCSP_instance" -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** Re-enter password: ******** pk12util: PKCS12 EXPORT SUCCESSFUL
The old security databases may contain additional public/private key pairs; these can also be extracted using pk12util.
Export the public key using the certutil tool; -L lists the named certificate, -n sets the name of the file and the old prefix, and -a saves the output to a base-64 file.
certutil -L -n "caSigningCert cert-old_OCSP_instance" -d . -a > caSigningCert.b64
The old security databases may contain additional public keys; these can also be exported using the certutil tool.
Delete the old security databases.
rm cert7.db
rm cert8.db
rm key3.db
Register the new HSM in the new token database.
modutil -nocertdb -dbdir . -addnew_HSM_token_name-libfilenew_HSM_library_path/new_HSM_library
Identify the new HSM slot name.
modutil -dbdir . -nocertdb -list
Create new security databases.
certutil -N -d .
Import the public/private key pairs of each entry from the PKCS #12 files into the new HSM.
pk12util -i ServerCert.p12 -d . -hnew_HSM_slot_nameEnter Password or Pin for "new_HSM_slot_name":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFULpk12util -i ocspSigningCert.p12 -d . -hnew_HSM_slot_nameEnter Password or Pin for "new_HSM_slot_name":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFUL
Optionally, delete the PKCS #12 files.
rm ServerCert.p12
rm ocspSigningCert.p12
Set the trust bits on the public/private key pairs that were imported into the new HSM.
certutil -M -n "new_HSM_slot_name:Server-Cert cert-old_OCSP_instance" -t "cu,cu,cu" -d . -hnew_HSM_token_namecertutil -M -n "new_HSM_slot_name:ocspSigningCert cert-old_OCSP_instance" -t "cu,cu,cu" -d . -hnew_HSM_token_name
Import the public key from the base-64 file into the new HSM, and set the trust bits.
certutil -A -n "new_HSM_slot_name:caSigningCert cert-old_OCSP_instance" -t "CT,c," -d . -hnew_HSM_token_name-i caSigningCert.b64
Optionally, delete the base-64 file.
rm caSigningCert.b64
Open the CS.cfg configuration file.
cd /var/lib/instance_ID/conf/ vi CS.cfg
Edit the ocsp.signing.certnickname attribute to reflect the new OCSP information.
ocsp.signing.certnickname=new_HSM_slot_name:ocspSigningCert cert-old_OCSP_instance
In the same directory, edit the serverCertNick.conf file to contain the old certificate nickname. For example:
vi serverCertNick.confnew_HSM_slot_name:Server-Cert cert-old_OCSP_instance
Extract the public/private key pairs from the HSM. The format for the extracted key pairs should be portable, such as a PKCS #12 file.
The pk12util tool provided by the Certificate System cannot extract public/private key pairs from an HSM because of requirements in the FIPS 140-1 standard which protect the private key portion of an entry. To extract this information, contact the HSM vendor for more information. The extracted keys should not have any dependencies, such as nickname prefixes, on the HSM.
Copy the extracted public/private key pairs from the old server to the new server.
cpold_server_root/cert-old_OCSP_instance/config/ServerCert.p12 /var/lib/instance_ID/alias/ServerCert.p12 cpold_server_root/cert-old_OCSP_instance/config/ocspSigningCert.p12 /var/lib/instance_ID/alias/ocspSigningCert.p12
Extract the public key of the old_HSM_slot_name:caSigningCert cert-old_OCSP_instance from the old security databases and save the base-64 encoded output to a file called caSigningCert.b64.
Open the old Certificate System's configuration directory.
cdold_server_root/cert-old_OCSP_instance/config/
Use the old Certificate System's certutil tool to identify the old HSM slot name.
old_server_root/bin/cert/tools/certutil -U -d .
Use the old Certificate System's certutil tool to extract the public key entry from the security databases and save the base-64 output to a file.
old_server_root/bin/cert/tools/certutil -L -n "old_HSM_slot_name:caSigningCert cert-old_OCSP_instance" -d . -hold_HSM_token_name-a > caSigningCert.b64
Copy the key data from the old server to the new server.
cpold_server_root/cert-old_OCSP_instance/config/caSigningCert.b64 /var/lib/instance_ID/alias/caSigningCert.b64
Log into the new server as the Certificate System user, and open the Certificate System alias/ directory.
cd /var/lib/instance_ID/alias/
Log in as root, and set the file user and group to the Certificate System user and group.
su chownuser:groupServerCert.p12 chownuser:groupocspSigningCert.p12 chownuser:groupcaSigningCert.b64
Log out as root. As the Certificate System user, set the file permissions.
chmod 00600 ServerCert.p12
chmod 00600 ocspSigningCert.p12
chmod 00600 caSigningCert.b64
Import the public/private key pairs of each entry from the PKCS #12 files into the new security databases.
pk12util -i ServerCert.p12 -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFULpk12util -i ocspSigningCert.p12 -d .Enter Password or Pin for "NSS Certificate DB":******** Enter password for PKCS12 file: ******** pk12util: PKCS12 IMPORT SUCCESSFUL
Optionally, delete the PKCS #12 files.
rm ServerCert.p12
rm ocspSigningCert.p12
Set the trust bits on the public/private key pairs that were imported into the new security databases.
certutil -M -n "Server-Cert cert-old_OCSP_instance" -t "cu,cu,cu" -d .certutil -M -n "ocspSigningCert cert-