6. Log out as
root
, and log back into the system as the Certificate System user.
7. Set the file permissions.
chmod 00600 ServerCert.p12
chmod 00600 caSigningCert.p12
chmod 00600 ocspSigningCert.p12
8. Import the public/private key pairs of each entry from the PKCS #12 files into the 7.3 security
databases.
pk12util -i ServerCert.p12 -d .
Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
pk12util: PKCS12 IMPORT SUCCESSFUL
pk12util -i caSigningCert.p12 -d .
Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
pk12util: PKCS12 IMPORT SUCCESSFUL
pk12util -i ocspSigningCert.p12 -d .
Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
pk12util: PKCS12 IMPORT SUCCESSFUL
9. Optionally, delete the PKCS #12 files.
rm ServerCert.p12
rm caSigningCert.p12
rm ocspSigningCert.p12
10.Set the trust bits on the public/private key pairs that were imported into the 7.3 security
databases.
certutil -M -n "Server-Cert cert-old_CA_instance" -t "cu,cu,cu" -d .
certutil -M -n "caSigningCert cert-old_CA_instance" -t "CTu,CTu,CTu" -d .
certutil -M -n "ocspSigningCert cert-old_CA_instance" -t "CTu,Cu,Cu" -d .
11.Open the
CS.cfg
configuration file in the
/var/lib/
instance_ID
/conf/
directory.
12.Edit the
ca.signing.cacertnickname
and
ca.ocsp_signing.cacertnickname
attributes to
Chapter 5. Step 4: Migrating Security Databases
20
