NOTE
The old security databases may contain additional public/private key pairs; these
can also be extracted using
pk12util
.
10.Export the public key using the
certutil
tool;
-L
lists the named certificate,
-n
sets the
name of the file and the old prefix, and
-a
outputs the information to a base-64 file.
certutil -L -n "caSigningCert cert-old_OCSP_instance" -d . -a >
caSigningCert.b64
NOTE
The old security databases may contain additional public keys; these can also be
exported using the
certutil
tool.
11.Delete the old security databases.
rm cert8.db
rm key3.db
12.Register the new HSM in the 7.3 token database.
modutil -nocertdb -dbdir . -add new_HSM_token_name -libfile
new_HSM_library_path/new_HSM_library
13.Identify the new HSM slot name.
modutil -dbdir . -nocertdb -list
14.Create new security databases.
certutil -N -d .
15.Import the public/private key pairs of each entry from the PKCS #12 files into the new HSM.
pk12util -i ServerCert.p12 -d . -h new_HSM_slot_name
Enter Password or Pin for "new_HSM_slot_name":********
Enter password for PKCS12 file: ********
Option 2: Security Databases to HSM
41
