22.In the same directory, edit the
serverCertNick.conf
file to contain the old certificate
nickname. For example:
new_HSM_slot_name:Server-Cert cert-old_OCSP_instance
3.3. Option 3: HSM to Security Databases Migration
1. Extract the public/private key pairs from the HSM. The format for the extracted key pairs
should be portable, such as a PKCS #12 file.
The
pk12util
tool provided by Certificate System cannot extract public/private key pairs
from an HSM because of requirements in the FIPS 140-1 standard which protect the private
key. To extract this information, contact the HSM vendor. The extracted keys should not have
any dependencies, such as nickname prefixes, on the HSM.
2. Copy the extracted key pairs from the 6.x server to the 7.3 server.
cp old_server_root/alias/ServerCert.p12
/var/lib/instance_ID/alias/ServerCert.p12
cp old_server_root/alias/ocspSigningCert.p12
/var/lib/instance_ID/alias/ocspSigningCert.p12
3. Extract the public key of the CA signing certificate from the old security databases and save
the base-64 encoded output to a file called
caSigningCert.b64
.
a. Open the Certificate Management System 6.x
/alias
directory.
cd old_server_root/alias
b. Set the
LD_LIBRARY_PATH
environment variable to search the Certificate System libraries.
LD_LIBRARY_PATH=old_server_root/bin/cert/lib
export LD_LIBRARY_PATH
c. Use the Certificate Management System 6.x
certutil
tool to identify the old HSM slot
name.
old_server_root/bin/cert/tools/certutil -U -d .
d. Use the Certificate Management System 6.x
certutil
tool to extract the public key from
the security databases and save the base-64 output to a file.
Migration
43
