old_server_root/bin/cert/tools/certutil -L -n
"old_HSM_slot_name:caSigningCert
cert-old_OCSP_instance" -d . -h old_HSM_token_name -a >
caSigningCert.b64
e. Copy the key information from the 6.x server to the 7.3 server.
cp old_server_root/alias/caSigningCert.b64
/var/lib/instance_ID/alias/caSigningCert.b64
4. Open the Certificate System
/alias
directory.
cd /var/lib/instance_ID/alias/
5. Log in as
root
.
6. Set the file user and group to the Certificate System user and group.
# chown user:group ServerCert.p12
# chown user:group ocspSigningCert.p12
# chown user:group caSigningCert.b64
7. Log out as
root
, and log back into the system as the Certificate System user.
8. Set the file permissions.
chmod 00600 ServerCert.p12
chmod 00600 ocspSigningCert.p12
chmod 00600 caSigningCert.b64
9. Import the public/private key pairs of each entry from the PKCS #12 files into the 7.3 security
databases.
pk12util -i ServerCert.p12 -d .
Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
pk12util: PKCS12 IMPORT SUCCESSFUL
pk12util -i ocspSigningCert.p12 -d .
Enter Password or Pin for "NSS Certificate DB":********
Enter password for PKCS12 file: ********
pk12util: PKCS12 IMPORT SUCCESSFUL
Chapter 5. Step 4: Migrating Security Databases
44
