Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Administration Manual

Page: 68 / 512

Chapter 2. Installation and Configuration
48
NOTE
When the first subsystem is installed on a machine, the installation process automatically
creates a new user (
pkiuser
) and group (
pkiuser
). All default Certificate System
instances will run as this user and group.
2.5.2. Installing through up2date
NOTE
There is an environment variable,
DONT_RUN_PKICREATE
, which will stop the
pkicreate
script from running automatically after the subsystems are installed. This
allows the default instances to be installed in user-defined installation directories, instead
of the default locations in
var/lib
. It can be preferable to install through the ISO image
with this environment variable set to block the
pkicreate
script for deployments where
the default instances must be installed in custom locations.
To install the subsystems on Red Hat Enterprise Linux using the
up2date
command, run a command
like the following for each subsystem:
up2date rhpki- subsystem
subsystem
can be
ca
for the CA,
kra
for the DRM,
ocsp
for the OCSP,
tks
for the TKS, and
tps
for
the TPS.
up2date
is used only for the first subsystem instance; any additional subsystem instances should be
added using
pkicreate
.
To install the client using
up2date
, run the following:
up2date esc
2.6. Configuring the Default Subsystem Instances
After the packages have been installed, the subsystem has to be configured by going through the
HTML configuration wizard. The configuration process is similar for the subsystems; differences in
the wizard are described in the panel descriptions in
Section 2.4, “Configuration Setup Wizard”
. The
general process is outlined in this section.
•
Section 2.6.1, “Configuring a CA”
•
Section 2.6.2, “Configuring a DRM, OCSP, or TKS”
•
Section 2.6.3, “Configuring a TPS”
2.6.1. Configuring a CA
1. Open the configuration wizard. When the instance is installed, the process returns a success
message which includes a URL with the login PIN. For example: