Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 118 / 554

Chapter 3. Administrative Basics
96
3.11.2. Changing a Port Number
To change a port number for a CA, RA, DRM, OCSP, or TKS subsystem:
1. Stop the subsystem instance.
2. Open the instance's configuration directory.
cd /var/lib/ instance_ID /conf
3. Open the
server.xml
file, and edit the appropriate port numbers. For example:
#Define a non-SSL HTTP/1.1 Connector on port 8080 <Connector port="9080"
maxHttpHeaderSize="8192"
====
# Define a SSL HTTP/1.1 Connector on port 8443
<Connector port="9443"
maxHttpHeaderSize="8192"
4. Restart the subsystem.
To change a port number for a TPS subsystem:
1. Stop the TPS instance.
2. Open the instance's configuration directory.
cd /var/lib/ instance_ID /conf
3. Open the
httpd.conf
file, and edit the non-SSL port number. For example:
Listen 0.0.0.0:7888
4. Open the
nss.conf
file, and edit the SSL port numbers. For example:
Listen 0.0.0.0:7889
<VirtualHost _default_:7889>
5. Open the
CS.cfg
file, and edit the both the SSL and non-SSL port numbers. For example:
service.securePort=7889
service.unsecurePort=7888
op.format.tokenKey.issuerinfo.value=http://server.example.com:7888/cgi-bin/home/index.cgi
6. Restart the subsystem.
3.11.3. Configuring Port Separation
For security reasons, some deployments require different TCP ports for the different subsystem
interfaces (administrative, agent, and end-entities). New instances can be installed with separated
ports, but existing instances (including the default instances) must have port separation configured
separately.