Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 211 / 554

Configuring Server-Side Key Generation and Archival of Encryption Keys
189
</VirtualHost>
3. Restart the TPS instance.
/etc/init.d/rhpki-tps restart
4. The Enterprise Security Client needs to be configured to communicate with the TPS over SSL; this
is done by setting the
Phone Home URL
, which is the default URL the Enterprise Security Client
uses to connect to the TPS.
Resetting the Enterprise Security Client's Phone Home URL is described in more detail in
Managing Smart Cards with the Enterprise Security Client
.
a. Open the Enterprise Security Client.
/usr/lib/esc-1.0.1/esc
b. Insert a new, blank token into the machine.
Blank tokens are unformatted, so they do not have an existing Phone Home URL, and
the URL must be set manually. Formatted tokens (and tokens can be formatted by the
manufacturer or by your IT department) already have the URL set, and thus do not prompt to
set the Phone Home URL.
c. Fill in the new TPS URL with the SSL port information. For example:
http s ://server.example.com: 7890 /cgi-bin/home/index.cgi
8.5.2. Configuring Server-Side Key Generation and Archival of
Encryption Keys
The global platform environment prevents removing private keys from the smart card. For encryption
keys, it is often necessary to back up the key material for later recovery, which means the keys
should be generated outside the smart card and then imported. The keys are generated in the DRM
subsystem, where the keys can also be archived. The TPS, TKS, and DRM must all be configured to
support server-side generation and archival for encryption keys.
To configure server-side key generation for tokens enrolled through the token management system:
1. Add the TPS to the DRM as a key recovery agent.
2. Import the DRM transport key into the TKS.
3. Configure the TPS to generate and archive keys.
8.5.2.1. Step 1: Adding the TPS as a DRM Recovery Agent
1. Open the DRM Console.
2. In the
Configuration
tab, select
Users and Groups
.
3. In the
Users
tab, click
Add
, and create the new user; give this user a name such as
TPS
Recovery Agent
. Add this user to the
Data Recovery Manager Agents
group.