Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 74 / 554

Chapter 2. Installation and Configuration
52
11. The next panels generate and show certificate requests, certificates, and key pairs.
If an external CA is used to issue the certificates, configuration cannot go forward until they are
received from the CA. When they are issued, paste the certificates into this panel to add them to
the TPS database, and then proceed with the installation. Click
Apply
to view the certificates as
they are imported.
12. Give the information for the new subsystem administrator.
13. Click
Next
through the remaining panels to import the agent certificate into the browser and
complete the configuration.
14. When the configuration is complete, restart the subsystem.
/etc/init.d/rhpki-tps restart
2.7. Creating Additional Subsystem Instances
There can be multiple instances of the same type of subsystem on a single machine or multiple
instances can be installed on separate machines throughout a deployment. Creating additional
subsystem instances is similar to installing and configuring the default instances; there is a script to
run to create a basic installation and then an HTML-based configuration wizard.
All additional CA, RA, DRM, OCSP, TKS, and TPS instances are installed by running a special tool,
pkicreate
. After that, they are configured through the HTML-based administration page. For more
information on
pkicreate
, see the
Certificate System Command-Line Tools Guide
.
NOTE
Additional subsystems can be duplicates, or clones, of existing subsystems. Cloning can
be used for load balancing for heavily trafficked servers and for failover support. Clones
are installed the same as other subsystems, with slight differences in the subsequent
configuration. For more information on using cloning as part of a deployment strategy, see
Chapter 20, Configuring the Certificate System for High Availability
.
2.7.1. Running pkicreate
1. Run the
pkicreate
command. Through the options on this tool, the type of subsystem being
created, the configuration directory, instance name, port numbers, and other basic configuration
information are set. For example, creating a second DRM instance would have the following
command:
pkicreate -pki_instance_root=/var/lib/rhpki-drm2 -subsystem_type=kra -
pki_instance_name=rhpki-drm2
-secure_port=10543 -unsecure_port=10180 -tomcat_server_port=1802 -verbose
NOTE
For a TPS subsystem, do not use the
tomcat_server_port
option since the TPS
subsystem uses Apache rather than Tomcat as its web server.