Red Hat CERTIFICATE SYSTEM 8 - DEPLOYMENT, Install Manual, Page: 74 / 132

Chapter 4. Additional Installation Options
64
service subsystem_name restart
4.2. Installing a CA with ECC Enabled
Elliptic curve cryptography
(ECC) is much more secure than the more common RSA-style encryption,
which allows it to use much shorter key lengths and makes it faster to generate certificates. CAs which
are ECC-enabled can issue both RSA and ECC certificates, using their ECC signing certificate.
Certificate System does not include a module natively to enable ECC, but it is possible to load and use
a third-party PKCS #11 module with ECC-enabled.
To use the ECC module, it must be loaded before the subsystem instance is configured.
IMPORTANT
Third-party ECC modules must have an SELinux policy configured for them, or SELinux
needs to be changed from
enforcing
mode to
permissive
mode to allow the module
to function. Otherwise, any subsystem operations which require the ECC module will fail.
4.2.1. Loading a Third-Party ECC Module
1. Copy the third-party module to a common directory, like
/usr/lib
for 32-bit systems or
/usr/
lib64
for 64-bit systems.
2. Create a new CA instance by running
pkicreate
, but do
not
go through the configuration wizard.
3. Stop the CA.
service pki-ca stop
4. The CA runs as the
pkiuser
user. As
root
, create a home directory for
pkiuser
.
/usr/sbin/usermod --home /usr/share/pki/pkiuser pkiuser
cd /usr/share/pki
mkdir pkiuser
HOME=/usr/share/pki/pkiuser
export HOME
5. Install the third-party module in the CA's security databases so it is available for the configuration.
cd /var/lib/pki-ca/alias
modutil -dbdir . -nocertdb -add THIRD_PARTY_MODULE -libfile /usr/lib/ libYourNewModule .so
This creates a directory called
.THIRD_PARTY_MODULE
in the new home directory created for
root
(the new
pkiuser
home directory). For example, if the module's name is EccForPki, then
the directory is named
.EccForPki
/
6. Using
modutil
, set the password for the new ECC module token.