Red Hat CERTIFICATE SYSTEM 8 - DEPLOYMENT, Install Manual, Page: 92 / 132

Chapter 6. Cloning Subsystems
82
• If the token is network-based, then the keys and certificates simply need to be available to the
token; the keys and certificates do not need to be copied.
• When using a network-based hardware token, make sure the high-availability feature is enabled on
the hardware token to avoid single point of failure.
6.1.5. Cloning Considerations
As mentioned in
Section 6.1, “About Cloning”
, part of the behavior of cloning is to replication
information between the master and the clone, so that they work from an identical set of data
and records. This means that the LDAP servers for the master and clones need to be able to
communicate. If these servers are on different hosts, then make sure that there is appropriate firewall
access to allow the Directory Server instances to connect with each other.
6.2. Exporting Keys from a Software Database
Ideally, the keys for the master instance are exported when the instance is first created. If the keys
were not exported then or if the backup file is lost, then it is possible to extract the keys from the
internal software database for the subsystem instance using the
PKCS12Export
command. For
example:
PKCS12Export -debug -d /var/lib/ subsystem_name /alias -w p12pwd.txt -p internal.txt -o
master.p12
The PKCS#12 file (in this example,
master.p12
) can then be copied to the clone instance's
alias/
directory and imported during the clone configuration.
NOTE
Keys and certificates do not need to be exported from an HSM, so long as the clone
instance is installed using the same HSM as the master. If both instances use the same
key store, then the keys are naturally available to the clone.
6.3. Cloning a CA
1. Configure the master CA, as described in
Section 3.3, “Configuring a CA”
, and back up the keys.
2. In the
CS.cfg
file for the master CA, enable the the master CA to monitor replication database
changes by adding the
ca.listenToCloneModifications
parameter:
cd /etc/ subsystem_name
ca.listenToCloneModifications=true
3. Create the clone subsystem instance.
IMPORTANT
Do
not
go through the setup wizard for the instance yet.