migration is complete before starting the migration of the next subsystem.
Setting File Permissions.
• On Linux and UNIX systems, make sure that the file owner (user and group) and the file
permissions are correct when the file is copied between two instances. Also make sure that
the target machine allows the file transfer.
• The
chmod
command used in the examples have the permissions
00600
(octal, no sticky bit
permissions, user read/write permissions, no group permissions, no other permissions).
These are the recommended permissions, but are not required.
Extracting Data from a Hardware Security Module.
While the migration procedure refers to extracting data from a hardware security module (HSM),
no Certificate System tool can extract public/private key pairs from an HSM because of Federal
Information Processing Standard (FIPS) 140-1, which protects the private key portion of an
entry. Contact the HSM vendor for information on how to extract data from an old HSM.
Extracted keys should not have any dependencies, such as nickname prefixes, on the old HSM.
Changing Subsystem Names and Port Numbers.
It is possible to change the names of migrated Certificate System subsystem instances, but
greater care must be taken when extracting and renaming certain portions of the data. Because
port numbers are stored in the
server.xml
file, which is unaffected by subsystem migration,
port numbers can be changed between instances without difficulty.
About Usage Examples.
All examples assume that the new passwords are the same as the old passwords.
Subsystem and Version Related Considerations.
• The default key-splitting scheme used by the DRM subsystem in Certificate System 7.1 and
later is not the scheme required by the DRM subsystem key recovery feature in 6.x versions.
There is no way to migrate from the old key-splitting scheme to the new scheme. Therefore,
DRM instances in Certificate Management System 6.x versions cannot be successfully
migrated to version 7.3.
• The RA subsystem was deprecated in Certificate Management System 7.0 and redesigned in
Red Hat Certificate System 7.3, so it is not possible to migrate RA subsystems into Certificate
System version 7.3. All RA request queues should be processed by the 6.x-version servers
into their existing CAs before beginning any CA migrations.
Considerations before Migration
5
