Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Руководство администратора

Страница: 164 / 512

Chapter 6. Data Recovery Manager
144
• A transport key pair and corresponding certificate.
• A storage key pair.
Figure 6.1, “How the Key Archival Process Works”
illustrates how the key archival process occurs
when an end entity requests a certificate.
Figure 6.1. How the Key Archival Process Works
1. The client requests and generates a dual key pair.
a. The end entity, using a client which can generate dual key pairs, submits a request through
the Certificate Manager enrollment form.
b. The client detects the JavaScript in the enrollment form and exports only the private
encryption key, not the private signing key.
c. The Certificate Manager detects the key archival option in the request and asks the client for
the private encryption key.
d. The client encrypts the private encryption key with the public key from the DRM's transport
certificate embedded in the enrollment form.
2. After approving the certificate request and issuing the certificate, the Certificate Manager sends it
to the DRM for storage, along with the public key). The Certificate Manager waits for verification
from the DRM that the private key has been received and stored and that it corresponds to the
public encryption key.
3. The DRM decrypts it with the private key. After confirming that the private encryption key
corresponds to the public encryption key, the DRM encrypts it again with its public key pair of the
storage key before storing it in its internal database.