Red Hat CERTIFICATE SYSTEM 7.0 - MIGRATION GUIDE Manuel utilisateur

Red Hat Certificate System

Migration Guide: 7.x to 7.3

7.0

Matthew Harmsen

ISBN: N/A

Publication date: March 12, 2008

This migration guide provides in-depth procedures to migrate subsystems, user information, and

certificate and key materials from Netscape Certificate Management System 7.0 and Red Hat

Certificate System 7.1 and 7.2 to Red Hat Certificate System 7.3.

Red Hat Certificate System

Red Hat Certificate System: Migration Guide: 7.x to 7.3

Author Matthew Harmsen <[email protected]>

Editor Ella Deon Lackey <[email protected]>

Open Publication License, V1.0 or later with the restrictions noted below (the latest version of the OPL is presently

available at http://www.opencontent.org/openpub/).

Distribution of substantively modified versions of this document is prohibited without the explicit permission of the

Distribution of the work or derivative of the work in any standard (paper) book form for commercial purposes is

prohibited unless prior permission is obtained from the copyright holder.

Red Hat and the Red Hat "Shadow Man" logo are registered trademarks of Red Hat, Inc. in the United States and other

countries.

All other trademarks referenced herein are the property of their respective owners.

The GPG fingerprint of the [email protected] key is:

CA 20 86 86 2B D6 9D FC 65 F6 EC C4 21 91 80 CD DB 42 A6 0E

1801 Varsity Drive

Raleigh, NC 27606-2072

USA

Phone: +1 919 754 3700

Phone: 888 733 4281

Fax: +1 919 754 3701

PO Box 13588

Research Triangle Park, NC 27709

USA

Red Hat Certificate System

1. Introduction to Red Hat Certificate System Migration ................................................ 1

1. Certificate System Migration Overview ............................................................ 1

1.1. Migration Scripts ................................................................................. 2

1.2. Certificate System Subsystems ............................................................ 3

2. Considerations before Migration ...................................................................... 4

2. Step 1: Preparing the Older Server Instance for Migration ......................................... 7

3. Step 2: Installing the New Certificate System ........................................................... 9

4. Step 3: Stopping the New Certificate System Servers ..............................................11

5. Step 4: Migrating Security Databases .....................................................................13

1. Certificate Authority (CA) Migration ................................................................13

1.1. Option 1: Security Databases to Security Databases Migration ..............13

1.2. Option 2: Security Databases to HSM Migration ...................................15

1.3. Option 3: HSM to Security Databases Migration ...................................18

1.4. Option 4: HSM to HSM Migration .........................................................21

2. Data Recovery Manager (DRM) Migration ......................................................23

2.1. Option 1: Security Databases to Security Databases Migration ..............24

2.2. Option 2: Security Databases to HSM Migration ...................................25

2.3. Option 3: HSM to Security Databases Migration ...................................29

2.4. Option 4: HSM to HSM Migration .........................................................33

3. Online Certificate Status Protocol Manager (OCSP) Migration .........................36

3.1. Option 1: Security Databases to Security Databases Migration ..............36

3.2. Option 2: Security Databases to HSM Migration ...................................38

3.3. Option 3: HSM to Security Databases Migration ...................................41

3.4. Option 4: HSM to HSM Migration .........................................................44

4. Token Key Service (TKS) Migration ................................................................47

4.1. Option 1: Security Databases to Security Databases Migration ..............47

4.2. Option 2: Security Databases to HSM Migration ...................................49

4.3. Option 3: HSM to Security Databases Migration ...................................54

4.4. Option 4: HSM to HSM Migration .........................................................58

6. Step 5: Migrating Password Cache Data .................................................................63

7. Step 6: Migrating Internal Databases ......................................................................65

8. Step 7: Customizing User Data (Non-Console) ........................................................71

9. Step 8: Starting All Certificate System 7.3 Instances ................................................73

10. Step 9: Generate New Certificate System Server Certificates .................................75

1. Self-Signing an SSL Server Certificate for a CA ..............................................75

2. Requesting a New SSL Server Certificate from a Third-Party CA .....................76

3. Generating a New DRM, OCSP, or TKS SSL Server Certificate .......................77

11. Step 10: Customizing User Data (Console) ...........................................................79

12. Step 11: Verifying Migration .................................................................................81

Introduction to Red Hat Certificate

System Migration

Netscape Certificate Management System (CMS) versions 7.0, 7.1, and 7.2 can be migrated to

Red Hat Certificate System version 7.3 using the Red Hat Certificate System migration utility.

Certificate System has the ability to extract data from the installation of a previous version and

migrate this data to 7.3. Each Certificate System subsystem is migrated independently.

• Product downgrade, extracting information from a newer version to import into an older

version, is not supported by the migration utility in any version of the Certificate System.

• Certificate System 7.3 does not support in-place upgrades. This is true even when the

installations are on the same machine, running the same platform. For example, a Red Hat

Certificate System 7.1 installation on a machine named delta.example.com running Red Hat

Enterprise Linux has to be migrated to Certificate System 7.3 installation, even if the 7.3

installation is on the same machine named delta.example.com running Red Hat Enterprise

Linux. This is accomplished simply by supplying a different installation directory for each

instance.

NOTE

Throughout this manual, all system instances are referred to as Certificate

System, unless the specific version or product name is required.

1. Certificate System Migration Overview

The migration process is staged to migrate the different subsets of Certificate System

information separately. The general process is as follows:

1. Install the Certificate System 7.3 subsystem instances.

2. Migrate the Certificate Management System 7.x security databases, which contains the key

and certificate materials for the server, to the Certificate System 7.3 instances.

3. Migrate the password database information for Certificate Management System 7.x to the

Certificate System 7.3 password file.

4. Migrate the Certificate Management System 7.x internal databases, which contain user and

group entries, to the Certificate System 7.3 server.

5. Migrate customized server configuration data from the 7.x server to Certificate System 7.3.

Chapter 1.

6. Renew all migrated certificates.

1.1. Migration Scripts

The Certificate System migration utility contains several separate platform-independent tools,

but only two are required for migrating a Certificate System installation: one program to convert

all of the data in an LDIF that was exported from the 7.x installation into a normalized LDIF text

file, and another program to convert the normalized LDIF text file into an LDIF data file that can

be imported into the newer Certificate System.

NOTE

The major version number of the migration export/import package is applied to all

service packs for that version. (This also applies to installations which contain

hot-fixes, individual bug fixes made after a service pack is released.)

Certificate System migration export utilities are files named versionToTxt. For migrating 7.0,

7.1, and 7.2 servers to Certificate System 7.3, there are three files which are used, depending

on your 7.x version: 70ToTxt,71ToTxt, and 72ToTxt. Each export tool contains the following

files:

• Two precompiled Java™classes

• An tool shell script

• An tool batch script

• The Java™source file that produced the precompiled Java™classes

• A sample shell script that can compile the source file

• A sample batch script that can compile the source file

The export file to use is determined by the older version of the Certificate System being

migrated.

NOTE

Each compilation batch and shell script is dependent on a specific version of the

Java software development kit defined in its comments.

Certificate System migration import utilities are files named TxtToversion. To migrate the

Chapter 1. Introduction to Red Hat Certificate System Migration

Certificate Management System 7.x servers to Certificate System 7.3, use the TxtTo73 script.

The import tool contains the following files:

• Three precompiled Java™classes

• An tool shell script

• An tool batch script

• The Java™source file that produced the precompiled Java™classes

• A sample shell script that can compile the source file

• A sample batch script that can compile the source file

Each compilation batch and shell script is dependent upon a specific version of the Java™

software development kit as defined in the comments.

1.2. Certificate System Subsystems

Certificate System installations may exist on different platforms. Additionally, each Certificate

System installation may contain more than one type of subsystem or more than one instance of

a type of subsystem. The following subsystems may be present in a Certificate System

installation:

• Certificate Authority (CA)

• Data Recovery Manager (DRM)

• Online Certificate Status Protocol (OCSP) Manager

• Registration Authority (RA)

• Token Key Service (TKS)

• Token Processing System (TPS)

The following table defines the platforms and subsystems supported by different versions of

Certificate System:

Product (including service

packs and hot-fixes) Subsystems Platforms

Netscape Certificate

Management System 7.0 CA

DRM

OCSP

TKS

TPS

Red Hat Enterprise Linux AS

2.1

Solaris 8

Certificate System Subsystems

Product (including service

packs and hot-fixes) Subsystems Platforms

Red Hat Certificate System

7.1 CA

DRM

OCSP

TKS

TPS

Red Hat Enterprise Linux

AS/ES 3

Red Hat Enterprise Linux

AS/ES 4

Solaris 9

Red Hat Certificate System

7.2 CA

DRM

OCSP

TKS

TPS

Red Hat Enterprise Linux

AS/ES 4 (i386)

Red Hat Enterprise Linux

AS/ES 4 (AMD64, Intel

EM64T)

Solaris 9 (64-bit)

Red Hat Certificate System

7.3 CA

DRM

OCSP

TKS

TPS

Red Hat Enterprise Linux

AS/ES 4 (i386)

Red Hat Enterprise Linux

AS/ES 4 (for AMD64 and Intel

EM64T)

Solaris 9 (64-bit)

Table 1.1. Certificate System Subsystem Types and Platforms

2. Considerations before Migration

Since all migrations are unique to a deployment, it is strongly recommended that the entire

migration process be planned in advance. Here are some common issues related to migration.

The Migration Procedure.

• Not all steps in the migration processes apply to every deployment. Follow only the steps

which apply to the deployment being migrated.

• Perform all steps in the migration procedure for every instance of each subsystem being

migrated. Always follow the steps for migration in the order which they are presented in the

manual, even if not every step needs to be performed.

• Perform each subsystem migration as a separate migration. Wait until one subsystem

migration is complete before starting the migration of the next subsystem.

Setting File Permissions.

Chapter 1. Introduction to Red Hat Certificate System Migration

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Red Hat Logiciel

Red Hat

Red Hat ENTERPRISE LINUX 3 - USING BINUTILS Manuel

Red Hat

Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER... Manuel utilisateur

Red Hat

Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Manuel utilisateur

Red Hat

Red Hat NETWORK ENTERPRISE - USER 2.2 Fiche d'information produit

Red Hat

Red Hat CLUSTER FOR ENTERPRISE LINUX 5.0 Guide d'installation

Red Hat

Red Hat NETWORK SATELLITE SERVER 4.1.0 Manuel utilisateur

Red Hat

Red Hat NETWORK - USER 3.0 Fiche d'information produit

Red Hat

Red Hat ENTERPRISE LINUX 3 - USING BINUTILS Manuel

Red Hat

Red Hat CLUSTER SUITE - CONFIGURING AND MANAGING A CLUSTER... Manuel utilisateur

Red Hat

Red Hat ENTERPRISE LINUX 3 - STEP BY STEP GUIDE Manuel utilisateur

Red Hat

Red Hat CERTIFICATE SYSTEM 8 - AGENTS GUIDE Manuel d'installation et d'exploitation

Red Hat

Red Hat ENTERPRISE LINUX 3 - SECURITY GUIDE Manuel utilisateur

Red Hat

Red Hat NETWORK 3.6 - Manuel utilisateur

Red Hat

Red Hat NETWORK 4.1.0 - Manuel utilisateur

Red Hat

Red Hat NETWORK SATELLITE 5.2 - CHANNEL MANAGEMENT Manuel utilisateur

Red Hat

Red Hat CLUSTER MANAGER - INSTALLATION AND Mode d’emploi

Red Hat

Red Hat LVM ADMINISTRATOR FOR RHEL 4.5 Manuel de service

Red Hat

Red Hat NETWORK PROXY 5.3.0 - Manuel utilisateur

Red Hat

Red Hat ADD-ONS - DATASHEET FOR ENTERPRISE LINUX 6 Manuel utilisateur

Red Hat

Red Hat APPLICATION SERVER - JONAS Instructions de fonctionnement

Red Hat

Red Hat CLUSTER FOR ENTERPRISE LINUX 5.0 Manuel utilisateur

Red Hat

Red Hat ENTERPRISE LINUX 3 - SECURITY GUIDE Mode d’emploi

Red Hat

Red Hat NETWORK 4.0 - Manuel utilisateur

Red Hat

Red Hat NETWORK ENTERPRISE - USER 1.1.1 Fiche d'information produit

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur