Red Hat CERTIFICATE SYSTEM 6.0 - MIGRATION GUIDE Manuale utente

Red Hat Certificate System

Migration Guide: 6.x to 7.3

6.0

Matthew Harmsen

ISBN: N/A

Publication date: March 12, 2008

This migration guide provides in-depth procedures to migrate subsystems, user information, and

certificate and key materials from Netscape Certificate Management System 6.0, 6.1, and 6.2 to

Red Hat Certificate System 7.3.

Red Hat Certificate System

Red Hat Certificate System: Migration Guide: 6.x to 7.3

Author Matthew Harmsen <[email protected]>

Editor Ella Deon Lackey <[email protected]>

Open Publication License, V1.0 or later with the restrictions noted below (the latest version of the OPL is presently

available at http://www.opencontent.org/openpub/).

Distribution of substantively modified versions of this document is prohibited without the explicit permission of the

Distribution of the work or derivative of the work in any standard (paper) book form for commercial purposes is

prohibited unless prior permission is obtained from the copyright holder.

Red Hat and the Red Hat "Shadow Man" logo are registered trademarks of Red Hat, Inc. in the United States and other

countries.

All other trademarks referenced herein are the property of their respective owners.

The GPG fingerprint of the [email protected] key is:

CA 20 86 86 2B D6 9D FC 65 F6 EC C4 21 91 80 CD DB 42 A6 0E

1801 Varsity Drive

Raleigh, NC 27606-2072

USA

Phone: +1 919 754 3700

Phone: 888 733 4281

Fax: +1 919 754 3701

PO Box 13588

Research Triangle Park, NC 27709

USA

Red Hat Certificate System

1. Introduction to Red Hat Certificate System Migration ................................................ 1

1. Certificate System Migration Overview ............................................................ 1

1.1. Migration Scripts ................................................................................. 2

1.2. Certificate System Subsystems ............................................................ 3

2. Considerations before Migration ...................................................................... 4

2. Step 1: Preparing the 6.x Server Instance for Migration ............................................ 7

3. Step 2: Installing the New Certificate System ........................................................... 9

4. Step 3: Stopping the New Certificate System Servers ..............................................11

5. Step 4: Migrating Security Databases .....................................................................13

1. Certificate Authority (CA) Migration ................................................................13

1.1. Option 1: Security Databases to Security Databases Migration ..............13

1.2. Option 2: Security Databases to HSM Migration ...................................15

1.3. Option 3: HSM to Security Databases Migration ...................................19

1.4. Option 4: HSM to HSM Migration .........................................................21

2. Data Recovery Manager (DRM) Migration ......................................................23

2.1. Option 1: Security Databases to Security Databases Migration ..............24

2.2. Option 2: Security Databases to HSM Migration ...................................26

2.3. Option 3: HSM to Security Databases Migration ...................................30

2.4. Option 4: HSM to HSM Migration .........................................................33

3. Online Certificate Status Protocol Manager (OCSP) Migration .........................37

3.1. Option 1: Security Databases to Security Databases Migration ..............37

3.2. Option 2: Security Databases to HSM Migration ...................................39

3.3. Option 3: HSM to Security Databases Migration ...................................43

3.4. Option 4: HSM to HSM Migration .........................................................46

6. Step 5: Migrating Password Cache Data .................................................................51

7. Step 6: Migrating Internal Databases ......................................................................53

8. Step 7: Customizing User Data (Non-Console) ........................................................59

9. Step 8: Starting All Certificate System 7.3 Instances ................................................61

10. Step 9: Generate New Certificate System Server Certificates .................................63

1. Self-Signing an SSL Server Certificate for a CA ..............................................63

2. Requesting a New SSL Server Certificate from a Third-Party CA .....................64

3. Generating a New DRM, OCSP, or TKS SSL Server Certificate .......................65

11. Step 10: Customizing User Data (Console) ...........................................................67

12. Step 11: Verifying Migration .................................................................................69

Introduction to Red Hat Certificate

System Migration

Netscape Certificate Management System (CMS) versions 6.0x, 6.1, and 6.2 can be migrated to

Red Hat Certificate System version 7.3 using the Red Hat Certificate System migration utility.

Certificate System has the ability to extract data from the installation of a previous version and

migrate this data to 7.3. Each Certificate System subsystem is migrated independently.

• Product downgrade, extracting information from a newer version to import into an older

version, is not supported by the migration utility in any version of the Certificate System.

• Certificate System 7.3 does not support in-place upgrades. This is true even when the

installations are on the same machine, running the same platform. For example, a Certificate

Management System 6.2 installation on a machine named delta.example.com running Red

Hat Enterprise Linux has to be migrated to Certificate System 7.3 installation, even if the 7.3

installation is on the same machine named delta.example.com running Red Hat Enterprise

Linux. This is accomplished simply by supplying a different installation directory for each

instance.

NOTE

Throughout this manual, all system instances are referred to as Certificate

System, unless the specific version or product name is required.

1. Certificate System Migration Overview

The migration process is staged to migrate the different subsets of Certificate System

information separately. The general process is as follows:

1. Install the Certificate System 7.3 subsystem instances.

2. Migrate the Certificate Management System 6.x security databases, which contains the key

and certificate materials for the server, to the Certificate System 7.3 instances.

3. Migrate the password database information for Certificate Management System 6.x to the

Certificate System 7.3 password file.

4. Migrate the Certificate Management System 6.x internal databases, which contain user and

group entries, to the Certificate System 7.3 server.

5. Migrate customized server configuration data from the 6.x server to Certificate System 7.3.

Chapter 1.

6. Renew all migrated certificates.

1.1. Migration Scripts

The Certificate System migration utility contains several separate platform-independent tools,

but only two are required for migrating a Certificate System installation: one program to convert

all of the data in an LDIF that was exported from the 6.x installation into a normalized LDIF text

file, and another program to convert the normalized LDIF text file into an LDIF data file that can

be imported into the newer Certificate System.

NOTE

The major version number of the migration export/import package is applied to all

service packs for that version. (This also applies to installations which contain

hot-fixes, individual bug fixes made after a service pack is released.) For

example, migrating from Certificate Management System 6.01 uses the 60ToTxt

program to export data.

Certificate System migration export utilities are files named versionToTxt. For migrating 6.0x,

6.1, and 6.2 servers to Certificate System 7.3, there are three files which are used, depending

on your 6.x version: 60ToTxt,61ToTxt, and 62ToTxt. Each export tool contains the following

files:

• Two precompiled Java™classes

• An tool shell script

• An tool batch script

• The Java™source file that produced the precompiled Java™classes

• A sample shell script that can compile the source file

• A sample batch script that can compile the source file

The export file to use is determined by the older version of the Certificate System being

migrated.

NOTE

Each compilation batch and shell script is dependent on a specific version of the

Java software development kit defined in its comments.

Chapter 1. Introduction to Red Hat Certificate System Migration

Certificate System migration import utilities are files named TxtToversion. To migrate the

Certificate Management System 6.x servers to Certificate System 7.3, use the TxtTo73 script.

The import tool contains the following files:

• Three precompiled Java™classes

• An tool shell script

• An tool batch script

• The Java™source file that produced the precompiled Java™classes

• A sample shell script that can compile the source file

• A sample batch script that can compile the source file

Each compilation batch and shell script is dependent upon a specific version of the Java™

software development kit as defined in the comments.

1.2. Certificate System Subsystems

Certificate System installations may exist on different platforms. Additionally, each Certificate

System installation may contain more than one type of subsystem or more than one instance of

a type of subsystem. The following subsystems may be present in a Certificate System

installation:

• Certificate Authority (CA)

• Data Recovery Manager (DRM)

• Online Certificate Status Protocol (OCSP) Manager

• Registration Authority (RA)

• Token Key Service (TKS)

• Token Processing System (TPS)

The following table defines the platforms and subsystems supported by different versions of

Certificate System:

Product (including service

packs and hot-fixes) Subsystems Platforms

Netscape Certificate

Management System 6.0 CA

DRM

OCSP

Solaris 8

Windows 2000 (SP 2)

Certificate System Subsystems

Product (including service

packs and hot-fixes) Subsystems Platforms

Netscape Certificate

Management System 6.01 aCA

DRM

OCSP

Red Hat Linux 7.2

Red Hat Enterprise Linux AS

2.1

Solaris 8

Netscape Certificate

Management System 6.1 CA

DRM

OCSP

Solaris 8

Netscape Certificate

Management System 6.2 CA

DRM

OCSP

Red Hat Enterprise Linux AS

2.1

Solaris 8

Red Hat Certificate System

7.3 CA

DRM

OCSP

TKS

TPS

Red Hat Enterprise Linux

AS/ES 4 (i386)

Red Hat Enterprise Linux

AS/ES 4 (for AMD64 and Intel

EM64T)

Solaris 9 (64-bit)

aAlthough Certificate Management System 6.01 was considered a service pack of version 6.0, Certificate Management

System 6.01 is listed separately in this table because it is supported on different platforms.

Table 1.1. Certificate System Subsystem Types and Platforms

2. Considerations before Migration

Since all migrations are unique to a deployment, it is strongly recommended that the entire

migration process be planned in advance. Here are some common issues related to migration.

The Migration Procedure.

• Not all steps in the migration processes apply to every deployment. Follow only the steps

which apply to the deployment being migrated.

• Perform all steps in the migration procedure for every instance of each subsystem being

migrated. Always follow the steps for migration in the order which they are presented in the

manual, even if not every step needs to be performed.

• Perform each subsystem migration as a separate migration. Wait until one subsystem

Chapter 1. Introduction to Red Hat Certificate System Migration

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali Red Hat Software

Red Hat

Red Hat ENTERPRISE VIRTUALIZATION FOR DESKTOPS Manuale utente

Red Hat

Red Hat CLUSTER SUITE 4.7 - CLUSTER LVM... Manuale utente

Red Hat

Red Hat LINUX 7.1 - PSERIES Manuale utente

Red Hat

Red Hat CERTIFICATE SYSTEM 8 - DEPLOYMENT Guida di riferimento rapido

Red Hat

Red Hat APPLICATION STACK 1.3 RELEASE Manuale di istruzioni

Red Hat

Red Hat ENTERPRISE LINUX 4 - FOR X86-ITANIUM AND... Manuale utente

Red Hat

Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Istruzioni per l'installazione e il funzionamento

Red Hat

Red Hat NETWORK SATELLITE SERVER 3.7 Manuale utente

Red Hat

Red Hat ENTERPRISE LINUX 5.5 - S 2010 Manuale utente

Red Hat

Red Hat CLUSTER SUITE FOR ENTERPRISE LINUX 5.1 Manuale utente

Red Hat

Red Hat GLOBAL FILE SYSTEM 4.7 Manuale utente

Red Hat

Red Hat NETWORK 3.6 - Manuale utente

Red Hat

Red Hat ENTERPRISE LINUX 3 - SECURITY GUIDE Manuale utente

Red Hat

Red Hat CLUSTER FOR ENTERPRISE LINUX 5.0 Guida all'installazione

Red Hat

Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE Manuale utente

Red Hat

Red Hat NETWORK - USER REFERENCE GUIDE 2.0 Scheda informativa del prodotto

Red Hat

Red Hat NETWORK SATELLITE 5.0.0 - Manuale di istruzioni

Red Hat

Red Hat ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE Manuale utente

Red Hat

Red Hat ENTERPRISE LINUX 4 - USING BINUTILS Istruzioni per l'installazione e il funzionamento

Red Hat

Red Hat NETWORK SATELLITE 5.2 - CHANNEL MANAGEMENT Manuale utente

Red Hat

Red Hat NETWORK 3.1 - PROVISIONING Manuale utente

Red Hat

Red Hat SYSTEM 8.0 - MIGRATION GUIDE 7.X TO 8.0 Manuale utente

Red Hat

Red Hat CERTIFICATE 7.2 RELEASE NOTES Manuale di istruzioni

Red Hat

Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER... Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuale utente

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente