Release Notes Red Hat Certificate System 10 Highlighted features and updates related to Red Hat Certificate System 10 Red Hat Customer Content Services

Commands:
The following procedure describes the prerequisites and the basic installation process for {RHCS} 10.
subscription-manager register subscription-manager list --available --all
subscription-manager attach --pool=POOL_ID_RHEL_SERVER subscription-manager attach --pool=POOL_ID_CERT_SYSTEM
dnf update
& dnf module enable 389-ds:1.4 && dnf install 389-ds-base
dscreate interactive
dnf module enable redhat-pki:10 && dnf install redhat-pki
pkispawn
ldapmodify -D "cn=Directory Manager" -W -x -p 3389 -h hostname -x <<EOF dn: dc=example,dc=org changetype: modify add: aci aci: (targetattr!="userPassword || aci")(version 3.0; acl "Enable anonymous access"; allow (read, search, compare) userdn="ldap:///anyone";) EOF
certutil -vv -V -d /var/lib/pki/clone-KRA/alias/ -h nfast -n 'token:auditSigningCert cert-topology-02-KRA KRA' -u J Enter Password or Pin for "token": certutil: certificate is invalid: Certificate type not approved for application.
certutil -M -d /var/lib/pki/clone-KRA/alias/ -n 'token:auditSigningCert cert-topology-02-KRA KRA' -t u,u,Pu certutil -vv -V -d /var/lib/pki/clone-KRA/alias/ -h nfast -n 'token:auditSigningCert cert-topology-02-KRA KRA' -u J Enter Password or Pin for "token": certutil: certificate is valid
ldapmodify -D "cn=Directory Manager" -W -x -p 3389 -h hostname -x <<EOF dn: dc=example,dc=org changetype: modify add: aci aci: (targetattr!="userPassword || aci")(version 3.0; acl "Enable anonymous access"; allow (read, search, compare) userdn="ldap:///anyone";) EOF
certutil -vv -V -d /var/lib/pki/clone-KRA/alias/ -h nfast -n 'token:auditSigningCert cert-topology-02-KRA KRA' -u J Enter Password or Pin for "token": certutil: certificate is invalid: Certificate type not approved for application.
certutil -M -d /var/lib/pki/clone-KRA/alias/ -n 'token:auditSigningCert cert-topology-02-KRA KRA' -t u,u,Pu certutil -vv -V -d /var/lib/pki/clone-KRA/alias/ -h nfast -n 'token:auditSigningCert cert-topology-02-KRA KRA' -u J Enter Password or Pin for "token": certutil: certificate is valid
ldapmodify -D "cn=Directory Manager" -W -x -p 3389 -h hostname -x <<EOF dn: dc=example,dc=org changetype: modify add: aci aci: (targetattr!="userPassword || aci")(version 3.0; acl "Enable anonymous access"; allow (read, search, compare) userdn="ldap:///anyone";) EOF
pki -d /opt/pki/certdb/ -c SECret.123 -p 25443 -n 'PKI TPS Administrator for Example.Org' tps-token-find
certutil -vv -V -d /var/lib/pki/clone-KRA/alias/ -h nfast -n 'token:auditSigningCert cert-topology-02-KRA KRA' -u J Enter Password or Pin for "token": certutil: certificate is invalid: Certificate type not approved for application.
certutil -M -d /var/lib/pki/clone-KRA/alias/ -n 'token:auditSigningCert cert-topology-02-KRA KRA' -t u,u,Pu certutil -vv -V -d /var/lib/pki/clone-KRA/alias/ -h nfast -n 'token:auditSigningCert cert-topology-02-KRA KRA' -u J Enter Password or Pin for "token": certutil: certificate is valid
ldapmodify -D "cn=Directory Manager" -W -x -p 3389 -h hostname -x <<EOF dn: dc=example,dc=org changetype: modify add: aci aci: (targetattr!="userPassword || aci")(version 3.0; acl "Enable anonymous access"; allow (read, search, compare) userdn="ldap:///anyone";) EOF
ldapmodify -x -D "cn=Directory Manager" -w USDPASSWORD << EOF dn: cn=Auditors,ou=Groups,{rootSuffix} changeType: add objectClass: top objectClass: groupOfUniqueNames cn: Auditors description: People who can read the signed audit logs for TPS EOF
ldapmodify -D "cn=Directory Manager" -W -x -p 3389 -h hostname -x <<EOF dn: dc=example,dc=org changetype: modify add: aci aci: (targetattr!="userPassword || aci")(version 3.0; acl "Enable anonymous access"; allow (read, search, compare) userdn="ldap:///anyone";) EOF
ldapmodify -D "cn=Directory Manager" -W -x -p 3389 -h hostname -x <<EOF dn: dc=example,dc=org changetype: modify add: aci aci: (targetattr!="userPassword || aci")(version 3.0; acl "Enable anonymous access"; allow (read, search, compare) userdn="ldap:///anyone";) EOF