21.2. Migrating a KRA Simple KRA migration requires the following steps: Section 21.2.1, "Setting Up the KRA on the New Host" Section 21.2.2, "Exporting Contents from the System" Section 21.2.3, "Importing the Data into the New KRA" Section 21.2.4, "Validating the presence of migrated keys from the KRA Agent Page" The KRA located on alpha.example.com contains the data, while the KRA located on omega.example.com does not exist yet. Hostname PKI KRA Version alpha.example.com PKI KRA 10.5 on RHCS 9.7 omega.example.com PKI KRA 10.13 on RHCS 10.6 21.2.1. Setting Up the KRA on the New Host On omega.example.com as the root user: Install and configure a new PKI 10.13 KRA on omega.example.com . Stop the KRA instance. Create a directory to export all required files. Export KRA storage certificates to a file. You will need the KRA storage certificate later to re-encrypt the decrypted old data from the KRA on alpha. In the following example, the file is called omega.crt : Move the omega.crt file to the /export/pki directory. Stop the Directory Server. Note If db2ldif is missing, install the 389-ds-base-legacy-tools package. Extract the KRA LDAP database configurations. You will need the new KRA LDAP database configurations for transforming the old data to the new. Move the /tmp/omega.ldif file to the /export/pki directory. 21.2.2. Exporting Contents from the System On alpha.example.com as the root user: Create a common directory: Stop the Directory Server. In this example, the server is named alpha : Generate the LDIF from the KRA LDAP database: Move the /tmp/alpha.ldif file to /export/pki directory: Copy the KRA NSS security databases to the data area: Go to the /export/pki directory: Obtain the flat-file containing the new KRA's storage certificate from omega.example.com : Obtain the internal password: Run the KRATool on alpha.example.com : Note Alternatively, you can create a plain-text file protected from unauthorized access containing one and only password that will be automatically accessed by a certificate or a certificate database. Add this file to KRATool with the -source_pki_security_database_pwdfile <path_to_PKI_password_file> command-line option. Copy the alpha2omega.ldif file to omega.example.com : 21.2.3. Importing the Data into the New KRA On omega.example.com as the root user: Go to /export/pki directory Concatenate the ldif files: Import the omega_alpha.ldif file into the LDAP database associated with the PKI KRA: Start the Directory Server: Start the KRA instance. 21.2.4. Validating the presence of migrated keys from the KRA Agent Page The last step is to perform key recovery of migrated keys from the KRA Agent page. 21.2.5. Post-Upgrade Testing Follow the key recovery operation for user key archived before upgrade. Procedure 21.1. Key Recovery Test Display the base64 user certificate created before upgrade. Use this certificate to generate a key recovery request through KRA Agent UI. Approve the recovery request. Download the key from the KRA UI.

Commands:
systemctl stop pki-tomcatd@ <pki-kra>
mkdir -p /export/pki
cd /var/lib/pki/ <pki-kra> /alias/ # pki-server cert-export kra_storage -i <pki-kra> --cert-file <omega.crt> Certificate: Data: Version: 3 (0x2) Serial Number: 8 (0x8) Signature Algorithm: sha256WithRSAEncryption Issuer: O = example.com Security Domain, OU = topology-02-CA, CN = CA Signing Certificate Validity Not Before: Dec 19 10:58:02 2019 GMT Not After : Dec 8 10:58:02 2021 GMT Subject: O = example.com Security Domain, OU = topology-02-KRA, CN = DRM Storage Certificate Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:99:c1:f6:f4:0d:75:67:ff:58:3a:28:ee:34:f1: 40:0a:e1:5b:f3:9d:f4:c2:5a:1e:d0:d5:0c:62:c1:
mv omega.crt /export/pki/
systemctl stop dirsrv@omega
/usr/lib64/dirsrv/slapd- omega /db2ldif -n <pki-kra-KRA> -a /tmp/ omega .ldif
mv /tmp/omega.ldif /export/pki/
mkdir -p /export/pki
systemctl stop dirsrv@alpha
/usr/lib64/dirsrv/slapd- alpha /db2ldif -n <pki-kra-KRA> -a /tmp/alpha.ldif
mv /tmp/alpha.ldif /export/pki/
cp -p /var/lib/pki/ <pki-kra> /alias/* /export/pki/
cd /export/pki
sftp root@omega.example.com sftp> cd /export/pki sftp> get omega.crt sftp> quit
cat /var/lib/ <instance_name> /conf/password.conf
KRATool -kratool_config_file /usr/share/pki/java-tools/KRATool.cfg -source_ldif_file /export/pki/alpha.ldif -target_ldif_file /export/pki/alpha2omega.ldif -log_file /tmp/KRATool_26_05_2023.log -source_pki_security_database_path /export/pki/ -source_storage_token_name "Internal Key Storage Token" -source_storage_certificate_nickname " <storageCert cert-pki-tomcat KRA> " -target_storage_certificate_file /export/pki/omega.crt -source_kra_naming_context alpha.example.com -target_kra_naming_context omega.example.com -unwrap_algorithm AES -process_requests_and_key_records_only PROCESSING KRATOOL CONFIG FILE: ................................... FINISHED. SUCCESSFULLY processed kratool config file! Initializing source PKI security databases in '/export/pki/'. Retrieving token from CryptoManager. Retrieving source storage token called 'Internal Key Storage Token'. Retrieving source storage cert with nickname of 'storageCert cert-pki-tomcat KRA'. BEGIN: Obtaining the private key from the source storage token . . . Enter password for Internal Key Storage Token ************ FINISHED: Obtaining the private key from the source storage token. BEGIN: Obtaining the public key from the target storage certificate . . . FINISHED: Obtaining the public key from the target storage certificate. PROCESSING: xxxxxxxxxxxxxxxxxxxxxxxxx... SUCCESSFULLY converted source LDIF file --> target LDIF file! FINISHED "KRATool -kratool_config_file /usr/share/pki/java-tools/KRATool.cfg -source_ldif_file /export/pki/alpha.ldif -target_ldif_file /export/pki/alpha2omega.ldif -log_file /tmp/DRMTool_20_05_2021.log -source_pki_security_database_path /export/pki/ -source_storage_token_name 'Internal Key Storage Token' -source_storage_certificate_nickname 'storageCert cert-pki-tomcat KRA' -target_storage_certificate_file /export/pki/omega.crt -source_pki_security_database_pwdfile '/export/pki/password.cfg' -source_kra_naming_context 'alpha.example.com' -target_kra_naming_context 'omega.example.com' -process_requests_and_key_records_only"
sftp root@omega.example.com sftp> cd /export/pki sftp> put alpha2omega.ldif sftp> quit
cd /export/pki
cat omega .ldif alpha2omega .ldif > omega_alpha .ldif
/usr/lib64/dirsrv/slapd-omega/ldif2db -n <pki-kra-KRA> -i /export/pki/ omega_alpha .ldif
systemctl start dirsrv@ omega
systemctl start pki-tomcatd@ <pki-kra>
pki -d /root/nssdb/ -p 21080 -n ' <PKI Administrator - example.com Security Domain> ' kra-key-find Enter password for Internal Key Storage Token ---------------- 3 key(s) matched ---------------- Key ID: 0x1 Algorithm: 1.2.840.113549.1.1.1 Size: 1024 Owner: UID=alpha1 Key ID: 0x2 Algorithm: 1.2.840.113549.1.1.1 Size: 1024 Owner: UID=alpha2 Key ID: 0x3 Algorithm: 1.2.840.113549.1.1.1 Size: 1024 Owner: UID=alpha3 ---------------------------- Number of entries returned 3 ----------------------------
<pki -n 'PKI Administrator - example.com> ' -c <Secret.123> ca-cert-export <0xd> Serial Number: 0xd Subject DN: UID=alpha Issuer DN: CN=CA Signing Certificate,OU=pki-tomcat,O=example.com Security Domain Status: VALID Not Valid Before: Wed Jun 07 01:49:07 EDT 2023 Not Valid After: Mon Dec 04 01:49:07 EST 2023 ----BEGIN CERTIFICATE---- MIIDODCCAiCgAwIBAgIBDTANBgkqhkiG9w0BAQsFADBtMTUwMwYDVQQKDCxpZG1xZS5sYWIuZW5n LmJvcy5yZWRoYXQuY29tIFNlY3VyaXR5IERvbWFpbjETMBEGA1UECwwKcGtpLXRvbWNhdDEfMB0G A1UEAwwWQ0EgU2lnbmluZyBDZXJ0aWZpY2F0ZTAeFw0yMzA2MDcwNTQ5MDdaFw0yMzEyMDQwNjQ5 [...output truncated...] EJyoMFM+RaAcTh+C3S0JZEoKlAS3UlJOMxk3BFZdWpv7ia+1faV6LFPZSCZ/m8i2c3KZNxFW2xv1 DTIIVc7a1uEDApVDHf5aFcm0nGpEVeK+yvP4r1eD ----END CERTIFICATE----
pki -c <Secret.123> -n ' <PKI Administrator - example.com Security Domain> ' -p 8443 -P https kra-key-request-review <0x2> --action approve ----- Result ------ Request ID: 0x2 Type: recovery Status: approved