14.5. Configuring the LDAP Database

1. Stop the Directory Server instance:

   # systemctl stop dirsrv@instance_name

2. Generate a Certificate Signing Request (CSR).
   For example, to generate a CSR which uses 2048 bit RSA encryption, and to store it in the ~/ds.csr file:

   # PKCS10Client -d /etc/dirsrv/slapd-instance_name/ -p password -a rsa -l 2048 -o ~/ds.csr -n "CN=$HOSTNAME"
   PKCS10Client: Debug: got token.
   PKCS10Client: Debug: thread token set.
   PKCS10Client: token Internal Key Storage Token logged in...
   PKCS10Client: key pair generated.
   PKCS10Client: CertificationRequest created.
   PKCS10Client: b64encode completes.
   Keypair private key id: -3387b397ebe254b91c5d6c06dc36618d2ea8b7e6
   
   -----BEGIN CERTIFICATE REQUEST-----
   ...
   -----END CERTIFICATE REQUEST-----
   PKCS10Client: done. Request written to file: ~/ds.csr

3. Start the Directory Server instance to enable the CA to process the request:

   # systemctl start dirsrv@instance_name

4. Submit the CSR to the Certificate System's CA. For example:

   # pki -d /etc/dirsrv/slapd-instance_name/ ca-cert-request-submit --profile caServerCert --csr-file ~/ds.csr
   -----------------------------
   Submitted certificate request
   -----------------------------
     Request ID: 13
     Type: enrollment
     Request Status: pending
     Operation Result: success

1. Import the CA agent certificate into a Network Security Services (NSS) database to sign the CMC full request:
   1. Create a new directory. For example:

      # mkdir ~/certs_db/

   2. Initialize the database in the newly created directory:

      # certutil -N -d ~/certs_db/

   3. Display the serial number of the CA signing certificate:

      # pki -p 8080 ca-cert-find --name "CA Signing Certificate"
      ---------------
      1 entries found
      ---------------
      Serial Number: 0x87bbe2d
      ...

   4. Use the serial number from the previous step to download the CA signing certificate into the ~/certs_db/CA.pem file:

      # pki -p 8080 ca-cert-show 0x87bbe2d --output ~/certs_db/CA.pem

   5. Import the CA signing certificate into the NSS database:

      # pki -d ~/certs_db/ -c password client-cert-import "CA Certificate" --ca-cert ~/certs_db/CA.pem

   6. Import the agent certificate:

      # pk12util -d ~/certs_db/ -i ~/.dogtag/instance_name/ca_admin_cert.p12
      Enter Password or Pin for "NSS FIPS 140-2 Certificate DB": password
      Enter password for PKCS12 file: password
      pk12util: PKCS12 IMPORT SUCCESSFUL
      

2. Create the Certificate Management over CMS (CMC) request:
   1. Create a configuration file, such as ~/sslserver-cmc-request.cfg, with the following content:

      # NSS database directory where the CA agent certificate is stored.
      dbdir=~/certs_db/
      
      # NSS database password.
      password=password
      
      # Token name (default is internal).
      tokenname=internal
      
      # Nickname for CA agent certificate.
      nickname=caadmin
      
      # Request format: pkcs10 or crmf.
      format=pkcs10
      
      # Total number of PKCS10/CRMF requests.
      numRequests=1
      
      # Path to the PKCS10/CRMF request.
      # The content must be in Base-64 encoded format.
      # Multiple files are supported. They must be separated by space.
      input=~/ds.csr
      
      # Path for the CMC request.
      output=~/sslserver-cmc-request.bin

   2. Create the CMC request:

      # CMCRequest ~/sslserver-cmc-request.cfg
      ...
      The CMC enrollment request in base-64 encoded format:
      ...
      The CMC enrollment request in binary format is stored in ~/sslserver-cmc-request.bin

3. Submit the CMC request:
   1. Create a configuration file, such as ~/sslserver-cmc-submit.cfg, with the following content:

      # PKI server host name.
      host=server.example.com
      
      # PKI server port number.
      port=8443
      
      # Use secure connection.
      secure=true
      
      # Use client authentication.
      clientmode=true
      
      # NSS database directory where the CA agent certificate is stored.
      dbdir=~/certs_db/
      
      # NSS database password.
      password=password
      
      # Token name (default: internal).
      tokenname=internal
      
      # Nickname of CA agent certificate.
      nickname=caadmin
      
      # CMC servlet path
      servlet=/ca/ee/ca/profileSubmitCMCFull?profileId=caCMCserverCert
      
      # Path for the CMC request.
      input=~/sslserver-cmc-request.bin
      
      # Path for the CMC response.
      output=~/sslserver-cmc-response.bin

   2. Submit the request:

      # HttpClient sslserver-cmc-submit.cfg
      ...
      The response in binary format is stored in
      ~/sslserver-cmc-response.bin

   3. Optionally, verify the result:

      # CMCResponse -d ~/certs_db/ -i ~/sslserver-cmc-response.bin
      ...
      Number of controls is 1
      Control #0: CMCStatusInfoV2
         OID: {1 3 6 1 5 5 7 7 25}
         BodyList: 1
         Status: SUCCESS
      

4. Display the serial number of the Directory Server certificate:

   # pki -p 8080 ca-cert-find --name "DS Certificate"
   ---------------
   1 entries found
   ---------------
   Serial Number: 0xc3eeb0c
   ...

5. Use the serial number from the previous step to download the certificate:

   # pki -p 8080 ca-cert-show 0xc3eeb0c --output ~/ds.crt

6. Copy the certificate for Directory Server and the CA certificate to the Directory Server host. For example:

   # scp ~/ds.crt ~/certs_db/CA.pem ds.example.com:~/

7. Stop Certificate System:

   # pki-server stop instance_name

1. Stop the Directory Server instance:

   # systemctl stop dirsrv@instance_name

2. Replace the certificates. For details, see the corresponding sections in the Red Hat Directory Server Administration Guide:
   1. Remove the old certificate and CA certificate. See Removing a Certificate.
   2. Install the CA certificate issued by Certificate System. See Installing a CA Certificate.
   3. Install the certificate for Directory Server issued by Certificate System. See Installing a Server Certificate.
3. Start the Directory Server instance:

   # systemctl start dirsrv@instance_name

# pki-server stop instance_name