Red Hat Summit Red Hat SummitSupportKonsoleEntwicklerDemo startenKontakt

Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.

10.7. Converting Masters and Clones

Only one single active CA generating CRLs can exist within the same topology. Similarly, only one OCSP receiving CRLs can exist within the same topology. As such, there can be any number of clones, but there can only be a single configured master for CA and OCSP.
For KRAs and TKSs, there is no configuration difference between masters and clones, but CAs and OCSPs do have some configuration differences. This means that when a master is taken offline — because of a failure or for maintenance or to change the function of the subsystem in the PKI — then the existing master must be reconfigured to be a clone, and one of the clones promoted to be the master.

10.7.1. Converting CA Clones and Masters
Link kopieren

  1. Stop the master CA if it is still running.
  2. Open the existing master CA configuration directory: 
    # cd /var/lib/pki/instance_name/ca/conf
    Copy to Clipboard Toggle word wrap
  3. Edit the CS.cfg file for the master, and change the CRL and maintenance thread settings so that it is set as a clone:
    • Disable control of the database maintenance thread: 
      ca.certStatusUpdateInterval=0
      Copy to Clipboard Toggle word wrap
    • Disable monitoring database replication changes: 
      ca.listenToCloneModifications=false
      Copy to Clipboard Toggle word wrap
    • Disable maintenance of the CRL cache: 
      ca.crl.IssuingPointId.enableCRLCache=false
      Copy to Clipboard Toggle word wrap
    • Disable CRL generation: 
      ca.crl.IssuingPointId.enableCRLUpdates=false
      Copy to Clipboard Toggle word wrap
    • Set the CA to redirect CRL requests to the new master: 
      master.ca.agent.host=new_master_hostname
master.ca.agent.port=new_master_port
      Copy to Clipboard Toggle word wrap
  4. Stop the cloned CA server. 
    # systemctl stop pki-tomcatd@instance_name.service
    Copy to Clipboard Toggle word wrap
  5. Open the cloned CA's configuration directory. 
    # cd /etc/instance_name
    Copy to Clipboard Toggle word wrap
  6. Edit the CS.cfg file to configure the clone as the new master.
    1. Delete each line which begins with the ca.crl. prefix.
    2. Copy each line beginning with the ca.crl. prefix from the former master CA CS.cfg file into the cloned CA's CS.cfg file.
    3. Enable control of the database maintenance thread; the default value for a master CA is 600. 
      ca.certStatusUpdateInterval=600
      Copy to Clipboard Toggle word wrap
    4. Enable monitoring database replication: 
      ca.listenToCloneModifications=true
      Copy to Clipboard Toggle word wrap
    5. Enable maintenance of the CRL cache: 
      ca.crl.IssuingPointId.enableCRLCache=true
      Copy to Clipboard Toggle word wrap
    6. Enable CRL generation: 
      ca.crl.IssuingPointId.enableCRLUpdates=true
      Copy to Clipboard Toggle word wrap
    7. Disable the redirect settings for CRL generation requests: 
      master.ca.agent.host=hostname
master.ca.agent.port=port number
      Copy to Clipboard Toggle word wrap
  7. Start the new master CA server. 
    # systemctl start pki-tomcatd@instance_name.service
    Copy to Clipboard Toggle word wrap

10.7.2. Converting OCSP Clones
Link kopieren

  1. Stop the OCSP master, if it is still running.
  2. Open the existing master OCSP configuration directory. 
    # cd /etc/instance_name
    Copy to Clipboard Toggle word wrap
  3. Edit the CS.cfg, and reset the OCSP.Responder.store.defStore.refreshInSec parameter to 21600: 
    OCSP.Responder.store.defStore.refreshInSec=21600
    Copy to Clipboard Toggle word wrap
  4. Stop the online cloned OCSP server. 
    # systemctl stop pki-tomcatd@instance_name.service
    Copy to Clipboard Toggle word wrap
  5. Open the cloned OCSP responder's configuration directory. 
    # cd /etc/instance_name
    Copy to Clipboard Toggle word wrap
  6. Open the CS.cfg file, and delete the OCSP.Responder.store.defStore.refreshInSec parameter or change its value to any non-zero number: 
    OCSP.Responder.store.defStore.refreshInSec=15000
    Copy to Clipboard Toggle word wrap
  7. Start the new master OCSP responder server. 
    # systemctl start pki-tomcatd@instance_name.service
    Copy to Clipboard Toggle word wrap
Nach oben
Red Hat logoGithubredditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können. Entdecken Sie unsere neuesten Updates.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

Theme

© 2025 Red Hat