21.2. Migrating a KRA
Simple KRA migration requires the following steps:
The KRA located on alpha.example.com contains the data, while the KRA located on omega.example.com does not exist yet.
Hostname | PKI KRA Version |
---|---|
alpha.example.com | PKI KRA 10.5 on RHCS 9.7 |
omega.example.com | PKI KRA 10.13 on RHCS 10.6 |
21.2.1. Setting Up the KRA on the New Host
On omega.example.com as the
root
user:
- Install and configure a new PKI 10.13 KRA on omega.example.com.
- Stop the KRA instance.
#
systemctl stop pki-tomcatd@<pki-kra>
- Create a directory to export all required files.
#
mkdir -p /export/pki
- Export KRA storage certificates to a file. You will need the KRA storage certificate later to re-encrypt the decrypted old data from the KRA on alpha. In the following example, the file is called omega.crt:
#
cd /var/lib/pki/<pki-kra>/alias/
#
pki-server cert-export kra_storage -i <pki-kra> --cert-file <omega.crt>
Certificate: Data: Version: 3 (0x2) Serial Number: 8 (0x8) Signature Algorithm: sha256WithRSAEncryption Issuer: O = example.com Security Domain, OU = topology-02-CA, CN = CA Signing Certificate Validity Not Before: Dec 19 10:58:02 2019 GMT Not After : Dec 8 10:58:02 2021 GMT Subject: O = example.com Security Domain, OU = topology-02-KRA, CN = DRM Storage Certificate Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:99:c1:f6:f4:0d:75:67:ff:58:3a:28:ee:34:f1: 40:0a:e1:5b:f3:9d:f4:c2:5a:1e:d0:d5:0c:62:c1: - Move the
omega.crt
file to the/export/pki
directory.#
mv omega.crt /export/pki/
- Stop the Directory Server.
#
systemctl stop dirsrv@omega
Note
Ifdb2ldif
is missing, install the 389-ds-base-legacy-tools package. - Extract the KRA LDAP database configurations. You will need the new KRA LDAP database configurations for transforming the old data to the new.
#
/usr/lib64/dirsrv/slapd-omega/db2ldif -n <pki-kra-KRA> -a /tmp/omega.ldif
- Move the
/tmp/omega.ldif
file to the/export/pki
directory.#
mv /tmp/omega.ldif /export/pki/
21.2.2. Exporting Contents from the Previous System
On alpha.example.com as the
root
user:
- Create a common directory:
#
mkdir -p /export/pki
- Stop the Directory Server. In this example, the server is named alpha:
#
systemctl stop dirsrv@alpha
- Generate the LDIF from the KRA LDAP database:
#
/usr/lib64/dirsrv/slapd-alpha/db2ldif -n <pki-kra-KRA> -a /tmp/alpha.ldif
- Move the
/tmp/alpha.ldif
file to/export/pki
directory:#
mv /tmp/alpha.ldif /export/pki/
- Copy the KRA NSS security databases to the data area:
#
cp -p /var/lib/pki/<pki-kra>/alias/* /export/pki/
- Go to the /export/pki directory:
#
cd /export/pki
- Obtain the flat-file containing the new KRA’s storage certificate from omega.example.com:
sftp root@omega.example.com sftp> cd /export/pki sftp> get omega.crt sftp> quit
- Obtain the internal password:
#
cat /var/lib/<instance_name>/conf/password.conf
- Run the
KRATool
on alpha.example.com:# KRATool \ -kratool_config_file /usr/share/pki/java-tools/KRATool.cfg \ -source_ldif_file /export/pki/alpha.ldif \ -target_ldif_file /export/pki/alpha2omega.ldif \ -log_file /tmp/KRATool_26_05_2023.log \ -source_pki_security_database_path /export/pki/ \ -source_storage_token_name "Internal Key Storage Token" \ -source_storage_certificate_nickname "<storageCert cert-pki-tomcat KRA>" \ -target_storage_certificate_file /export/pki/omega.crt \ -source_kra_naming_context alpha.example.com \ -target_kra_naming_context omega.example.com \ -unwrap_algorithm AES \ -process_requests_and_key_records_only PROCESSING KRATOOL CONFIG FILE: ................................... FINISHED. SUCCESSFULLY processed kratool config file! Initializing source PKI security databases in '/export/pki/'. Retrieving token from CryptoManager. Retrieving source storage token called 'Internal Key Storage Token'. Retrieving source storage cert with nickname of 'storageCert cert-pki-tomcat KRA'. BEGIN: Obtaining the private key from the source storage token . . . Enter password for Internal Key Storage Token ************ FINISHED: Obtaining the private key from the source storage token. BEGIN: Obtaining the public key from the target storage certificate . . . FINISHED: Obtaining the public key from the target storage certificate. PROCESSING: xxxxxxxxxxxxxxxxxxxxxxxxx...... SUCCESSFULLY converted source LDIF file --> target LDIF file! FINISHED "KRATool -kratool_config_file /usr/share/pki/java-tools/KRATool.cfg -source_ldif_file /export/pki/alpha.ldif -target_ldif_file /export/pki/alpha2omega.ldif -log_file /tmp/DRMTool_20_05_2021.log -source_pki_security_database_path /export/pki/ -source_storage_token_name 'Internal Key Storage Token' -source_storage_certificate_nickname 'storageCert cert-pki-tomcat KRA' -target_storage_certificate_file /export/pki/omega.crt -source_pki_security_database_pwdfile '/export/pki/password.cfg' -source_kra_naming_context 'alpha.example.com' -target_kra_naming_context 'omega.example.com' -process_requests_and_key_records_only"
Note
Alternatively, you can create a plain-text file protected from unauthorized access containing one and only password that will be automatically accessed by a certificate or a certificate database. Add this file toKRATool
with the-source_pki_security_database_pwdfile <path_to_PKI_password_file>
command-line option. - Copy the
alpha2omega.ldif
file to omega.example.com:sftp root@omega.example.com sftp> cd /export/pki sftp> put alpha2omega.ldif sftp> quit
21.2.3. Importing the Data into the New KRA
On omega.example.com as the
root
user:
- Go to
/export/pki
directory#
cd /export/pki
- Concatenate the
ldif
files:#
cat omega.ldif alpha2omega.ldif > omega_alpha.ldif
- Import the
omega_alpha.ldif
file into the LDAP database associated with the PKI KRA:#
/usr/lib64/dirsrv/slapd-omega/ldif2db -n <pki-kra-KRA> -i /export/pki/omega_alpha.ldif
- Start the Directory Server:
#
systemctl start dirsrv@omega
- Start the KRA instance.
#
systemctl start pki-tomcatd@<pki-kra>
21.2.4. Validating the presence of migrated keys from the KRA Agent Page
The last step is to perform key recovery of migrated keys from the KRA Agent page.
[root@pki1 pki]#
pki -d /root/nssdb/ -p 21080 -n '<PKI Administrator - example.com Security Domain>' kra-key-find
Enter password for Internal Key Storage Token ---------------- 3 key(s) matched ---------------- Key ID: 0x1 Algorithm: 1.2.840.113549.1.1.1 Size: 1024 Owner: UID=alpha1 Key ID: 0x2 Algorithm: 1.2.840.113549.1.1.1 Size: 1024 Owner: UID=alpha2 Key ID: 0x3 Algorithm: 1.2.840.113549.1.1.1 Size: 1024 Owner: UID=alpha3 ---------------------------- Number of entries returned 3 ----------------------------
21.2.5. Post-Upgrade Testing
Follow the key recovery operation for user key archived before upgrade.
Procedure 21.1. Key Recovery Test
- Display the base64 user certificate created before upgrade.
#
<pki -n 'PKI Administrator - example.com>' -c <Secret.123> ca-cert-export <0xd>
Serial Number: 0xd Subject DN: UID=alpha Issuer DN: CN=CA Signing Certificate,OU=pki-tomcat,O=example.com Security Domain Status: VALID Not Valid Before: Wed Jun 07 01:49:07 EDT 2023 Not Valid After: Mon Dec 04 01:49:07 EST 2023 ----BEGIN CERTIFICATE---- MIIDODCCAiCgAwIBAgIBDTANBgkqhkiG9w0BAQsFADBtMTUwMwYDVQQKDCxpZG1xZS5sYWIuZW5n LmJvcy5yZWRoYXQuY29tIFNlY3VyaXR5IERvbWFpbjETMBEGA1UECwwKcGtpLXRvbWNhdDEfMB0G A1UEAwwWQ0EgU2lnbmluZyBDZXJ0aWZpY2F0ZTAeFw0yMzA2MDcwNTQ5MDdaFw0yMzEyMDQwNjQ5 [...output truncated...] EJyoMFM+RaAcTh+C3S0JZEoKlAS3UlJOMxk3BFZdWpv7ia+1faV6LFPZSCZ/m8i2c3KZNxFW2xv1 DTIIVc7a1uEDApVDHf5aFcm0nGpEVeK+yvP4r1eD ----END CERTIFICATE---- - Use this certificate to generate a key recovery request through KRA Agent UI.
- Approve the recovery request.
#
pki -c <Secret.123> -n '<PKI Administrator - example.com Security Domain>' -p 8443 -P https kra-key-request-review <0x2> --action approve
----- Result ------ Request ID: 0x2 Type: recovery Status: approved - Download the key from the KRA UI.