22.3. Importing the Data into the New CA

After finishing setting up the new CA in Section 22.2, “Setting up the CA on the New Host”, you can import the data to the Directory Server database:

Shut down the CA service:

# systemctl stop pki-tomcatd@instance_name.service

Optionally, back up the CA database on the new host:
```
# db2bak
```
The backup is stored in the /var/lib/dirsrv/instance_name/bak/host_name-time_stamp/ directory.
Import the data into the new database. For example:
```
# ldapmodify -h <hostname> -x -W -D 'cn=Directory Manager' -a -c -f /tmp/ds_bak/old_ca.ldif | \
     tee /root/import.log
```
The ldapmodify utility only adds new entries and does not update existing entries, created when you installed the CA. For example:
- Top level entries. For example: o=pki-tomcat-CA.
- Default groups. For example: cn=Certificate Manager Agents,ou=groups,o=pki-tomcat-CA.
  Because the standard groups are not updated, the users are not automatically added to these groups. After the import, you must add members to each default group manually. See Section 22.4, “Reassigning Users to Default Groups”.
- Default access control lists (ACL) for the CA.
As mentioned earlier, Directory Server 10 uses syntax validation. Verify the output in the /root/import.log file and search for failed actions, such as ldap_add: Invalid syntax (21). For further details, see Step 1.

Remove the directory entry for the old security domain. For example:

# ldapmodify -W -x -D "cn=Directory Manager"
dn: cn=server.example.com:9445,cn=CAList,ou=Security Domain,o=pki-tomcat-CA
changetype: delete

Enable the CA in the /etc/pki/instance_name/ca/CS.cfg file to act as the certificate revocation list (CRL) master:
```
ca.crl.MasterCRL.enable=true
```

Restart the CA service:

# systemctl start pki-tomcat@instance_name