23.2. Migrating an OpenSSL CA to Certificate System When Using an HSM
When using an HSM and the keys cannot be extracted, make the HSM available to the Certificate System CA. For this, copy the following files to the new Certificate System host:
- Copy the following files to the new Certificate System host:
- CA signing certificate in PEM format
- OpenSSL CA CSR
- Certificate CA certificate chain (if available)
- Set up the CA on the new host. For details, see Section 22.2, “Setting up the CA on the New Host”.
After the migration, you can deactivate the OpenSSL CA or run it in read-only mode, where it only responds to Online Certificate Status Protocol (OCSP) requests.
