Chapter 4. Setting up Key Archival and Recovery
For more information on Key Archival and Recovery, see the Archiving, Recovering, and Rotating Keys section in the Red Hat Certificate System Planning, Installation, and Deployment Guide.
This chapter explains how to setup the Key Recovery Authority (KRA), previously known as Data Recovery Manager (DRM), to archive private keys and to recover archived keys for restoring encrypted data.
Note
This chapter only discusses archiving keys through client-side key generation. Server-side key generation and archivals, whether it's initiated through TPS, or through CA's End Entity portal, are not discussed here.
For information on smart card key recovery, see Section 6.11, “Setting Up Server-side Key Generation”.
For information on server-side key generation provided at the CA’s EE portal, see Section 5.2.2, “Generating CSRs Using Server-Side Key Generation”.
Note
Gemalto SafeNet LunaSA only supports PKI private key extraction in its CKE - Key Export model, and only in non-FIPS mode. The LunaSA Cloning model and the CKE model in FIPS mode do not support PKI private key extraction.
When KRA is installed, it joins a security domain, and is paired up with the CA. At such time, it is configured to archive and recover private encryption keys. However, if the KRA certificates are issued by an external CA rather than one of the CAs within the security domain, then the key archival and recovery process must be set up manually.
For more information, see the Manually Setting up Key Archival section in the Red Hat Certificate System Planning, Installation, and Deployment Guide.
Note
In a cloned environment, it is necessary to set up key archival and recovery manually. For more information, see the Updating CA-KRA Connector Information After Cloning section in the Red Hat Certificate System Planning, Installation, and Deployment Guide.
4.1. Configuring Agent-Approved Key Recovery in the Console
Note
While the number of key recovery agents can be configured in the Console, the group to use can only be set directly in the
CS.cfg file. The Console uses the Key Recovery Authority Agents Group by default.
- Open the KRA's console. For example:
pkiconsole https://server.example.com:8443/kra
- Click the Key Recovery Authority link in the left navigation tree.
- Enter the number of agents to use to approve key recover in the Required Number of Agents field.
Note
For more information on how to configure agent-approved key recovery in the
CS.cfg file, see the Configuring Agent-Approved Key Recovery in the Command Line section in the Red Hat Certificate System Planning, Installation, and Deployment Guide.
