Red Hat Summit Red Hat SummitSupportConsoleDéveloppeursCommencer un essaiContact

Ce contenu n'est pas disponible dans la langue sélectionnée.

Chapter 4. Setting up key archival and recovery

This chapter explains how to setup the Key Recovery Authority (KRA), previously known as Data Recovery Manager (DRM), to archive private keys and to recover archived keys for restoring encrypted data.

For more information on key archival and recovery, see the Archiving, recovering, and rotating keys section in the Red Hat Certificate System Planning, Installation, and Deployment Guide.

Note

This chapter only discusses archiving keys through client-side key generation. Server-side key generation and archivals, whether it’s initiated through TPS, or through CA’s End Entity portal, are not discussed here.

For information on smart card key recovery, see Section 6.10.1, “Setting up Server-side Key Generation”.

For information on server-side key generation provided at the CA’s EE portal, see Section 5.2.2, “Generating CSRs using Server-Side Key Generation”.

Note

Gemalto SafeNet LunaSA only supports PKI private key extraction in its CKE - Key Export model, and only in non-FIPS mode. The LunaSA Cloning model and the CKE model in FIPS mode do not support PKI private key extraction.

When the KRA is installed, it joins a security domain, and is paired up with the CA. At such time, it is configured to archive and recover private encryption keys. However, if the KRA certificates are issued by an external CA rather than one of the CAs within the security domain, then the key archival and recovery process must be set up manually.

For more information, see the Manually setting up key archival section in the Red Hat Certificate System Planning, Installation, and Deployment Guide.

Note

In a cloned environment, it is necessary to set up key archival and recovery manually. For more information, see the Updating CA-KRA connector information after cloning section in the Red Hat Certificate System Planning, Installation, and Deployment Guide.

4.1. Configuring agent-approved key recovery in the Console

NOTE

While the number of key recovery agents can be configured in the Console, the group to use can only be set directly in the CS.cfg file. The Console uses the Key Recovery Authority Agents Group by default.

  1. Open the KRA’s console. For example: 

    pkiconsole https://server.example.com:8443/kra
    Note

    pkiconsole is being deprecated.

  2. Click the Key Recovery Authority link in the left navigation tree.

  3. Enter the number of agents to use to approve key recover in the Required Number of Agents field.

    kra recovery agents
Note

For more information on how to configure agent-approved key recovery in the CS.cfg file, see the Configuring agent-approved key recovery in the command line section in the Red Hat Certificate System Planning, Installation, and Deployment Guide.

4.2. Testing the key archival and recovery setup

Note

Newer browsers do not support key archival from the browser; for Step 1, one should substitute CRMF generation clients for those browsers.

To test whether a key can be successfully archived:

  1. Enroll for dual certificates using the CA’s Manual User Signing & Encryption Certificates Enrollment form.
  2. Submit the request. Log in to the agent services page, and approve the request.
  3. Log into the end-entities page, and check to see if the certificates have been issued. In the list of certificates, there should be two new certificates with consecutive serial numbers.
  4. Import the certificates into the web browser.
  5. Confirm that the key has been archived. In the KRA’s agent services page, select Show completed requests. If the key has been archived successfully, there will be information about that key. If the key is not shown, check the logs, and correct the problem. If the key has been successfully archived, close the browser window.
  6. Verify the key. Send a signed and encrypted email. When the email is received, open it, and check the message to see if it is signed and encrypted. There should be a security icon at the top-right corner of the message window that indicates that the message is signed and encrypted.
  7. Delete the certificate. Check the encrypted email again; the mail client should not be able to decrypt the message.

  8. Test whether an archived key can be recovered successfully:

    1. Open the KRA’s agent services page, and click the Recover Keys link. Search for the key by the key owner, serial number, or public key. If the key has been archived successfully, the key information will be shown.
    2. Click Recover.
    3. In the form that appears, enter the base-64 encoded certificate that corresponds to the private key to recover; use the CA to get this information. If the archived key was searched for by providing the base-64 encoded certificate, then the certificate does not have to be supplied here.

    4. Make sure that the Async Recovery checkbox is selected to allow the browser session to be closed while recovery is ongoing.

      TIP

      An async recovery is the default and recommended way to perform a key recovery. If you want to perform a synchronous key recovery, the browser window cannot be shut and the KRA cannot be stopped during the recovery process.

    5. Depending on the agent scheme, a specified number of agents must authorize this key recovery. Have the agents search for the key to recover and then to approve the initiated recovery.
    6. Once all the agents have authorized the recovery, the next screen requests a password to encrypt the PKCS #12 file with the certificate.

    7. The next screen returns a link to download a PKCS #12 blob containing the recovered key pair. Follow the link, and save the blob to file.

      Important

      Opening the PKCS #12 file directly from the browser in the gcr-viewer utility can fail in certain situations. To work around the problem, download the file and manually open it in gcr-viewer.

  9. Restore the key to the browser’s database. Import the .p12 file into the browser and mail client.
  10. Open the test email. The message should be shown again.
Red Hat logoGithubRedditYoutubeTwitter

Apprendre

Essayez, achetez et vendez

Communautés

À propos de la documentation Red Hat

Nous aidons les utilisateurs de Red Hat à innover et à atteindre leurs objectifs grâce à nos produits et services avec un contenu auquel ils peuvent faire confiance.

Rendre l’open source plus inclusif

Red Hat s'engage à remplacer le langage problématique dans notre code, notre documentation et nos propriétés Web. Pour plus de détails, consultez leBlog Red Hat.

À propos de Red Hat

Nous proposons des solutions renforcées qui facilitent le travail des entreprises sur plusieurs plates-formes et environnements, du centre de données central à la périphérie du réseau.

© 2024 Red Hat, Inc.