7.4. Installing an IdM replica server with keys and certificates stored on an HSM

Prerequisites

• A supported HSM installed and the CA keys and certificates installed on that HSM. See Installing an IdM server with an integrated CA with keys and certificates stored on an HSM.
• An available slot, token, and the token password.

Verification

• Verify that the keys and certificates are stored on the HSM:

  certutil -L -d /etc/pki/pki-tomcat/alias - h <HSM-TOKEN>
  
  Certificate Nickname                                Trust Attributes
  	   SSL,S/MIME,JAR/XPI
  
  Enter Password or Pin for "<HSM-TOKEN>":
  <HSM-TOKEN>:subsystemCert cert-pki-ca                  	u,u,u
  <HSM-TOKEN>:ocspSigningCert cert-pki-ca                	u,u,u
  <HSM-TOKEN>:caSigningCert cert-pki-ca                  	CTu,Cu,Cu
  <HSM-TOKEN>:auditSigningCert cert-pki-ca               	u,u,Pu

  The certificate name is prefixed with the HSM token name, which indicates that the private keys and certificates are stored on the token.

  Where the keys are stored does not affect how users obtain or use certificates.