Chapter 7. Installing and configuring Red Hat Certificate System

Procedure:

1. Create an OS administrator group (e.g. pkiadmin):

   # /usr/sbin/groupadd -r pkiadmin

2. Create OS users:

   1. Create an OS user that belongs to the OS group pkiadmin (e.g. Jane Genie - jgenie). In our example, this person will serve as a PKI Administrator user:

      # /usr/sbin/useradd -g pkiadmin -d /home/jgenie -s /bin/bash -c "Red Hat Certificate System Administrator Jane Genie" -m jgenie

   2. Create an OS user (e.g John Smith - jsmith). In our example, this person will serve as a PKI Agent user:

      # /usr/sbin/useradd -c "Red Hat Certificate System Agent John Smith" -m jsmith

   3. Create an OS user (e.g. Astrid Guru - aguru). In our example, this person will serve as a PKI Auditor user:

      # /usr/sbin/useradd -c "Red Hat Certificate System Auditor Astrid Guru" -m aguru

3. Associate pkiuser with the pkiadmin and nfast groups:

   # /usr/sbin/usermod -a -G pkiadmin pkiuser

   # /usr/sbin/usermod -a -G nfast pkiuser

   NOTE

   If using a Thales Luna HSM, associate pkiuser with the hsmusers group (instead of nfast):

   # /usr/sbin/usermod -a -G hsmusers pkiuser

   Please see Section 4.4, “Supported Hardware Security Modules” for more information on Luna’s limitations.

4. Since the tests in this example use an Entrust HSM, associate the users who are to administer the HSM device with the nfast group:

   # /usr/sbin/usermod -a -G nfast jgenie

   NOTE

   Again, if using a Thales Luna HSM, associate the users who are to administer the HSM device with the hsmusers group (instead of nfast). For example:

   # /usr/sbin/usermod -a -G hsmusers jgenie

   Please see Section 4.4, “Supported Hardware Security Modules” for more information on Luna’s limitations.

1. [DEFAULT] - subsystem-independent settings
2. [Tomcat]
3. [CA], [KRA], [OCSP], [TKS], or [TPS] - the subsystem-specific sections

1. Reads the default values from the /usr/share/pki/server/etc/default.cfg file. For further details, see the pki_default.cfg(5) man page.

   Important

   Do not edit the /usr/share/pki/server/etc/default.cfg file. Instead, you will be instructed to create a configuration file that will override the defaults. For details about using a configuration file, see the example pkispawn configuration files in the following sections that correspond to each different type of subsystem.

2. Reads the administrator-provided configuration file mentioned above to override the default values.
3. Performs the installation of the requested subsystem.
4. Passes the settings to a Java servlet that performs the configuration based on the settings.

1. Set a unique instance name:

   # pki_instance_name=instance_name

2. Set the host name:

   # pki_hostname=server.example.com

   Note

   Certificate System creates unique certificate nicknames based on these parameters and the instance name. The uniqueness of certificate nicknames is very important in keeping the HSM token shared by multiple PKI instances functional.

3. Set the port numbers for the HTTP and HTTPS protocols:

   pki_https_port=port_number
   pki_http_port=port_number

   Important

   To run more than one Certificate System instance on the same host, you must set ports in the pki_https_port and pki_http_port parameters that are not used by any other service on the host. By default, Certificate System uses port 8080 for HTTP and 8443 for HTTPS.

4. Set the HSM-specific parameters:

   pki_hsm_enable=True
   pki_hsm_libfile=HSM_PKCS11_library_path
   pki_hsm_modulename=HSM_module_name
   pki_token_name=HSM_token_name
   pki_token_password=HSM_token_password
   
   pki_audit_signing_token=HSM_token_name
   pki_subsystem_token=HSM_token_name
   pki_sslserver_token=HSM_token_name

   For further details, see Section 6.6.3, “Preparing for installing Certificate System with an HSM”.

5. If building an RSA Certificate System instance, use the following configuration:

   pki_admin_key_algorithm=SHA256withRSA
   pki_admin_key_size=4096
   pki_admin_key_type=rsa
   pki_sslserver_key_algorithm=SHA256withRSA
   pki_sslserver_key_size=4096
   pki_sslserver_key_type=rsa
   pki_subsystem_key_algorithm=SHA256withRSA
   pki_subsystem_key_size=4096
   pki_subsystem_key_type=rsa
   pki_audit_signing_key_algorithm=SHA256withRSA
   pki_audit_signing_key_size=4096
   pki_audit_signing_key_type=rsa
   pki_audit_signing_signing_algorithm=SHA256withRSA

   Allowed choices for the key_algorithm parameters are:

   SHA256withRSA
   SHA384withRSA
   SHA512withRSA

   Note

   You can set these algorithm parameters to a value specified in the ca.profiles.defaultSigningAlgsAllowed parameter in the CA’s CS.cfg file. For details, see the B.2.10 Signing Algorithm Constraint annex in the Administration Guide (Common Criteria Edition). Signature algorithm must match key_type.

6. To use Elliptic Curve Cryptography (ECC) instead of RSA when creating certificates, set:

   pki_admin_key_algorithm=SHA256withEC
   pki_admin_key_size=nistp256
   pki_admin_key_type=ecc
   pki_sslserver_key_algorithm=SHA256withEC
   pki_sslserver_key_size=nistp256
   pki_sslserver_key_type=ecc
   pki_subsystem_key_algorithm=SHA256withEC
   pki_subsystem_key_size=nistp256
   pki_subsystem_key_type=ecc
   pki_audit_signing_key_algorithm=SHA256withEC
   pki_audit_signing_key_size=nistp256
   pki_audit_signing_key_type=ecc
   pki_audit_signing_signing_algorithm=SHA256withEC

   Allowed choices for the key_algorithm parameters are:

   SHA256withEC
   SHA384withEC
   SHA512withEC

   Note

   You can set these algorithm parameters to a value specified in the ca.profiles.defaultSigningAlgsAllowed parameter in the CA’s CS.cfg file. For details, see the For details, see the B.2.10 Signing Algorithm Constraint annex in the Administration Guide (Common Criteria Edition). The signature algorithm must match with key_type.

   For ECC, the allowed choices for key_size are:

   nistp256
   nistp384
   nistp521

   For ECC, the allowed choice for key_type is ecc.

7. Set the client directory of the bootstrap admin user:

   pki_client_dir=bootstrap_admin_directory

   By default, the path is set to ~/.dogtag/instance_name/

   Important

   The pki_admin_* and pki_client_* parameters belong to the bootstrap user that is automatically created by the installation process. For further information about default roles (privileges) and the bootstrap user, see Section 2.6.6, “Users, authorization, and access controls”. For descriptions about the parameters covered in this section, see the pki_default.cfg(5) man page.

8. Set various passwords for the bootstrap admin user:

   pki_admin_password=password
   pki_client_database_password=password
   pki_client_pkcs12_password=password

9. Set the parameters for the LDAPS connection to Directory Server running on the same host:

   pki_ds_database=back-end database name
   pki_ds_hostname=hostname
   pki_ds_secure_connection=True
   pki_ds_secure_connection_ca_pem_file=path_to_CA_or_self-signed_certificate
   pki_ds_password=password

10. If you use a self-signed certificate in Directory Server use the following command to export it from the Directory Server’s Network Security Services (NSS) database:

    # certutil -L -d /etc/dirsrv/slapd-instance_name/ \ -n "server-cert" -a -o /root/ds.crt

11. For the CA that will act as a security domain, set the proper parameters:

    # for a CA that acts as a security domain
    pki_security_domain_hostname=
    pki_security_domain_name=example.com Security Domain
    pki_security_domain_user=caadmin
    pki_security_domain_password=SD password

[Tomcat] section:

1. Set the Tomcat JServ Protocol (AJP) port:

   pki_ajp_port=Tomcat_AJP_port

2. Set the Tomcat server port:

   pki_tomcat_server_port=Tomcat_server_port

Procedure

1. Create a CA installation file at a chosen location (e.g. /root/pki_rsa) on the machine that will host the RHCS instance (rhcs10.example.com).

   # cd /root/pki_rsa

   # vi rootca_inst.cfg

   Note

   Unless explicitly specified, system certificate nicknames are automatically named bearing the value specified for pki_instance_name. To avoid certificate nickname conflicts on a shared HSM, use a unique instance name for each instance creation.
   

   The values specified in the installation file below are examples. In addition to changing the HSM password, edit the values accordingly, for example ports, directories, nicknames, domains…​

   [DEFAULT]
   pki_instance_name=rhcs10-RSA-RootCA
   pki_https_port=8443
   pki_http_port=8080
   
   ### Crypto Token
   pki_hsm_enable=True
   pki_hsm_libfile=/opt/nfast/toolkits/pkcs11/libcknfast.so
   pki_hsm_modulename=nfast
   pki_token_name=NHSM-CONN-XC
   pki_token_password=<YourHSMpassword>
   
   pki_audit_signing_token=NHSM-CONN-XC
   pki_audit_signing_key_algorithm=SHA256withRSA
   pki_audit_signing_key_size=2048
   pki_audit_signing_key_type=rsa
   pki_audit_signing_signing_algorithm=SHA256withRSA
   
   pki_subsystem_token=NHSM-CONN-XC
   pki_subsystem_key_algorithm=SHA256withRSA
   pki_subsystem_signing_algorithm=SHA256withRSA
   pki_subsystem_key_size=2048
   pki_subsystem_key_type=rsa
   
   pki_sslserver_token=NHSM-CONN-XC
   pki_sslserver_key_algorithm=SHA256withRSA
   pki_sslserver_signing_algorithm=SHA256withRSA
   pki_sslserver_key_size=2048
   pki_sslserver_key_type=rsa
   
   ### Bootstrap Admin
   pki_admin_password=SECret.123
   pki_admin_key_type=rsa
   pki_admin_key_size=2048
   pki_admin_key_algorithm=SHA256withRSA
   
   ### Bootstrap Admin client dir
   ### by default, if pki_client_dir, pki_client_database_dir,
   ### and pki_client_admin_cert_p12 are not specified, items will be placed
   ### under some default directories in /root/.dogtag
   pki_client_admin_cert_p12=/opt/pki_rsa/rhcs10-RSA-RootCA/ca_admin_cert.p12
   pki_client_database_dir=/opt/pki_rsa/rhcs10-RSA-RootCA/certs_db
   pki_client_database_password=SECret.123
   pki_client_dir=/opt/pki_rsa/rhcs10-RSA-RootCA
   pki_client_pkcs12_password=SECret.123
   
   ### Internal LDAP
   pki_ds_bind_dn=cn=Directory Manager
   pki_ds_ldap_port=389
   pki_ds_ldaps_port=636
   pki_ds_password=SECret.123
   pki_ds_remove_data=True
   pki_ds_secure_connection=True
   pki_ds_secure_connection_ca_pem_file=/opt/pki_rsa/temp-dirsrv-rootca-cert.pem
   pki_ds_secure_connection_ca_nickname=DS temp CA certificate
   
   ### Security Domain
   pki_security_domain_hostname=rhcs10.example.com
   pki_security_domain_name=Example-rhcs10-RSA-RootCA
   pki_security_domain_password=SECret.123
   
   
   [Tomcat]
   pki_ajp_port=8009
   pki_tomcat_server_port=8005
   
   
   [CA]
   pki_import_admin_cert=False
   pki_admin_nickname=PKI Bootstrap Administrator for RSA-RootCA
   pki_admin_name=caadmin
   pki_admin_uid=caadmin
   pki_admin_email=caadmin@example.com
   
   pki_ca_signing_token=NHSM-CONN-XC
   pki_ca_signing_key_algorithm=SHA256withRSA
   pki_ca_signing_key_size=3072
   pki_ca_signing_key_type=rsa
   pki_ca_signing_nickname=CA Signing Cert - %(pki_instance_name)s
   pki_ca_signing_signing_algorithm=SHA256withRSA
   
   pki_ocsp_signing_token=NHSM-CONN-XC
   pki_ocsp_signing_key_algorithm=SHA256withRSA
   pki_ocsp_signing_key_size=3072
   pki_ocsp_signing_key_type=rsa
   pki_ocsp_signing_signing_algorithm=SHA256withRSA
   
   pki_ds_hostname=rhds11.example.com
   pki_ds_base_dn=dc=RSA-RootCA
   pki_ds_database=CC-RSA-RootCA-LDAP
   pki_share_db=False
   
   ### Enable random serial numbers
   pki_random_serial_numbers_enable=True

2. Run the pkispawn tool to install the RHCS CA instance:

   # pkispawn -s CA -f rootca_inst.cfg --debug

Verification steps

1. Show the status of the installed CA:

   # pki-server status rhcs10-RSA-RootCA

   Note down the Unsecure EE, Secure EE, Agent, Admin and pkiconsole URLs.

2. Verify the sanity of the CA by running the following command. It should display certificates:

   # pki -p 8443 -h rhcs10.example.com ca-cert-find

First step of RootCA installation

1. Create a CA installation file at a chosen location (e.g. /root/pki_rsa) on the machine that will host the RHCS instance (rhcs10.example.com).

   # cd /root/pki_rsa
   
   # vi rootca_inst.cfg

   [DEFAULT]
   pki_instance_name=rhcs10-RSA-RootCA
   pki_https_port=8443
   pki_http_port=8080
   
   ### Crypto Token
   pki_hsm_enable=True
   pki_hsm_libfile=/opt/nfast/toolkits/pkcs11/libcknfast.so
   pki_hsm_modulename=nfast
   pki_token_name=NHSM-CONN-XC
   pki_token_password=<YourHSMpassword>
   
   pki_audit_signing_token=NHSM-CONN-XC
   pki_audit_signing_key_algorithm=SHA256withRSA
   pki_audit_signing_key_size=2048
   pki_audit_signing_key_type=rsa
   pki_audit_signing_signing_algorithm=SHA256withRSA
   
   pki_subsystem_token=NHSM-CONN-XC
   pki_subsystem_key_algorithm=SHA256withRSA
   pki_subsystem_signing_algorithm=SHA256withRSA
   pki_subsystem_key_size=2048
   pki_subsystem_key_type=rsa
   
   pki_sslserver_token=NHSM-CONN-XC
   pki_sslserver_key_algorithm=SHA256withRSA
   pki_sslserver_signing_algorithm=SHA256withRSA
   pki_sslserver_key_size=2048
   pki_sslserver_key_type=rsa
   
   ### Bootstrap Admin
   pki_admin_password=SECret.123
   pki_admin_key_type=rsa
   pki_admin_key_size=2048
   pki_admin_key_algorithm=SHA256withRSA
   
   ### Bootstrap Admin client dir
   ### by default, if pki_client_dir, pki_client_database_dir,
   ### and pki_client_admin_cert_p12 are not specified, items will be placed
   ### under some default directories in /root/.dogtag
   pki_client_dir=/opt/pki_rsa/rhcs10-RSA-RootCA
   pki_client_admin_cert_p12=/opt/pki_rsa/rhcs10-RSA-RootCA/ca_admin_cert.p12
   pki_client_database_dir=/opt/pki_rsa/rhcs10-RSA-RootCA/certs_db
   pki_client_database_password=SECret.123
   pki_client_pkcs12_password=SECret.123
   
   ### Internal LDAP
   pki_ds_bind_dn=cn=Directory Manager
   pki_ds_ldap_port=389
   pki_ds_ldaps_port=636
   pki_ds_password=SECret.123
   pki_ds_remove_data=True
   pki_ds_secure_connection=True
   pki_ds_secure_connection_ca_pem_file=/opt/pki_rsa/temp-dirsrv-rootca-cert.pem
   pki_ds_secure_connection_ca_nickname=DS temp CA certificate
   
   ### Security Domain
   pki_security_domain_hostname=rhcs10.example.com
   pki_security_domain_name=Example-rhcs10-RSA-RootCA
   pki_security_domain_password=SECret.123
   
   
   [Tomcat]
   pki_ajp_port=8009
   pki_tomcat_server_port=8005
   
   
   [CA]
   pki_import_admin_cert=False
   pki_admin_nickname=PKI Bootstrap Administrator for RSA-RootCA
   pki_admin_name=caadmin
   pki_admin_uid=caadmin
   pki_admin_email=caadmin@example.com
   
   pki_ca_signing_token=NHSM-CONN-XC
   pki_ca_signing_key_algorithm=SHA256withRSA
   pki_ca_signing_key_size=3072
   pki_ca_signing_key_type=rsa
   pki_ca_signing_nickname=CA Signing Cert - %(pki_instance_name)s
   pki_ca_signing_signing_algorithm=SHA256withRSA
   
   pki_ocsp_signing_token=NHSM-CONN-XC
   pki_ocsp_signing_key_algorithm=SHA256withRSA
   pki_ocsp_signing_key_size=3072
   pki_ocsp_signing_key_type=rsa
   pki_ocsp_signing_signing_algorithm=SHA256withRSA
   
   pki_ds_hostname=rhds11.example.com
   pki_ds_base_dn=dc=RSA-RootCA
   pki_ds_database=CC-RSA-RootCA-LDAP
   pki_share_db=False
   
   ### Enable random serial numbers
   pki_random_serial_numbers_enable=True

   Note

   Unless explicitly specified, system certificate nicknames are automatically named bearing the value specified for pki_instance_name. To avoid certificate nickname conflicts on a shared HSM, use a unique instance name for each instance creation. However, in a two-step installation, the pki_instance_name value of both files should match. The following values are just examples.

2. Run the pkispawn tool to install the RHCS CA instance:

   # pkispawn -s CA -f rootca_inst.cfg --skip-configuration --debug

Verification steps

1. Show the status of the installed CA:

   # pki-server status rhcs10-RSA-RootCA

   Note down the Unsecure EE, Secure EE, Agent, Admin and pkiconsole URLs.

2. Verify the sanity of the CA by running the following command. It should display certificates:

   # pki -p 8443 -h rhcs10.example.com ca-cert-find

Procedure

1. Generate a list of non-CMC profiles to be edited:

   # ls /var/lib/pki/rhcs10-RSA-RootCA/ca/profiles/ca | grep -v CMC | grep -v Install | grep -v caInternal | grep -v caECInternal | grep -v caAdminCert | grep -v caECAdminCert | tee /root/pki_rsa/ca-profile-deletelist.txt

2. Stop the RootCA instance:

   pki-server stop rhcs10-RSA-RootCA

3. For every profile in the list, change the visible and enable parameters from true to false. For example, use the following command to set visible=false and enable=false:

   # cat /root/pki_rsa/ca-profile-deletelist.txt | while read line; do sed -i 's/^visible=true/visible=false/g' /var/lib/pki/rhcs10-RSA-RootCA/ca/profiles/ca/$line; sed -i 's/^enable=true/enable=false/g' /var/lib/pki/rhcs10-RSA-RootCA/ca/profiles/ca/$line; done

4. In addition, also change the visible parameter for the caCMCUserCert profile to false:

   # sed -i 's/^visible=true/visible=false/' /var/lib/pki/rhcs10-RSA-RootCA/ca/profiles/ca/caCMCUserCert.cfg

5. Start the RootCA instance:

   pki-server start rhcs10-RSA-RootCA

1. Create a CA chain file for later use:

   # certutil -L -d /var/lib/pki/rhcs10-RSA-RootCA/alias -n "CA Signing Cert - rhcs10-RSA-RootCA" -a > /opt/pki_rsa/rootCA.pem

   # cp /opt/pki_rsa/rootCA.pem /opt/pki_rsa/ca-chain.pem

2. Copy the files to rhds11.example.com (the machine that hosts the DS instances):

   # scp /opt/pki_rsa/rootCA.pem root@rhds11.example.com:/opt/pki_rsa

   # scp /opt/pki_rsa/ca-chain.pem root@rhds11.example.com:/opt/pki_rsa

3. On rhds11.example.com, edit the /etc/openldap/ldap.conf file so that TLS_CACERT points to the CA chain file we just created:

   # echo "TLS_CACERT /opt/pki_rsa/ca-chain.pem" >> /etc/openldap/ldap.conf

4. Restart the DS instance for the RootCA:

   # dsctl slapd-CC-RSA-RootCA-LDAP restart

Procedure

1. Create a client nssdb:

   # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db -c SECret.123 client-init

   NOTE

   The directory specified at -d should not already exist. If it does exist, another RHCS instance might be using it. In that case, it’s advised to move it out of the way or specify a different path. You can check if there are any certificates with:

   # certutil -L -d /root/.dogtag/pki_rsa_bootstrap/certs_db

   and if none exist, you can select Yes to overwrite.

2. Import the CA signing certificate into the nssdb:

   # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db -c SECret.123 client-cert-import "CA Signing Cert - rhcs10-RSA-RootCA" --ca-cert /opt/pki_rsa/rootCA.pem

3. Import the RootCA bootstrap admin certificate/key into the nssdb:

   # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db -c SECret.123 client-cert-import --pkcs12 /opt/pki_rsa/rhcs10-RSA-RootCA/ca_admin_cert.p12 --pkcs12-password SECret.123
   
   ----------------------------------------
   Imported certificates from PKCS #12 file
   ----------------------------------------

Verification:

1. List the certificates:

   # certutil -d /root/.dogtag/pki_rsa_bootstrap/certs_db -L
   
   Certificate Nickname                            Trust Attributes
                                                   SSL,S/MIME,JAR/XPI
   
   PKI Bootstrap Administrator for RSA-RootCA      u,u,u
   CA Signing Cert - rhcs10-RSA-RootCA             CT,C,C

2. As the bootstrap admin user, list the users in the RootCA:

   # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 8443 -n "PKI Bootstrap Administrator for RSA-RootCA" ca-user-find

   -----------------
   3 entries matched
   -----------------
     User ID:  CA-rhcs10.example.com-8443
     Full name:  CA-rhcs10.example.com-8443
   
     User ID: caadmin
     Full name: caadmin
   
     User ID: pkidbuser
     Full name: pkidbuser
   ----------------------------
   Number of entries returned 3

1. Stop DS:

   # dsctl slapd-CC-RSA-OCSP-rootca-LDAP stop

   Note

   If you are not certain about the name of a DS instance, list all instances using: dsctl -l.

2. Use the certutil tool to generate the CSR:

   # certutil -R -d /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP -s "CN=rhds11.example.com" -g 2048 -f /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/pwdfile.txt -a -o /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/Server-Cert-ocsp-rootca.csr -z /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/noise.txt

   Important

   Edit the Server-Cert-ocsp-rootca.csr output file obtained above to remove the few lines before "Begin Certificate Request". For example:
   

   # vi /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/Server-Cert-ocsp-rootca.csr

   The CSR file must start with the line "-----BEGIN CERTIFICATE REQUEST-----" and end with the line "-----END CERTIFICATE REQUEST-----".

3. Remote copy the Server-Cert-ocsp-rootca.csr file to the system where the CA resides. For example:

   # scp /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/Server-Cert-ocsp-rootca.csr root@rhcs10.example.com:/root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-ocsp-rootca.csr

1. Generate a CMC request:

   1. Create a CMCRequest configuration file. For example:

      # vim /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-rootca_pkcs10.cfg

      ### numRequests: Total number of PKCS10 requests or CRMF requests.
      numRequests=1
      
      ### input: full path for the PKCS10 request or CRMF request,
      ### The content must be in Base-64 encoded format.
      ### Multiple files are supported. They must be separated by a space.
      ### For input on a different host, specify where to find the CSR.
      input=/root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-ocsp-rootca.csr
      
      ### output: full path for the CMC request in binary format
      ### For output on a different host, specify the destination.
      output=/root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-rootca_pkcs10.req
      
      ### tokenname: name of the token where the agent signing cert can be found (default is internal)
      tokenname=internal
      
      ### nickname: nickname for the agent certificate that will be used to sign the CMC full request.
      nickname=PKI Bootstrap Administrator for RSA-RootCA
      
      ### dbdir: directory for cert8.db, key3.db and secmod.db
      dbdir=/root/.dogtag/pki_rsa_bootstrap/certs_db
      
      ### password: password for cert8.db that stores the agent certificate
      password=SECret.123
      
      ### format: request format, either pkcs10 or crmf
      format=pkcs10

   2. Generate the request using the CMCRequest command:

      # CMCRequest /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-rootca_pkcs10.cfg
      
      cert/key prefix =
      path = /root/.dogtag/pki_rsa_bootstrap/certs_db
      CryptoManger initialized
      token internal logged in...
      got signerCert: PKI Bootstrap Administrator for RSA-RootCA
      createPKIData: begins
      k=0
      createPKIData:  format: pkcs10
      useSharedSecret is false...
      signData: begins:
      getPrivateKey: got signing cert
      signData:  got signer privKey
      createSignedData: begins
      getSigningAlgFromPrivate: begins.
      getSigningAlgFromPrivate: found signingKeyType=RSA
      getSigningAlgFromPrivate: using SignatureAlgorithm: RSASignatureWithSHA256Digest
      createSignedData: digest created for pkidata
      createSignedData: digest algorithm =RSASignatureWithSHA256Digest
      createSignedData: building cert chain
      signData: signed request generated.
      getCMCBlob: begins
      getCMCBlob: generating signed data
      
      The CMC enrollment request in base-64 encoded format:
      
      . . . Output omitted . . .
      
      The CMC enrollment request in binary format is stored in
      /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-rootca_pkcs10.req

2. Submit the CMC request:

   1. Create a HttpClient configuration file. For example:

      # vim /root/.dogtag/pki_rsa_bootstrap/certs_db/HttpClient_dirsrv-ocsp-rootca.cfg

      ### host: host name for the http server
      host=rhcs10.example.com
      
      ### port: port number
      port=8443
      
      ### secure: true for secure connection, false for nonsecure connection
      secure=true
      
      ### input: full path for the enrollment request, the content must be in binary format
      input=/root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-rootca_pkcs10.req
      
      ### output: full path for the response in binary format
      output=/root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-rootca_pkcs10.resp
      
      ### tokenname: name of the token where the SSL client authentication cert can be found (default is internal)
      ### This parameter will be ignored if secure=false
      tokenname=internal
      
      ### dbdir: directory for cert8.db, key3.db and secmod.db
      ### This parameter will be ignored if secure=false
      dbdir=/root/.dogtag/pki_rsa_bootstrap/certs_db
      
      ### clientmode: true for client authentication, false for no client authentication
      ### This parameter will be ignored if secure=false
      clientmode=true
      
      ### password: password for cert8.db
      ### This parameter will be ignored if secure=false and clientauth=false
      password=SECret.123
      
      ### nickname: nickname for client certificate
      ### This parameter will be ignored if clientmode=false
      nickname=PKI Bootstrap Administrator for RSA-RootCA
      
      ### servlet: servlet name
      servlet=/ca/ee/ca/profileSubmitCMCFull?profileId=caCMCserverCert

   2. Submit the request using the HttpClient command:

      # HttpClient /root/.dogtag/pki_rsa_bootstrap/certs_db/HttpClient_dirsrv-ocsp-rootca.cfg
      
      Total number of bytes read = 3096
      after SSLSocket created, thread token is NSS FIPS 140-2 User Private Key
      client cert is not null
      handshake happened
      writing to socket
      
      ##Response Headers begin##
      HTTP/1.1 200
      Content-Type: application/pkcs7-mime
      Content-Length: 2492
      Date: Tue, 29 Sep 2020 15:20:21 GMT
      Connection: close
      ##end##
      
      . . . Output omitted . . .
      
      The response in binary format is stored in
      /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-rootca_pkcs10.resp

3. Process the CMC Response:

   1. Process the response using CMCResponse to display all certificates in chain individually in PEM format:

      Important

      Running CMCResponse with the "-v" option returns the PEM of each certificate in the chain as Cert:0, Cert:1 etc. Below all the PEMs, the output also displays each certificate in the chain in pretty print format. Since the certificates are not displayed in a fixed order, in order to determine their position in the chain, you must examine the "Subject:" under each "Certificate". The corresponding PEM is displayed in the same position above.

      # CMCResponse -d /root/.dogtag/pki_rsa_bootstrap/certs_db -i /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-rootca_pkcs10.resp -v
      
      Cert:0
      ...
      ===
      Cert:1
      ...
      ===
      Cert:2
      ...
      ===
      Certificates:
      
        Certificate:
            Data:
                Version:  v3
                Serial Number: 0xA383694
                Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
                Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-OCSP-rootca,O=Example-rhcs10-RSA-OCSP-rootca
                Validity:
                    Not Before: Tuesday, April 5, 2022 8:41:36 AM EDT America/New_York
                    Not  After: Monday, March 25, 2024 8:41:36 AM EDT America/New_York
                Subject: CN=rhds11.example.com
      
      . . . Output omitted . . .
      
          Certificate:
              Data:
                  Version:  v3
                  Serial Number: 0x5C8FAD4
                  Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
                  Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
                  Validity:
                      Not Before: Tuesday, April 5, 2022 8:36:21 AM EDT America/New_York
                      Not  After: Saturday, April 5, 2042 8:36:21 AM EDT America/New_York
                  Subject: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
      
      . . . Output omitted . . .
      
          Certificate:
              Data:
                  Version:  v3
                  Serial Number: 0x80296C3
                  Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
                  Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-OCSP-rootca
                  Validity:
                      Not Before: Tuesday, April 5, 2022 8:39:43 AM EDT America/New_York
                      Not  After: Friday, April 5, 2041 8:39:43 AM EDT America/New_York
                  Subject: CN=CA Signing Certificate,OU=rhcs10-RSA-OCSP-rootca,O=Example-rhcs10-RSA-RootCA
      
      . . . Output omitted . . .
      
      Number of controls is 1
      Control #0: CMCStatusInfoV2
      OID: {1 3 6 1 5 5 7 7 25}
      BodyList: 1
      Status: SUCCESS
      CMC Full Response.

   2. Save the new Server-Cert DS certificate into a file in the bootstrap certificate directory (e.g. /root/.dogtag/pki_rsa_bootstrap/certs_db/) named accordingly. The .pem file must start with the header -----BEGIN CERTIFICATE----- and end with the footer -----END CERTIFICATE-----. For example:

      # vi /root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-ocsp-rootca.pem

      Where Server-Cert-ocsp-rootca.pem is the new Server-Cert certificate of the Directory Server instance that serves as the internaldb of the OCSP for the RootCA.

      Note

      The RootCA’s signing certificate should match with the output from the following command:

      # certutil -L -d /var/lib/pki/rhcs10-RSA-RootCA/alias/ -n "CA Signing Cert - rhcs10-RSA-RootCA" -a

4. Remote copy the new Server-Cert certificate to rhds11.example.com. For example:

   # scp /root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-ocsp-rootca.pem root@rhds11.example.com:/etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/

1. Save the contents of the dirsrv directory into a backup directory:

   # cp -r /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/ /etc/dirsrv/save-rsa/slapd-CC-RSA-OCSP-rootca-LDAP/

2. Delete the old DS certificates:

   # certutil -D -d /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/pwdfile.txt -n "Server-Cert"

   # certutil -D -d /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/pwdfile.txt -n "Self-Signed-CA"

3. Import the newly created DS certificate and its CA certificate in chain one by one. For example:

   # certutil -d /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/pwdfile.txt -A -t "CT,C,C" -n "CA Signing Cert - rhcs10-RSA-RootCA" -i /opt/pki_rsa/rootCA.pem

   # certutil -d /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/pwdfile.txt -A -t "u,u,u" -n "Server-Cert" -i /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/Server-Cert-ocsp-rootca.pem

4. List the certificates:

   # certutil -L -d /etc/dirsrv/slapd-CC-RSA-OCSP-rootca-LDAP/
   
   Certificate Nickname                           Trust Attributes
                                                  SSL,S/MIME,JAR/XPI
   CA Signing Cert - rhcs10-RSA-RootCA            CT,C,C
   Server-Cert                                    u,u,u

5. Start DS:

   # dsctl slapd-CC-RSA-OCSP-rootca-LDAP start

6. Test to confirm that the LDAP server is up and running (in case of a separate system, test on the CA host as well):

   # ldapsearch -x -D "cn=Directory Manager" -H ldaps://rhds11.example.com:6636 -b "dc=example,dc=com" -w SECret.123

   If testing on a separate system, include the CA certificate chain in front of the ldapsearch command, for example:

   # LDAPTLS_CACERT=/opt/pki_rsa/ca-chain.pem ldapsearch -x -D "cn=Directory Manager" -H ldaps://rhds11.example.com:6636 -b "dc=example,dc=com" -w SECret.123

Procedure

1. Create an OCSP installation file at a chosen location (e.g. /root/pki_rsa) for generating certificate requests:

   # cd /root/pki_rsa

   # vi ocsp_rootca_inst.cfg

   Note

   Unless explicitly specified, system certificate nicknames are automatically named bearing the value specified for pki_instance_name. To avoid certificate nickname conflicts on a shared HSM, use a unique instance name for each instance creation.
   

   The values specified in the installation file below are examples. In addition to changing the HSM password, edit the values accordingly, for example ports, directories, nicknames, domains…​

   [DEFAULT]
   pki_instance_name=rhcs10-RSA-OCSP-rootca
   pki_https_port=33443
   pki_http_port=33080
   
   ### Crypto Token
   pki_hsm_enable=True
   pki_hsm_libfile=/opt/nfast/toolkits/pkcs11/libcknfast.so
   pki_hsm_modulename=nfast
   pki_token_name=NHSM-CONN-XC
   pki_token_password=<YourHSMpassword>
   
   pki_audit_signing_token=NHSM-CONN-XC
   pki_audit_signing_key_algorithm=SHA256withRSA
   pki_audit_signing_key_size=2048
   pki_audit_signing_key_type=rsa
   pki_audit_signing_signing_algorithm=SHA256withRSA
   
   pki_subsystem_token=NHSM-CONN-XC
   pki_subsystem_key_algorithm=SHA256withRSA
   pki_subsystem_signing_algorithm=SHA256withRSA
   pki_subsystem_key_size=2048
   pki_subsystem_key_type=rsa
   
   pki_sslserver_token=NHSM-CONN-XC
   pki_sslserver_key_algorithm=SHA256withRSA
   pki_sslserver_signing_algorithm=SHA256withRSA
   pki_sslserver_key_size=2048
   pki_sslserver_key_type=rsa
   
   ### CA cert chain concatenated in PEM format
   pki_cert_chain_path=/opt/pki_rsa/ca-chain.pem
   
   ### Bootstrap Admin
   pki_admin_password=SECret.123
   pki_admin_key_type=rsa
   pki_admin_key_size=2048
   pki_admin_key_algorithm=SHA256withRSA
   
   ### Bootstrap Admin client dir
   pki_client_admin_cert_p12=/opt/pki_rsa/rhcs10-RSA-OCSP-rootca/ocsp_admin_cert.p12
   pki_client_database_dir=/opt/pki_rsa/rhcs10-RSA-OCSP-rootca/certs_db
   pki_client_database_password=SECret.123
   pki_client_database_purge=False
   pki_client_dir=/opt/pki_rsa/rhcs10-RSA-OCSP-rootca
   pki_client_pkcs12_password=SECret.123
   
   ### Internal LDAP
   pki_ds_bind_dn=cn=Directory Manager
   pki_ds_ldap_port=6389
   pki_ds_ldaps_port=6636
   pki_ds_password=SECret.123
   pki_ds_remove_data=True
   pki_ds_secure_connection=True
   pki_ds_secure_connection_ca_pem_file=/opt/pki_rsa/ca-chain.pem
   pki_ds_secure_connection_ca_nickname=CA Signing Cert - rhcs10-RSA-RootCA
   
   ### Security Domain
   pki_security_domain_hostname=rhcs10.example.com
   pki_security_domain_https_port=8443
   pki_security_domain_password=SECret.123
   pki_security_domain_user=caadmin
   
   
   [Tomcat]
   pki_ajp_port=33009
   pki_tomcat_server_port=33005
   
   [OCSP]
   pki_import_admin_cert=False
   
   pki_ocsp_signing_token=NHSM-CONN-XC
   pki_ocsp_signing_key_algorithm=SHA256withRSA
   pki_ocsp_signing_key_size=3072
   pki_ocsp_signing_key_type=rsa
   pki_ocsp_signing_signing_algorithm=SHA256withRSA
   
   pki_admin_nickname=PKI Bootstrap Administrator for RSA-OCSP-rootca
   pki_admin_name=ocspadmin
   pki_admin_uid=ocspadmin
   pki_admin_email=ocspadmin@example.com
   
   pki_ds_hostname=rhds11.example.com
   pki_ds_base_dn=dc=RSA-OCSP-rootca
   pki_ds_database=CC-RSA-OCSP-rootca-LDAP
   pki_share_db=False

2. Run the pkispawn tool to install the OCSP subsystem:

   # pkispawn -s OCSP -f ocsp_rootca_inst.cfg --debug

   This will create the OCSP instance in /var/lib/pki/rhcs10-RSA-OCSP-rootca.

1. Log in to rhcs10.example.com as root.

2. Stop the RootCA’s OCSP service:

   pki-server stop rhcs10-RSA-OCSP-rootca

3. Edit /var/lib/pki/rhcs10-RSA-OCSP-rootca/conf/server.xml to increase the timeout period:

   <Connector name="Secure" port="33443" …
   connectionTimeout="3000000"

4. Start the RootCA’s OCSP service:

   # pki-server start rhcs10-RSA-OCSP-rootca

1. Stop the RootCA:

   # pki-server stop rhcs10-RSA-RootCA

2. Edit the RootCA’s CS.cfg and set the ca.defaultOcspUri variable to point to the OCSP. For example:

   ca.defaultOcspUri=http://rhcs10.example.com:33080/ocsp/ee/ocsp

3. Start the RootCA:

   # pki-server start rhcs10-RSA-RootCA

1. Configure OCSP with authType=sslclientauth and import the role user certificate by following Section 7.13.6, “Configure pkiconsole login with client authentication”.

2. Login to pkiconsole with the client authentication certificate of the role user:

   # pkiconsole -d <home .redhat-idm-console dir> -n <client cert> https://rhcs10.example.com:33443/ocsp

   And select the role user certificate nickname from the list, for example OCSP adminV. Login to the console should be successful.

1. Verify the existence of the nssdb password file on this instance:

   # ls /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/pwdfile.txt

2. Stop DS:

   # dsctl slapd-CC-RSA-RootCA-LDAP stop

3. Use the certutil tool to generate the CSR:

   # certutil -R -d /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP -s "CN=rhds11.example.com" -g 2048 -f /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/pwdfile.txt -a -o /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/Server-Cert-rootca.csr -z /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/noise.txt

   Important

   Edit the Server-Cert-rootca.csr output file obtained above to remove the few lines before "Begin Certificate Request". For example:
   

   # vi /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/Server-Cert-rootca.csr

   The CSR file must start with the line "-----BEGIN CERTIFICATE REQUEST-----" and end with the line "-----END CERTIFICATE REQUEST-----".

   1. Start DS:

      # dsctl slapd-CC-RSA-RootCA-LDAP start

   2. Remote copy the Server-Cert-rootca.csr file to the system where the CA resides. For example:

      # scp /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/Server-Cert-rootca.csr root@rhcs10.example.com:/root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-rootca.csr

1. Generate a CMC request:

   1. Create a CMCRequest configuration file. For example:

      # vim /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-rootca_pkcs10.cfg

      ### numRequests: Total number of PKCS10 requests or CRMF requests.
      numRequests=1
      
      ### input: full path for the PKCS10 request or CRMF request,
      ### The content must be in Base-64 encoded format.
      ### Multiple files are supported. They must be separated by a space.
      ### For input on a different host, specify where to find the CSR.
      input=/root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-rootca.csr
      
      ### output: full path for the CMC request in binary format
      ### For output on a different host, specify the destination.
      output=/root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-rootca_pkcs10.req
      
      ### tokenname: name of the token where the agent signing cert can be found (default is internal)
      tokenname=internal
      
      ### nickname: nickname for the agent certificate that will be used to sign the CMC full request.
      nickname=PKI Bootstrap Administrator for RSA-RootCA
      
      ### dbdir: directory for cert8.db, key3.db and secmod.db
      dbdir=/root/.dogtag/pki_rsa_bootstrap/certs_db
      
      ### password: password for cert8.db that stores the agent certificate
      password=SECret.123
      
      ### format: request format, either pkcs10 or crmf
      format=pkcs10

   2. Generate the request using the CMCRequest command:

      # CMCRequest /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-rootca_pkcs10.cfg
      
      cert/key prefix =
      path = /root/.dogtag/pki_rsa_bootstrap/certs_db
      CryptoManger initialized
      token internal logged in...
      got signerCert: PKI Bootstrap Administrator for RSA-RootCA
      createPKIData: begins
      k=0
      createPKIData:  format: pkcs10
      useSharedSecret is false...
      signData: begins:
      getPrivateKey: got signing cert
      signData:  got signer privKey
      createSignedData: begins
      getSigningAlgFromPrivate: begins.
      getSigningAlgFromPrivate: found signingKeyType=RSA
      getSigningAlgFromPrivate: using SignatureAlgorithm: RSASignatureWithSHA256Digest
      createSignedData: digest created for pkidata
      createSignedData: digest algorithm =RSASignatureWithSHA256Digest
      createSignedData: building cert chain
      signData: signed request generated.
      getCMCBlob: begins
      getCMCBlob: generating signed data
      
      The CMC enrollment request in base-64 encoded format:
      
      . . . Output omitted . . .
      
      The CMC enrollment request in binary format is stored in
      /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-rootca_pkcs10.req

2. Submit the CMC request:

   1. Create a HttpClient configuration file. For example:

      # vim /root/.dogtag/pki_rsa_bootstrap/certs_db/HttpClient_dirsrv-rootca.cfg

      ### host: host name for the http server
      host=rhcs10.example.com
      
      ### port: port number
      port=8443
      
      ### secure: true for secure connection, false for nonsecure connection
      secure=true
      
      ### input: full path for the enrollment request, the content must be in binary format
      input=/root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-rootca_pkcs10.req
      
      ### output: full path for the response in binary format
      output=/root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-rootca_pkcs10.resp
      
      ### tokenname: name of the token where the SSL client authentication cert can be found (default is internal)
      ### This parameter will be ignored if secure=false
      tokenname=internal
      
      ### dbdir: directory for cert8.db, key3.db and secmod.db
      ### This parameter will be ignored if secure=false
      dbdir=/root/.dogtag/pki_rsa_bootstrap/certs_db
      
      ### clientmode: true for client authentication, false for no client authentication
      ### This parameter will be ignored if secure=false
      clientmode=true
      
      ### password: password for cert8.db
      ### This parameter will be ignored if secure=false and clientauth=false
      password=SECret.123
      
      ### nickname: nickname for client certificate
      ### This parameter will be ignored if clientmode=false
      nickname=PKI Bootstrap Administrator for RSA-RootCA
      
      ### servlet: servlet name
      servlet=/ca/ee/ca/profileSubmitCMCFull?profileId=caCMCserverCertWithCRLDP

      Note

      For EC certificates, use the ECC profiles by setting:

      servlet=/ca/ee/ca/profileSubmitCMCFull?profileId=caCMCECserverCertWithCRLDP

   2. Submit the request using the HttpClient command:

      # HttpClient /root/.dogtag/pki_rsa_bootstrap/certs_db/HttpClient_dirsrv-rootca.cfg
      
      Total number of bytes read = 3096
      after SSLSocket created, thread token is NSS FIPS 140-2 User Private Key
      client cert is not null
      handshake happened
      writing to socket
      
      ##Response Headers begin##
      HTTP/1.1 200
      Content-Type: application/pkcs7-mime
      Content-Length: 2492
      Date: Tue, 29 Sep 2020 15:20:21 GMT
      Connection: close
      ##end##
      
      . . . Output omitted . . .
      
      The response in binary format is stored in
      /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-rootca_pkcs10.resp

3. Process the CMC Response :

   1. Process the response using CMCResponse to display all certificates in chain individually in PEM format:

      Important

      Running CMCResponse with the "-v" option returns the PEM of each certificate in the chain as Cert:0, Cert:1 etc. Below all the PEMs, the output also displays each certificate in the chain in pretty print format. Since the certificates are not displayed in a fixed order, in order to determine their position in the chain, you must examine the "Subject:" under each "Certificate". The corresponding PEM is displayed in the same position above.

      # CMCResponse -d /root/.dogtag/pki_rsa_bootstrap/certs_db -i /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-rootca_pkcs10.resp -v
      
      Cert:0
      ...
      ===
      Cert:1
      ...
      ===
      Cert:2
      ...
      ===
      Certificates:
          Certificate:
              Data:
                  Version:  v3
                  Serial Number: 0xA383694
                  Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
                  Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
                  Validity:
                      Not Before: Tuesday, April 5, 2022 8:41:36 AM EDT America/New_York
                      Not  After: Monday, March 25, 2024 8:41:36 AM EDT America/New_York
                  Subject: CN=rhds11.example.com
      
      . . . Output omitted . . .
      
          Certificate:
              Data:
                  Version:  v3
                  Serial Number: 0x5C8FAD4
                  Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
                  Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
                  Validity:
                      Not Before: Tuesday, April 5, 2022 8:36:21 AM EDT America/New_York
                      Not  After: Saturday, April 5, 2042 8:36:21 AM EDT America/New_York
                  Subject: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
      
      . . . Output omitted . . .
      
          Certificate:
              Data:
                  Version:  v3
                  Serial Number: 0x80296C3
                  Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
                  Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
                  Validity:
                      Not Before: Tuesday, April 5, 2022 8:39:43 AM EDT America/New_York
                      Not  After: Friday, April 5, 2041 8:39:43 AM EDT America/New_York
                  Subject: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
      
      . . . Output omitted . . .
      
      Number of controls is 1
      Control #0: CMCStatusInfoV2
      OID: {1 3 6 1 5 5 7 7 25}
      BodyList: 1
      Status: SUCCESS
      CMC Full Response.

   2. Save the new Server-Cert DS certificate into a file in the bootstrap certificate directory (e.g. /root/.dogtag/pki_rsa_bootstrap/certs_db/) named accordingly. The .pem file must start with the header -----BEGIN CERTIFICATE----- and end with the footer -----END CERTIFICATE-----. For example:

      # vi /root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-rootca.pem

      Where Server-Cert-rootca.pem is the new Server-Cert certificate of the Directory Server instance that serves as the internaldb of the RootCA.

      Note

      The RootCA’s signing certificate should match with the output from the following command:

      # certutil -L -d /var/lib/pki/rhcs10-RSA-RootCA/alias/ -n "CA Signing Cert - rhcs10-RSA-RootCA" -a

4. Remote copy the new Server-Cert certificate to rhds11.example.com. For example:

   # scp /root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-rootca.pem root@rhds11.example.com:/etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/

1. Stop DS:

   # dsctl slapd-CC-RSA-RootCA-LDAP stop

2. Save the contents of the dirsrv directory into a backup directory:

   # cp -r /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/ /etc/dirsrv/save-rsa/slapd-CC-RSA-RootCA-LDAP/

3. Delete the old DS certificates:

   # certutil -D -d /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/pwdfile.txt -n "Server-Cert"

   # certutil -D -d /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/pwdfile.txt -n "Self-Signed-CA"

4. Import the newly created DS certificate and its CA certificate in chain one by one. For example:

   # certutil -d /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/pwdfile.txt -A -t "CT,C,C" -n "CA Signing Cert - rhcs10-RSA-RootCA" -i /opt/pki_rsa/rootCA.pem

   # certutil -d /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/pwdfile.txt -A -t "u,u,u" -n "Server-Cert" -i /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/Server-Cert-rootca.pem

5. List the certificates:

   # certutil -L -d /etc/dirsrv/slapd-CC-RSA-RootCA-LDAP/
   
   Certificate Nickname                        Trust Attributes
                                               SSL,S/MIME,JAR/XPI
   CA Signing Cert - rhcs10-RSA-RootCA         CT,C,C
   Server-Cert                                 u,u,u

6. On rhds11.example.com, start DS:

   # dsctl slapd-CC-RSA-RootCA-LDAP start

7. Test to confirm that the LDAP server is up and running (in case of a separate system, test on the CA host as well):

   # ldapsearch -x -D "cn=Directory Manager" -H ldaps://rhds11.example.com:636 -b "dc=example,dc=com" -w SECret.123

   If testing on a separate system, include the CA certificate chain in front of the ldapsearch command, for example:

   # LDAPTLS_CACERT=/opt/pki_rsa/ca-chain.pem ldapsearch -x -D "cn=Directory Manager" -H ldaps://rhds11.example.com:636 -b "dc=example,dc=com" -w SECret.123

1. Stop the CA:

   # pki-server stop rhcs10-RSA-RootCA

2. List the certificate:

   # certutil -L -d /var/lib/pki/rhcs10-RSA-RootCA/alias/
   
   Certificate Nickname                Trust Attributes
                                       SSL,S/MIME,JAR/XPI
   DS temp CA certificate              CT,C,C
   ...

3. Remove the temporary certificate from the nssdb:

   # certutil -D -d /var/lib/pki/rhcs10-RSA-RootCA/alias/ -n "DS temp CA certificate"

1. To enable certificate revocation checks, in the respective /var/lib/pki/rhcs10-RSA-RootCA/conf/server.xml file:

   1. Set enableOCSP or enableRevocationCheck to true:

      enableOCSP=true
      or
      enableRevocationCheck=true

   2. Additionally, remove these two parameters and their assigned values:

      ocspResponderURL
      ocspResponderCertNickname

2. Disable the legacy revocation check method by editing the CA’s CS.cfg file and setting the following to false:

   auths.revocationChecking.enabled=false

3. Start the RootCA instance:

   # pki-server start rhcs10-RSA-RootCA

1. Check the publishing of the file-based CRL:

   # ls -l /var/lib/pki/rhcs10-RSA-RootCA/crl
   total 8
   -rw-r--r--. 1 pkiuser pkiuser 574 Jun 20 18:08 ServerCertCRL-20240620-180859.der
   -rw-r--r--. 1 pkiuser pkiuser 613 Jun 20 18:09 ServerCertCRL-20240620-180938.der
   lrwxrwxrwx. 1 pkiuser pkiuser  68 Jun 20 18:09 ServerCertCRL.crl -> /var/lib/pki/rhcs10-RSA-RootCA/crl/ServerCertCRL-20240620-180938.der

2. Display and verify the content of the CRL

   # BtoA /var/lib/pki/rhcs10-RSA-RootCA/crl/ServerCertCRL.crl /var/lib/pki/rhcs10-RSA-RootCA/crl/ServerCertCRL.bin
   # PrettyPrintCrl /var/lib/pki/rhcs10-RSA-RootCA/crl/ServerCertCRL.bin
   Certificate Revocation List:
           Data:
               Version:  v2
               Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
               Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
               This Update: Thursday, June 20, 2024 6:09:38 PM EDT America/New_York
               Next Update: Thursday, June 20, 2024 9:00:00 PM EDT America/New_York
               Revoked Certificates:
                   Serial Number: 0xF6FDEF3
                   Revocation Date: Thursday, June 20, 2024 6:09:38 PM EDT America/New_York
                   Extensions:
                       Identifier: Revocation Reason - 2.5.29.21
                           Critical: no
                           Reason: Certificate_Hold
           Extensions:
               Identifier: CRL Number - 2.5.29.20
                   Critical: no
                   Number: 21
           Signature:
               Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
               Signature:
                   69:38:47:5D:E4:50:17:C5:6C:60:3F:1B:D8:B4:62:4D:
                   8B:11:FC:31:E4:26:6B:07:B6:BB:2C:7E:48:10:F4:DD:
                   0A:67:17:CB:DF:4E:1A:50:BE:4F:8F:61:B4:91:AE:DA:
                   E5:58:D5:FE:54:D9:94:B3:38:E1:B6:2C:19:C4:93:54:
                   D5:5E:8B:61:4F:89:52:5A:F7:F5:1B:2F:59:19:AD:23:
                   1F:6F:3C:93:17:F3:1A:1C:0B:9A:D2:8F:01:76:08:6E:
                   DA:DD:6F:2D:75:54:D3:D4:40:9A:2B:5D:8B:D5:BB:8B:
                   AF:89:E4:13:A7:F1:8A:AF:0A:72:26:E3:3D:FE:B3:90:
                   2B:F7:88:57:E9:8B:E7:82:B6:D3:F3:80:CD:F7:87:77:
                   69:AF:39:90:5E:46:9C:C2:C4:FA:44:01:77:6D:8F:2D:
                   5A:BD:B9:39:3F:E4:99:E7:F9:FD:2D:CD:FA:87:C1:42:
                   A4:D0:3B:87:0B:28:30:2D:2A:68:F2:68:7C:00:A8:4B:
                   AC:38:49:5A:03:D1:B2:CE:45:D8:C1:6A:3F:42:F0:04:
                   F6:CC:43:83:E8:19:41:6F:0A:64:95:C3:57:8F:54:53:
                   31:40:58:D4:CD:29:0E:0A:D9:15:E9:08:0C:B8:74:F4:
                   82:B4:4E:51:8F:1C:86:A3:2E:BF:BB:F8:4A:DD:17:07:
                   37:27:0F:8B:5C:5E:75:28:B4:0C:DE:F2:38:B9:0E:AE:
                   73:06:A1:3D:36:85:54:74:E6:C3:4B:78:80:9F:76:42:
                   85:D2:94:FF:A0:0C:7D:23:61:AB:4E:7A:D0:5B:EC:CF:
                   91:E9:CB:80:C4:A1:EB:86:FB:D8:E6:65:AC:48:D0:9F:
                   8B:95:07:A9:CA:D7:34:A9:7B:32:25:1E:F4:21:A8:06:
                   44:73:B4:99:79:B5:69:77:D1:18:3B:40:C5:20:AF:5C:
                   8E:D0:65:AE:34:CF:1F:90:82:97:33:7F:90:E6:D9:BC:
                   49:8F:BE:59:22:FE:09:E5:FA:F2:5F:31:77:6D:F8:99

Verifying that the CA is functioning

1. List the certificates in the CA:

   # pki -p 8443 ca-cert-find

2. As the bootstrap admin user, list the users in the RootCA:

   # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 8443 -n "PKI Bootstrap Administrator for RSA-RootCA" ca-user-find

Procedure

1. Create a SubCA installation file at a chosen location (e.g. /root/pki_rsa):

   # cd /root/pki_rsa

   # vi subca_inst.cfg

   Note

   Unless explicitly specified, system certificate nicknames are automatically named bearing the value specified for pki_instance_name. To avoid certificate nickname conflicts on a shared HSM, use a unique instance name for each instance creation.
   

   The values specified in the installation file below are examples. In addition to changing the HSM password, edit the values accordingly, for example ports, directories, nicknames, domains…​

   [DEFAULT]
   pki_instance_name=rhcs10-RSA-SubCA
   pki_https_port=31443
   pki_http_port=31080
   
   ### Crypto Token
   pki_hsm_enable=True
   pki_hsm_libfile=/opt/nfast/toolkits/pkcs11/libcknfast.so
   pki_hsm_modulename=nfast
   pki_token_name=NHSM-CONN-XC
   pki_token_password=<YourHSMpassword>
   
   pki_audit_signing_token=NHSM-CONN-XC
   pki_audit_signing_key_algorithm=SHA256withRSA
   pki_audit_signing_key_size=2048
   pki_audit_signing_key_type=rsa
   pki_audit_signing_signing_algorithm=SHA256withRSA
   
   pki_subsystem_token=NHSM-CONN-XC
   pki_subsystem_key_algorithm=SHA256withRSA
   pki_subsystem_signing_algorithm=SHA256withRSA
   pki_subsystem_key_size=2048
   pki_subsystem_key_type=rsa
   
   pki_sslserver_token=NHSM-CONN-XC
   pki_sslserver_key_algorithm=SHA256withRSA
   pki_sslserver_signing_algorithm=SHA256withRSA
   pki_sslserver_key_size=2048
   pki_sslserver_key_type=rsa
   
   ### CA cert chain concatenated in PEM format
   pki_cert_chain_path=/opt/pki_rsa/ca-chain.pem
   
   ### Bootstrap Admin
   pki_admin_password=SECret.123
   pki_admin_key_type=rsa
   pki_admin_key_size=2048
   pki_admin_key_algorithm=SHA256withRSA
   
   ### Bootstrap Admin client dir
   pki_client_admin_cert_p12=/opt/pki_rsa/rhcs10-RSA-SubCA/ca_admin_cert.p12
   pki_client_database_dir=/opt/pki_rsa/rhcs10-RSA-SubCA/certs_db
   pki_client_database_password=SECret.123
   pki_client_dir=/opt/pki_rsa/rhcs10-RSA-SubCA
   pki_client_pkcs12_password=SECret.123
   
   ### Internal LDAP
   pki_ds_bind_dn=cn=Directory Manager
   pki_ds_ldap_port=7389
   pki_ds_ldaps_port=7636
   pki_ds_password=SECret.123
   pki_ds_remove_data=True
   pki_ds_secure_connection=True
   pki_ds_secure_connection_ca_pem_file=/opt/pki_rsa/temp-dirsrv-subca-cert.pem
   pki_ds_secure_connection_ca_nickname=DS temp CA certificate
   
   
   [Tomcat]
   pki_ajp_port=31009
   pki_tomcat_server_port=31005
   
   
   [CA]
   pki_subordinate=True
   pki_issuing_ca_https_port=8443
   pki_issuing_ca_hostname=rhcs10.example.com
   pki_issuing_ca=https://rhcs10.example.com:8443
   
   ### New Security Domain
   pki_security_domain_hostname=rhcs10.example.com
   pki_security_domain_https_port=8443
   pki_security_domain_password=SECret.123
   pki_subordinate_create_new_security_domain=True
   pki_subordinate_security_domain_name=Example-rhcs10-RSA-SubCA
   
   pki_import_admin_cert=False
   pki_admin_nickname=PKI Bootstrap Administrator for RSA-SubCA
   pki_admin_name=caadmin
   pki_admin_uid=caadmin
   pki_admin_email=caadmin@example.com
   
   pki_ca_signing_token=NHSM-CONN-XC
   pki_ca_signing_key_algorithm=SHA256withRSA
   pki_ca_signing_key_size=3072
   pki_ca_signing_key_type=rsa
   pki_ca_signing_nickname=CA Signing Cert - %(pki_instance_name)s
   pki_ca_signing_signing_algorithm=SHA256withRSA
   
   pki_ocsp_signing_token=NHSM-CONN-XC
   pki_ocsp_signing_key_algorithm=SHA256withRSA
   pki_ocsp_signing_key_size=3072
   pki_ocsp_signing_key_type=rsa
   pki_ocsp_signing_signing_algorithm=SHA256withRSA
   
   pki_ds_hostname=rhds11.example.com
   pki_ds_base_dn=dc=RSA-SubCA
   pki_ds_database=CC-RSA-SubCA-LDAP
   pki_share_db=False
   
   ### Enable random serial numbers
   pki_random_serial_numbers_enable=True

2. Run the pkispawn tool to install the RHCS SubCA instance:

   # pkispawn -s CA -f subca_inst.cfg --debug

   This will create the SubCA instance in /var/lib/pki/rhcs10-RSA-SubCA.

Verification steps

1. Show the status of the installed CA:

   # pki-server status rhcs10-RSA-SubCA

   Note down the Unsecure EE, Secure EE, Agent, Admin and pkiconsole URLs.

2. Verify the sanity of the CA by running the following command. It should display certificates:

   # pki -p 31443 -h rhcs10.example.com ca-cert-find

First step of SubCA installation

1. Create a CA installation file at a chosen location (e.g. /root/pki_rsa) on the machine that will host the RHCS instance (rhcs10.example.com).

   # cd /root/pki_rsa
   
   # vi subca_inst.cfg

   [DEFAULT]
   pki_instance_name=rhcs10-RSA-SubCA
   pki_https_port=31443
   pki_http_port=31080
   
   ### Crypto Token
   pki_hsm_enable=True
   pki_hsm_libfile=/opt/nfast/toolkits/pkcs11/libcknfast.so
   pki_hsm_modulename=nfast
   pki_token_name=NHSM-CONN-XC
   pki_token_password=<YourHSMpassword>
   
   pki_audit_signing_token=NHSM-CONN-XC
   pki_audit_signing_key_algorithm=SHA256withRSA
   pki_audit_signing_key_size=2048
   pki_audit_signing_key_type=rsa
   pki_audit_signing_signing_algorithm=SHA256withRSA
   
   pki_subsystem_token=NHSM-CONN-XC
   pki_subsystem_key_algorithm=SHA256withRSA
   pki_subsystem_signing_algorithm=SHA256withRSA
   pki_subsystem_key_size=2048
   pki_subsystem_key_type=rsa
   
   pki_sslserver_token=NHSM-CONN-XC
   pki_sslserver_key_algorithm=SHA256withRSA
   pki_sslserver_signing_algorithm=SHA256withRSA
   pki_sslserver_key_size=2048
   pki_sslserver_key_type=rsa
   
   ### CA cert chain concatenated in PEM format
   pki_cert_chain_path=/opt/pki_rsa/ca-chain.pem
   
   ### Bootstrap Admin
   pki_admin_password=SECret.123
   pki_admin_key_type=rsa
   pki_admin_key_size=2048
   pki_admin_key_algorithm=SHA256withRSA
   
   ### Bootstrap Admin client dir
   pki_client_admin_cert_p12=/opt/pki_rsa/rhcs10-RSA-SubCA/ca_admin_cert.p12
   pki_client_database_dir=/opt/pki_rsa/rhcs10-RSA-SubCA/certs_db
   pki_client_database_password=SECret.123
   pki_client_dir=/opt/pki_rsa/rhcs10-RSA-SubCA
   pki_client_pkcs12_password=SECret.123
   
   ### Internal LDAP
   pki_ds_bind_dn=cn=Directory Manager
   pki_ds_ldap_port=7389
   pki_ds_ldaps_port=7636
   pki_ds_password=SECret.123
   pki_ds_remove_data=True
   pki_ds_secure_connection=True
   pki_ds_secure_connection_ca_pem_file=/opt/pki_rsa/temp-dirsrv-subca-cert.pem
   pki_ds_secure_connection_ca_nickname=DS temp CA certificate
   
   
   [Tomcat]
   pki_ajp_port=31009
   pki_tomcat_server_port=31005
   
   
   [CA]
   pki_subordinate=True
   pki_issuing_ca_https_port=8443
   pki_issuing_ca_hostname=rhcs10.example.com
   pki_issuing_ca=https://rhcs10.example.com:8443
   
   ### New Security Domain
   pki_security_domain_hostname=rhcs10.example.com
   pki_security_domain_https_port=8443
   pki_security_domain_password=SECret.123
   pki_subordinate_create_new_security_domain=True
   pki_subordinate_security_domain_name=Example-rhcs10-RSA-SubCA
   
   pki_import_admin_cert=False
   pki_admin_nickname=PKI Bootstrap Administrator for RSA-SubCA
   pki_admin_name=caadmin
   pki_admin_uid=caadmin
   pki_admin_email=caadmin@example.com
   
   pki_ca_signing_token=NHSM-CONN-XC
   pki_ca_signing_key_algorithm=SHA256withRSA
   pki_ca_signing_key_size=3072
   pki_ca_signing_key_type=rsa
   pki_ca_signing_nickname=CA Signing Cert - %(pki_instance_name)s
   pki_ca_signing_signing_algorithm=SHA256withRSA
   
   pki_ocsp_signing_token=NHSM-CONN-XC
   pki_ocsp_signing_key_algorithm=SHA256withRSA
   pki_ocsp_signing_key_size=3072
   pki_ocsp_signing_key_type=rsa
   pki_ocsp_signing_signing_algorithm=SHA256withRSA
   
   pki_ds_hostname=rhds11.example.com
   pki_ds_base_dn=dc=RSA-SubCA
   pki_ds_database=CC-RSA-SubCA-LDAP
   pki_share_db=False
   
   ### Enable random serial numbers
   pki_random_serial_numbers_enable=True

   Note

   Unless explicitly specified, system certificate nicknames are automatically named bearing the value specified for pki_instance_name. To avoid certificate nickname conflicts on a shared HSM, use a unique instance name for each instance creation. However, in a two-step installation, the pki_instance_name value of both files should match. The following values are just examples.

2. Run the pkispawn tool to install the RHCS CA instance:

   # pkispawn -s CA -f subca_inst.cfg --skip-configuration --debug

Verification steps

1. Show the status of the installed CA:

   # pki-server status rhcs10-RSA-SubCA

   Note down the Unsecure EE, Secure EE, Agent, Admin and pkiconsole URLs.

2. Verify the sanity of the CA by running the following command. It should display certificates:

   # pki -p 8443 -h rhcs10.example.com ca-cert-find

1. Retrieve the SubCA certificate into a .pem file

   # certutil -L -d /var/lib/pki/rhcs10-RSA-SubCA/alias -n "CA Signing Cert - rhcs10-RSA-SubCA" -a > /opt/pki_rsa/subCA.pem

2. Update the CA certificate chain. For example:

   # cat /opt/pki_rsa/subCA.pem /opt/pki_rsa/rootCA.pem > /opt/pki_rsa/ca-chain.pem

1. Copy the files to rhds11.example.com (the machine that hosts the DS instances):

   # scp /opt/pki_rsa/subCA.pem root@rhds11.example.com:/opt/pki_rsa

   # scp /opt/pki_rsa/ca-chain.pem root@rhds11.example.com:/opt/pki_rsa

2. Restart the DS instance for the SubCA:

   # dsctl slapd-CC-RSA-SubCA-LDAP restart

1. Optional: If you have not done this previously, import the RootCA signing certificate into the nssdb:

   # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db -c SECret.123 client-cert-import "CA Signing Cert - rhcs10-RSA-RootCA" --ca-cert /opt/pki_rsa/rootCA.pem

2. Import the SubCA signing certificate into the nssdb:

   # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db -c SECret.123 client-cert-import "CA Signing Cert - rhcs10-RSA-SubCA" --ca-cert /opt/pki_rsa/subCA.pem

3. Import the SubCA bootstrap certificate into the nssdb:

   # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db -c SECret.123 client-cert-import --pkcs12 /opt/pki_rsa/rhcs10-RSA-SubCA/ca_admin_cert.p12 --pkcs12-password SECret.123
   
   ----------------------------------------
   Imported certificates from PKCS #12 file
   ----------------------------------------

Procedure

1. Generate a list of non-CMC profiles to be edited:

   # ls /var/lib/pki/rhcs10-RSA-SubCA/ca/profiles/ca | grep -v CMC | grep -v Install | grep -v caInternal | grep -v caECInternal | grep -v caAdminCert | grep -v caECAdminCert | tee /root/pki_rsa/subca-profile-deletelist.txt

2. Stop the SubCA instance:

   pki-server stop rhcs10-RSA-SubCA

3. For every profile in the list, change the visible and enable parameters from true to false. For example, use the following command to set visible=false and enable=false:

   # cat /root/pki_rsa/subca-profile-deletelist.txt | while read line; do sed -i 's/^visible=true/visible=false/g' /var/lib/pki/rhcs10-RSA-SubCA/ca/profiles/ca/$line; sed -i 's/^enable=true/enable=false/g' /var/lib/pki/rhcs10-RSA-SubCA/ca/profiles/ca/$line; done

4. In addition, also change the visible parameter for the caCMCUserCert profile to false:

   # sed -i 's/^visible=true/visible=false/' /var/lib/pki/rhcs10-RSA-SubCA/ca/profiles/ca/caCMCUserCert.cfg /var/lib/pki/rhcs10-RSA-SubCA/ca/profiles/ca/caCMCECUserCert.cfg

5. Start the SubCA instance:

   pki-server start rhcs10-RSA-SubCA

1. Stop DS:

   # dsctl slapd-CC-RSA-OCSP-subca-LDAP stop

   Note

   If you are not certain about the name of a DS instance, list all instances using: dsctl -l

2. Use the certutil tool to generate the CSR:

   # certutil -R -d /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP -s "CN=rhds11.example.com" -g 2048 -f /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/pwdfile.txt -a -o /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/Server-Cert-ocsp-subca.csr -z /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/noise.txt

   Important

   Edit the Server-Cert-ocsp-subca.csr output file obtained above to remove the few lines before "Begin Certificate Request". For example:
   

   # vi /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/Server-Cert-ocsp-subca.csr

   The CSR file must start with the line "-----BEGIN CERTIFICATE REQUEST-----" and end with the line "-----END CERTIFICATE REQUEST-----".

3. Remote copy the Server-Cert-ocsp-subca.csr file to the system where the CA resides. For example:

   # scp /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/Server-Cert-ocsp-subca.csr root@rhcs10.example.com:/root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-ocsp-subca.csr

1. Generate a CMC request:

   1. Create a CMCRequest configuration file. For example:

      # vim /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-subca_pkcs10.cfg

      ### numRequests: Total number of PKCS10 requests or CRMF requests.
      numRequests=1
      
      ### input: full path for the PKCS10 request or CRMF request,
      ### The content must be in Base-64 encoded format.
      ### Multiple files are supported. They must be separated by a space.
      ### For input on a different host, specify where to find the CSR.
      input=/root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-ocsp-subca.csr
      
      ### output: full path for the CMC request in binary format
      ### For output on a different host, specify the destination.
      output=/root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-subca_pkcs10.req
      
      ### tokenname: name of the token where the agent signing cert can be found (default is internal)
      tokenname=internal
      
      ### nickname: nickname for the agent certificate that will be used to sign the CMC full request.
      nickname=PKI Bootstrap Administrator for RSA-SubCA
      
      ### dbdir: directory for cert8.db, key3.db and secmod.db
      dbdir=/root/.dogtag/pki_rsa_bootstrap/certs_db
      
      ### password: password for cert8.db that stores the agent certificate
      password=SECret.123
      
      ### format: request format, either pkcs10 or crmf
      format=pkcs10

   2. Generate the request using the CMCRequest command:

      # CMCRequest /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-subca_pkcs10.cfg
      
      cert/key prefix =
      path = /root/.dogtag/pki_rsa_bootstrap/certs_db
      CryptoManger initialized
      token internal logged in...
      got signerCert: PKI Bootstrap Administrator for RSA-SubCA
      createPKIData: begins
      k=0
      createPKIData:  format: pkcs10
      useSharedSecret is false...
      signData: begins:
      getPrivateKey: got signing cert
      signData:  got signer privKey
      createSignedData: begins
      getSigningAlgFromPrivate: begins.
      getSigningAlgFromPrivate: found signingKeyType=RSA
      getSigningAlgFromPrivate: using SignatureAlgorithm: RSASignatureWithSHA256Digest
      createSignedData: digest created for pkidata
      createSignedData: digest algorithm =RSASignatureWithSHA256Digest
      createSignedData: building cert chain
      signData: signed request generated.
      getCMCBlob: begins
      getCMCBlob: generating signed data
      
      The CMC enrollment request in base-64 encoded format:
      
      . . . Output omitted . . .
      
      The CMC enrollment request in binary format is stored in
      /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-subca_pkcs10.req

2. Submit the CMC request:

   1. Create a HttpClient configuration file. For example:

      # vim /root/.dogtag/pki_rsa_bootstrap/certs_db/HttpClient_dirsrv-ocsp-subca.cfg

      ### host: host name for the http server
      host=rhcs10.example.com
      
      ### port: port number
      port=31443
      
      ### secure: true for secure connection, false for nonsecure connection
      secure=true
      
      ### input: full path for the enrollment request, the content must be in binary format
      input=/root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-subca_pkcs10.req
      
      ### output: full path for the response in binary format
      output=/root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-subca_pkcs10.resp
      
      ### tokenname: name of the token where the SSL client authentication cert can be found (default is internal)
      ### This parameter will be ignored if secure=false
      tokenname=internal
      
      ### dbdir: directory for cert8.db, key3.db and secmod.db
      ### This parameter will be ignored if secure=false
      dbdir=/root/.dogtag/pki_rsa_bootstrap/certs_db
      
      ### clientmode: true for client authentication, false for no client authentication
      ### This parameter will be ignored if secure=false
      clientmode=true
      
      ### password: password for cert8.db
      ### This parameter will be ignored if secure=false and clientauth=false
      password=SECret.123
      
      ### nickname: nickname for client certificate
      ### This parameter will be ignored if clientmode=false
      nickname=PKI Bootstrap Administrator for RSA-SubCA
      
      ### servlet: servlet name
      servlet=/ca/ee/ca/profileSubmitCMCFull?profileId=caCMCserverCert

   2. Submit the request using the HttpClient command:

      # HttpClient /root/.dogtag/pki_rsa_bootstrap/certs_db/HttpClient_dirsrv-ocsp-subca.cfg
      
      Total number of bytes read = 3096
      after SSLSocket created, thread token is NSS FIPS 140-2 User Private Key
      client cert is not null
      handshake happened
      writing to socket
      
      ##Response Headers begin##
      HTTP/1.1 200
      Content-Type: application/pkcs7-mime
      Content-Length: 2492
      Date: Tue, 29 Sep 2020 15:20:21 GMT
      Connection: close
      ##end##
      
      . . . Output omitted . . .
      
      The response in binary format is stored in
      /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-subca_pkcs10.resp

3. Process the CMC Response:

   1. Process the response using CMCResponse to display all certificates in chain individually in PEM format:

      Important

      Running CMCResponse with the "-v" option returns the PEM of each certificate in the chain as Cert:0, Cert:1 etc. Below all the PEMs, the output also displays each certificate in the chain in pretty print format. Since the certificates are not displayed in a fixed order, in order to determine their position in the chain, you must examine the "Subject:" under each "Certificate". The corresponding PEM is displayed in the same position above.

      # CMCResponse -d /root/.dogtag/pki_rsa_bootstrap/certs_db -i /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-ocsp-subca_pkcs10.resp -v
      
      Cert:0
      …
      ===
      Cert:1
      …
      ===
      Cert:2
      …
      ===
      Certificates:
          Certificate:
              Data:
                  Version:  v3
                  Serial Number: 0xF4837FD
                  Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
                  Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA
                  Validity:
                      Not Before: Wednesday, September 13, 2023 10:29:00 AM EDT America/New_York
                      Not  After: Tuesday, September 2, 2025 10:29:00 AM EDT America/New_York
                  Subject: CN=rhds11.example.com
      
      . . . Output omitted . . .
      
          Certificate:
              Data:
                  Version:  v3
                  Serial Number: 0xD0F4BEE
                  Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
                  Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
                  Validity:
                      Not Before: Friday, September 1, 2023 1:26:46 AM EDT America/New_York
                      Not  After: Tuesday, September 1, 2043 1:26:46 AM EDT America/New_York
                  Subject: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
      
      . . . Output omitted . . .
      
          Certificate:
              Data:
                  Version:  v3
                  Serial Number: 0x485588D
                  Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
                  Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
                  Validity:
                      Not Before: Tuesday, September 12, 2023 5:18:54 PM EDT America/New_York
                      Not  After: Friday, September 12, 2042 5:18:54 PM EDT America/New_York
                  Subject: CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA
      
      . . . Output omitted . . .
      
      Number of controls is 1
      Control #0: CMCStatusInfoV2
         OID: {1 3 6 1 5 5 7 7 25}
         BodyList: 1
         Status: SUCCESS
      CMC Full Response.

   2. Save the new Server-Cert DS certificate into a file in the bootstrap certificate directory (e.g. /root/.dogtag/pki_rsa_bootstrap/certs_db/) named accordingly. The .pem file must start with the header -----BEGIN CERTIFICATE----- and end with the footer -----END CERTIFICATE-----. For example:

      # vi /root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-ocsp-subca.pem

      Where Server-Cert-ocsp-subca.pem is the new Server-Cert certificate of the Directory Server instance that serves as the internaldb of the OCSP for the SubCA.

      Note

      The RootCA’s signing certificate should match with the output from the following command:

      # certutil -L -d /var/lib/pki/rhcs10-RSA-RootCA/alias/ -n "CA Signing Cert - rhcs10-RSA-RootCA" -a

4. Remote copy the new Server-Cert certificate to rhds11.example.com. For example:

   # scp /root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-ocsp-subca.pem root@rhds11.example.com:/etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/

1. Save the contents of the dirsrv directory into a backup directory:

   # cp -r /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/ /etc/dirsrv/save-rsa/slapd-CC-RSA-OCSP-subca-LDAP/

2. Delete the old DS certificates:

   # certutil -D -d /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/pwdfile.txt -n "Server-Cert"

   # certutil -D -d /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/pwdfile.txt -n "Self-Signed-CA"

3. Import the newly created DS certificate and the CA certificates in its chain one by one. For example:

   # certutil -d /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/pwdfile.txt -A -t "CT,C,C" -n "CA Signing Cert - rhcs10-RSA-RootCA" -i /opt/pki_rsa/rootCA.pem

   # certutil -d /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/pwdfile.txt -A -t "CT,C,C" -n "CA Signing Cert - rhcs10-RSA-SubCA" -i /opt/pki_rsa/subCA.pem

   # certutil -d /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/pwdfile.txt -A -t "u,u,u" -n "Server-Cert" -i /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/Server-Cert-ocsp-subca.pem

4. List the certificates:

   # certutil -L -d /etc/dirsrv/slapd-CC-RSA-OCSP-subca-LDAP/
   
   Certificate Nickname                           Trust Attributes
                                                  SSL,S/MIME,JAR/XPI
   CA Signing Cert - rhcs10-RSA-RootCA            CT,C,C
   CA Signing Cert - rhcs10-RSA-SubCA             CT,C,C
   Server-Cert                                    u,u,u

5. Start DS:

   # dsctl slapd-CC-RSA-OCSP-subca-LDAP start

6. Test to confirm that the LDAP server is up and running (in case of a separate system, test on the CA host as well):

   # ldapsearch -x -D "cn=Directory Manager" -H ldaps://rhds11.example.com:11636 -b "dc=example,dc=com" -w SECret.123

   If testing on a separate system, include the CA certificate chain in front of the ldapsearch command, for example:

   # LDAPTLS_CACERT=/opt/pki_rsa/ca-chain.pem ldapsearch -x -D "cn=Directory Manager" -H ldaps://rhds11.example.com:11636 -b "dc=example,dc=com" -w SECret.123

Procedure

1. Create an OCSP installation file at a chosen location (e.g. /root/pki_rsa) for generating certificate requests:

   # cd /root/pki_rsa

   # vi ocsp_subca_inst.cfg

   Note

   Unless explicitly specified, system certificate nicknames are automatically named bearing the value specified for pki_instance_name. To avoid certificate nickname conflicts on a shared HSM, use a unique instance name for each instance creation.
   

   The values specified in the installation file below are examples. In addition to changing the HSM password, edit the values accordingly, for example ports, directories, nicknames, domains…​

   [DEFAULT]
   pki_instance_name=rhcs10-RSA-OCSP-subca
   pki_https_port=32443
   pki_http_port=32080
   
   ### Crypto Token
   pki_hsm_enable=True
   pki_hsm_libfile=/opt/nfast/toolkits/pkcs11/libcknfast.so
   pki_hsm_modulename=nfast
   pki_token_name=NHSM-CONN-XC
   pki_token_password=<YourHSMpassword>
   
   pki_audit_signing_token=NHSM-CONN-XC
   pki_audit_signing_key_algorithm=SHA256withRSA
   pki_audit_signing_key_size=2048
   pki_audit_signing_key_type=rsa
   pki_audit_signing_signing_algorithm=SHA256withRSA
   
   pki_subsystem_token=NHSM-CONN-XC
   pki_subsystem_key_algorithm=SHA256withRSA
   pki_subsystem_signing_algorithm=SHA256withRSA
   pki_subsystem_key_size=2048
   pki_subsystem_key_type=rsa
   
   pki_sslserver_token=NHSM-CONN-XC
   pki_sslserver_key_algorithm=SHA256withRSA
   pki_sslserver_signing_algorithm=SHA256withRSA
   pki_sslserver_key_size=2048
   pki_sslserver_key_type=rsa
   
   ### CA cert chain concatenated in PEM format
   pki_cert_chain_path=/opt/pki_rsa/ca-chain.pem
   
   ### Bootstrap Admin
   pki_admin_password=SECret.123
   pki_admin_key_type=rsa
   pki_admin_key_size=2048
   pki_admin_key_algorithm=SHA256withRSA
   
   ### Bootstrap Admin client dir
   pki_client_admin_cert_p12=/opt/pki_rsa/rhcs10-RSA-OCSP-subca/ocsp_admin_cert.p12
   pki_client_database_dir=/opt/pki_rsa/rhcs10-RSA-OCSP-subca/certs_db
   pki_client_database_password=SECret.123
   pki_client_database_purge=False
   pki_client_dir=/opt/pki_rsa/rhcs10-RSA-OCSP-subca
   pki_client_pkcs12_password=SECret.123
   
   ### Internal LDAP
   pki_ds_bind_dn=cn=Directory Manager
   pki_ds_ldap_port=11389
   pki_ds_ldaps_port=11636
   pki_ds_password=SECret.123
   pki_ds_remove_data=True
   pki_ds_secure_connection=True
   pki_ds_secure_connection_ca_pem_file=/opt/pki_rsa/ca-chain.pem
   pki_ds_secure_connection_ca_nickname=CA Signing Cert - rhcs10-RSA-SubCA
   
   ### Security Domain
   pki_security_domain_hostname=rhcs10.example.com
   pki_security_domain_https_port=31443
   pki_security_domain_password=SECret.123
   pki_security_domain_user=caadmin
   
   
   [Tomcat]
   pki_ajp_port=32009
   pki_tomcat_server_port=32005
   
   
   [OCSP]
   pki_import_admin_cert=False
   
   pki_ocsp_signing_token=NHSM-CONN-XC
   pki_ocsp_signing_key_algorithm=SHA256withRSA
   pki_ocsp_signing_key_size=3072
   pki_ocsp_signing_key_type=rsa
   pki_ocsp_signing_signing_algorithm=SHA256withRSA
   
   pki_admin_nickname=PKI Bootstrap Administrator for RSA-OCSP-subca
   pki_admin_name=ocspadmin
   pki_admin_uid=ocspadmin
   pki_admin_email=ocspadmin@example.com
   
   pki_ds_hostname=rhds11.example.com
   pki_ds_base_dn=dc=RSA-OCSP-subca
   pki_ds_database=CC-RSA-OCSP-subca-LDAP
   pki_share_db=False

2. Run the pkispawn tool to install the OCSP subsystem:

   # pkispawn -s OCSP -f ocsp_subca_inst.cfg --debug

   This will create the OCSP instance in /var/lib/pki/rhcs10-RSA-OCSP-subca.

1. Log in to rhcs10.example.com as root.

2. Stop the SubCA’s OCSP service:

   pki-server stop rhcs10-RSA-OCSP-subca

3. Edit /var/lib/pki/rhcs10-RSA-OCSP-subca/conf/server.xml to increase the timeout period:

   <Connector name="Secure" port="32443" …
   connectionTimeout="3000000"

4. Start the SubCA’s OCSP service:

   # pki-server start rhcs10-RSA-OCSP-subca

1. Stop the SubCA:

   # pki-server stop rhcs10-RSA-SubCA

2. Edit the SubCA’s CS.cfg and set the ca.defaultOcspUri variable to point to the OCSP. For example:

   ca.defaultOcspUri=http://rhcs10.example.com:32080/ocsp/ee/ocsp

3. Start the SubCA:

   # pki-server start rhcs10-RSA-SubCA

1. Configure OCSP with authType=sslclientauth and import the role user certificate by following Configure pkiconsole login with client authentication.

2. Login to pkiconsole with the client authentication certificate of the role user:

   # pkiconsole -d <home .redhat-idm-console dir> -n <client cert> https://rhcs10.example.com:32443/ocsp

   And select the role user certificate nickname from the list, for example OCSP adminV. Login to the console should be successful.

Create an agent certificate for a pki agent user

1. Follow the procedure as described in Section 7.12.3, “Agent users” to get an agent certificate (in this example, rsa_SubCA_AgentV) issued for a pki agent user (e.g. jsmith). NOTE: As explained at the beginning of that part, if you are simply testing/evaluating the product, for convenience, instead of using a non-root user (e.g. jsmith), you could generate the CSR for rsa_SubCA_AgentV in the same certificate database as that of the bootstrap user (/root/.dogtag/pki_rsa_bootstrap/certs_db) as root, and further import the certificate into the same certdb to use. In case you select to do that, substitute the user/certs_db accordingly in the instructions that follow.

Verification:

1. Show the status of the installed SubCA:

   # pki-server status rhcs10-RSA-SubCA

   Note down the Secure Agent, Admin and pkiconsole URLs.

2. Perform a sanity test to verify the new SubCA Admin certificate was added successfully:

   1. First, find the serial number of the user1 certificate created in Section 7.7.7.4, “Testing CRL publishing”:

      # pki -p 31443 -h rhcs10.example.com ca-cert-find --uid user1

   2. Place a hold on user1’s certificate using the SubCA Agent’s credentials:

      # pki -d /home/jsmith/certs_db -n rsa_SubCA_AgentV -p 31443 -h rhcs10.example.com ca-cert-hold <user1 serial number>

3. Make sure the SubCA’s EE page is accessible on rhcs10.example.com.

1. Stop DS:

   # dsctl slapd-CC-RSA-SubCA-LDAP stop

2. Use the certutil tool to generate the CSR:

   # certutil -R -d /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP -s "CN=rhds11.example.com" -g 2048 -f /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/pwdfile.txt -a -o /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/Server-Cert-subca.csr -z /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/noise.txt

   Important

   Edit the Server-Cert-subca.csr output file obtained above to remove the few lines before "Begin Certificate Request". For example:
   

   # vi /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/Server-Cert-subca.csr

   The CSR file must start with the line "-----BEGIN CERTIFICATE REQUEST-----" and end with the line "-----END CERTIFICATE REQUEST-----".

3. Start DS:

   # dsctl slapd-CC-RSA-SubCA-LDAP start

4. Remote copy the Server-Cert-subca.csr file to the system where the CA resides. For example:

   # scp /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/Server-Cert-subca.csr root@rhcs10.example.com:/root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-subca.csr

1. Generate a CMC request:

   1. Create a CMCRequest configuration file. For example:

      # vim /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-subca_pkcs10.cfg

      ### numRequests: Total number of PKCS10 requests or CRMF requests.
      numRequests=1
      
      ### input: full path for the PKCS10 request or CRMF request,
      ### The content must be in Base-64 encoded format.
      ### Multiple files are supported. They must be separated by a space.
      ### For input on a different host, specify where to find the CSR.
      input=/root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-subca.csr
      
      ### output: full path for the CMC request in binary format
      ### For output on a different host, specify the destination.
      output=/root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-subca_pkcs10.req
      
      ### tokenname: name of the token where the agent signing cert can be found (default is internal)
      tokenname=internal
      
      ### nickname: nickname for the agent certificate that will be used to sign the CMC full request.
      nickname=PKI Bootstrap Administrator for RSA-SubCA
      
      ### dbdir: directory for cert8.db, key3.db and secmod.db
      dbdir=/root/.dogtag/pki_rsa_bootstrap/certs_db
      
      ### password: password for cert8.db that stores the agent certificate
      password=SECret.123
      
      ### format: request format, either pkcs10 or crmf
      format=pkcs10

   2. Generate the request using the CMCRequest command:

      # CMCRequest /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-subca_pkcs10.cfg
      
      cert/key prefix =
      path = /root/.dogtag/pki_rsa_bootstrap/certs_db
      CryptoManger initialized
      token internal logged in...
      got signerCert: PKI Bootstrap Administrator for RSA-SubCA
      createPKIData: begins
      k=0
      createPKIData:  format: pkcs10
      useSharedSecret is false...
      signData: begins:
      getPrivateKey: got signing cert
      signData:  got signer privKey
      createSignedData: begins
      getSigningAlgFromPrivate: begins.
      getSigningAlgFromPrivate: found signingKeyType=RSA
      getSigningAlgFromPrivate: using SignatureAlgorithm: RSASignatureWithSHA256Digest
      createSignedData: digest created for pkidata
      createSignedData: digest algorithm =RSASignatureWithSHA256Digest
      createSignedData: building cert chain
      signData: signed request generated.
      getCMCBlob: begins
      getCMCBlob: generating signed data
      
      The CMC enrollment request in base-64 encoded format:
      
      . . . Output omitted . . .
      
      The CMC enrollment request in binary format is stored in
      /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-subca_pkcs10.req

2. Submit the CMC request:

   1. Create a HttpClient configuration file. For example:

      # vim /root/.dogtag/pki_rsa_bootstrap/certs_db/HttpClient_dirsrv-subca.cfg

      ### host: host name for the http server
      host=rhcs10.example.com
      
      ### port: port number
      port=31443
      
      ### secure: true for secure connection, false for nonsecure connection
      secure=true
      
      ### input: full path for the enrollment request, the content must be in binary format
      input=/root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-subca_pkcs10.req
      
      ### output: full path for the response in binary format
      output=/root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-subca_pkcs10.resp
      
      ### tokenname: name of the token where the SSL client authentication cert can be found (default is internal)
      ### This parameter will be ignored if secure=false
      tokenname=internal
      
      ### dbdir: directory for cert8.db, key3.db and secmod.db
      ### This parameter will be ignored if secure=false
      dbdir=/root/.dogtag/pki_rsa_bootstrap/certs_db
      
      ### clientmode: true for client authentication, false for no client authentication
      ### This parameter will be ignored if secure=false
      clientmode=true
      
      ### password: password for cert8.db
      ### This parameter will be ignored if secure=false and clientauth=false
      password=SECret.123
      
      ### nickname: nickname for client certificate
      ### This parameter will be ignored if clientmode=false
      nickname=PKI Bootstrap Administrator for RSA-SubCA
      
      ### servlet: servlet name
      servlet=/ca/ee/ca/profileSubmitCMCFull?profileId=caCMCserverCertWithCRLDP

      Note

      For EC certificates, use the ECC profiles by setting:

      servlet=/ca/ee/ca/profileSubmitCMCFull?profileId=caCMCECserverCertWithCRLDP

   2. Submit the request using the HttpClient command:

      # HttpClient /root/.dogtag/pki_rsa_bootstrap/certs_db/HttpClient_dirsrv-subca.cfg
      
      Total number of bytes read = 3096
      after SSLSocket created, thread token is NSS FIPS 140-2 User Private Key
      client cert is not null
      handshake happened
      writing to socket
      
      ##Response Headers begin##
      HTTP/1.1 200
      Content-Type: application/pkcs7-mime
      Content-Length: 2492
      Date: Tue, 29 Sep 2020 15:20:21 GMT
      Connection: close
      ##end##
      
      . . . Output omitted . . .
      
      The response in binary format is stored in
      /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-subca_pkcs10.resp

3. Process the CMC Response:

   1. Process the response using CMCResponse to display all certificates in chain individually in PEM format:

      Important

      Running CMCResponse with the "-v" option returns the PEM of each certificate in the chain as Cert:0, Cert:1 etc. Below all the PEMs, the output also displays each certificate in the chain in pretty print format. Since the certificates are not displayed in a fixed order, in order to determine their position in the chain, you must examine the "Subject:" under each "Certificate". The corresponding PEM is displayed in the same position above.

      # CMCResponse -d /root/.dogtag/pki_rsa_bootstrap/certs_db -i /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-subca_pkcs10.resp -v
      
      Cert:0
      ...
      ===
      Cert:1
      ...
      ===
      Cert:2
      ...
      ===
      Certificates:
          Certificate:
              Data:
                  Version:  v3
                  Serial Number: 0xA383694
                  Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
                  Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-SubCA
                  Validity:
                      Not Before: Tuesday, April 5, 2022 8:41:36 AM EDT America/New_York
                      Not  After: Monday, March 25, 2024 8:41:36 AM EDT America/New_York
                  Subject: CN=rhds11.example.com
      
      . . . Output omitted . . .
      
          Certificate:
              Data:
                  Version:  v3
                  Serial Number: 0x5C8FAD4
                  Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
                  Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
                  Validity:
                      Not Before: Tuesday, April 5, 2022 8:36:21 AM EDT America/New_York
                      Not  After: Saturday, April 5, 2042 8:36:21 AM EDT America/New_York
                  Subject: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
      
      . . . Output omitted . . .
      
          Certificate:
              Data:
                  Version:  v3
                  Serial Number: 0x80296C3
                  Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
                  Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-SubCA
                  Validity:
                      Not Before: Tuesday, April 5, 2022 8:39:43 AM EDT America/New_York
                      Not  After: Friday, April 5, 2041 8:39:43 AM EDT America/New_York
                  Subject: CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA
      
      . . . Output omitted . . .
      
      Number of controls is 1
      Control #0: CMCStatusInfoV2
      OID: {1 3 6 1 5 5 7 7 25}
      BodyList: 1
      Status: SUCCESS
      CMC Full Response.

   2. Save the new Server-Cert DS certificate into a file in the bootstrap certificate directory (e.g. /root/.dogtag/pki_rsa_bootstrap/certs_db/) named accordingly. The .pem file must start with the header -----BEGIN CERTIFICATE----- and end with the footer -----END CERTIFICATE-----. For example:

      # vi /root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-subca.pem

      Where Server-Cert-subca.pem is the new Server-Cert certificate of the Directory Server instance that serves as the internaldb of the SubCA.

      Note

      The RootCA’s signing certificate should match with the output from the following command:

      # certutil -L -d /var/lib/pki/rhcs10-RSA-RootCA/alias/ -n "CA Signing Cert - rhcs10-RSA-RootCA" -a

4. Remote copy the new Server-Cert certificate to rhds11.example.com. For example:

   # scp /root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-subca.pem root@rhds11.example.com:/etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/

1. Stop the SubCA’s LDAP instance:

   # dsctl slapd-CC-RSA-SubCA-LDAP stop

2. Save the contents of the dirsrv directory into a backup directory:

   # cp -r /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/ /etc/dirsrv/save-rsa/slapd-CC-RSA-SubCA-LDAP/

3. Delete the old DS certificates:

   # certutil -D -d /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/pwdfile.txt -n "Server-Cert"

   # certutil -D -d /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/pwdfile.txt -n "Self-Signed-CA"

4. Import the newly created DS certificate and the CA certificates in its chain one by one. For example:

   # certutil -d /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/pwdfile.txt -A -t "CT,C,C" -n "CA Signing Cert - rhcs10-RSA-RootCA" -i /opt/pki_rsa/rootCA.pem

   # certutil -d /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/pwdfile.txt -A -t "CT,C,C" -n "CA Signing Cert - rhcs10-RSA-SubCA" -i /opt/pki_rsa/subCA.pem

   # certutil -d /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/pwdfile.txt -A -t "u,u,u" -n "Server-Cert" -i /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/Server-Cert-subca.pem

5. List the certificates:

   # certutil -L -d /etc/dirsrv/slapd-CC-RSA-SubCA-LDAP/
   
   Certificate Nickname                         Trust Attributes
                                                SSL,S/MIME,JAR/XPI
   CA Signing Cert - rhcs10-RSA-RootCA          CT,C,C
   CA Signing Cert - rhcs10-RSA-SubCA           CT,C,C
   Server-Cert                                  u,u,u

6. Start DS:

   # dsctl slapd-CC-RSA-SubCA-LDAP start

7. Test to confirm that the LDAP server is up and running (in case of a separate system, test on the CA host as well):

   # ldapsearch -x -D "cn=Directory Manager" -H ldaps://rhds11.example.com:7636 -b "dc=example,dc=com" -w SECret.123

   If testing on a separate system, include the CA certificate chain in front of the ldapsearch command, for example:

   # LDAPTLS_CACERT=/opt/pki_rsa/ca-chain.pem ldapsearch -x -D "cn=Directory Manager" -H ldaps://rhds11.example.com:7636 -b "dc=example,dc=com" -w SECret.123

1. Stop the SubCA:

   # pki-server stop rhcs10-RSA-SubCA

2. List the certificate:

   # certutil -L -d /var/lib/pki/rhcs10-RSA-SubCA/alias/
   
   Certificate Nickname                    Trust Attributes
                                           SSL,S/MIME,JAR/XPI
   DS temp CA certificate                  CT,C,C
   ...

3. Remove the temporary certificate from the nssdb:

   # certutil -D -d /var/lib/pki/rhcs10-RSA-SubCA/alias/ -n "DS temp CA certificate"

1. To enable certificate revocation checks, in the respective /var/lib/pki/rhcs10-RSA-SubCA/conf/server.xml file:

   1. Set enableOCSP or enableRevocationCheck to true:

      enableOCSP=true
      or
      enableRevocationCheck=true

   2. Additionally, remove these two parameters and their assigned values:

      ocspResponderURL
      ocspResponderCertNickname

2. Disable the legacy revocation check method by editing the CA’s CS.cfg file and setting the following to false:

   auths.revocationChecking.enabled=false

3. Start the SubCA instance:

   # pki-server start rhcs10-RSA-SubCA

1. Check the publishing of the file-based CRL:

   #  ls -l /var/lib/pki/rhcs10-RSA-SubCA/crl
   total 4
   -rw-r--r--. 1 pkiuser pkiuser 573 Jun 21 18:43 ServerCertCRL-20240621-175339.der
   lrwxrwxrwx. 1 pkiuser pkiuser  67 Jun 21 18:43 ServerCertCRL.crl -> /var/lib/pki/rhcs10-RSA-SubCA/crl/ServerCertCRL-20240621-175339.der

2. Display and verify the content of the CRL

   # BtoA /var/lib/pki/rhcs10-RSA-SubCA/crl/ServerCertCRL.crl /var/lib/pki/rhcs10-RSA-SubCA/crl/ServerCertCRL.bin
   # PrettyPrintCrl /var/lib/pki/rhcs10-RSA-SubCA/crl/ServerCertCRL.bin
       Certificate Revocation List:
           Data:
               Version:  v2
               Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
               Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA
               This Update: Friday, June 21, 2024 5:53:39 PM EDT America/New_York
               Next Update: Friday, June 21, 2024 9:00:00 PM EDT America/New_York
               Revoked Certificates:
           Extensions:
               Identifier: CRL Number - 2.5.29.20
                   Critical: no
                   Number: 4
           Signature:
               Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
               Signature:
                   9E:8A:E1:38:C4:B8:EF:E0:34:2A:92:2D:96:F2:7C:DF:
                   71:F8:4E:8E:EF:AD:C1:CA:65:86:BD:27:45:1C:7E:DD:
                   32:E6:16:94:83:E9:83:3F:24:1F:A1:89:74:7E:70:B6:
                   04:20:36:7F:45:9C:A9:6C:7D:63:37:A3:9F:FD:F2:E1:
                   CE:64:FA:D8:75:82:09:42:AB:B6:83:73:40:1A:C7:98:
                   53:BC:65:81:3C:C3:71:D2:12:F9:A6:EA:00:80:B7:D8:
                   A9:56:37:CD:CF:B9:59:64:B1:7F:31:39:16:11:1C:DC:
                   93:64:87:F9:97:CC:EF:58:23:92:77:FC:2E:22:3A:57:
                   AA:D7:7B:D1:1E:2B:3F:AE:FF:17:1A:62:C4:0C:A0:1E:
                   0D:68:00:C4:68:4C:B5:27:4D:4B:DB:33:17:AC:8C:DF:
                   8D:FE:77:EE:B9:B1:17:55:8F:42:A2:5C:84:1B:6F:B8:
                   82:A6:F6:6E:E9:10:37:50:94:C4:33:D3:3C:18:22:7C:
                   D6:6E:5E:89:34:E1:55:F5:80:F6:8F:B9:49:AE:A0:86:
                   2E:B5:8A:B1:00:8C:B0:4C:81:37:A6:BA:D1:7D:77:81:
                   F3:68:6C:16:D6:0A:BA:E7:F6:65:4F:44:A1:5B:31:0F:
                   C2:F7:F9:FE:DC:55:BA:38:F2:AE:AA:34:9E:D0:7D:64:
                   E1:90:68:E2:68:DE:C9:D0:90:26:56:6B:3A:74:AF:E8:
                   CA:55:AE:E8:A1:DF:81:D1:E4:C8:46:DD:E3:12:6D:46:
                   BE:A5:F2:C4:12:4E:15:D5:0F:30:10:3D:77:62:A2:41:
                   F6:85:77:6F:EF:5C:78:0C:FE:F1:C5:4B:C5:C4:69:B5:
                   84:0A:7B:4B:E3:D7:39:9A:66:43:AB:E9:DD:25:8E:EA:
                   58:2F:AD:1D:D4:CD:1A:EE:50:73:B2:0C:F1:29:67:B3:
                   2D:49:E1:54:95:51:9A:36:82:C3:D2:3F:32:7E:73:20:
                   86:0F:28:6F:CC:89:9F:DF:4A:A9:64:CD:30:4A:80:EE

Verifying that the CA is functioning

1. List the certificates in the CA:

   # pki -p 31443 ca-cert-find

2. As the bootstrap admin user, list the users in the SubCA:

   # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 31443 -n "PKI Bootstrap Administrator for RSA-SubCA" ca-user-find

1. Stop the SubCA:

   # pki-server stop rhcs10-RSA-SubCA

2. Edit /var/lib/pki/rhcs10-RSA-SubCA/conf/server.xml to increase the timeout period:

   <Connector name="Secure" port="31443" …
   connectionTimeout="3000000"

3. Start the SubCA:

   # pki-server start rhcs10-RSA-SubCA

1. Configure the SubCA with sslclientauth and import the role user certificate as described in Section 7.13.6, “Configure pkiconsole login with client authentication”.

2. Login to pkiconsole with the client authentication certificate of the role user:

   # pkiconsole -d <home .redhat-idm-console dir> -n <client cert> https://rhcs10.example.com:31443/ca

   And select the role user certificate nickname from the list, for example rsa_SubCA_AdminV. Login to the console should be successful.

1. Stop DS:

   # dsctl slapd-CC-RSA-KRA-LDAP stop

2. Use the certutil tool to generate the CSR:

   # certutil -R -d /etc/dirsrv/slapd-CC-RSA-KRA-LDAP -s "CN=rhds11.example.com" -g 2048 -f /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/pwdfile.txt -a -o /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/Server-Cert-kra.csr -z /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/noise.txt

   Important

   Edit the Server-Cert-kra.csr output file obtained above to remove the few lines before "Begin Certificate Request". For example:
   

   # vi /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/Server-Cert-kra.csr

   The CSR file must start with the line "-----BEGIN CERTIFICATE REQUEST-----" and end with the line "-----END CERTIFICATE REQUEST-----".

3. Remote copy the Server-Cert-kra.csr file to the system where the CA resides. For example:

   # scp /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/Server-Cert-kra.csr root@rhcs10.example.com:/root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-kra.csr

1. Generate a CMC request:

   1. Create a CMCRequest configuration file. For example:

      # vim /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-kra_pkcs10.cfg

      ### numRequests: Total number of PKCS10 requests or CRMF requests.
      numRequests=1
      
      ### input: full path for the PKCS10 request or CRMF request,
      ### The content must be in Base-64 encoded format.
      ### Multiple files are supported. They must be separated by a space.
      ### For input on a different host, specify where to find the CSR.
      input=/root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-kra.csr
      
      ### output: full path for the CMC request in binary format
      ### For output on a different host, specify the destination.
      output=/root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-kra_pkcs10.req
      
      ### tokenname: name of the token where the agent signing cert can be found (default is internal)
      tokenname=internal
      
      ### nickname: nickname for the agent certificate that will be used to sign the CMC full request.
      nickname=PKI Bootstrap Administrator for RSA-SubCA
      
      ### dbdir: directory for cert8.db, key3.db and secmod.db
      dbdir=/root/.dogtag/pki_rsa_bootstrap/certs_db
      
      ### password: password for cert8.db that stores the agent certificate
      password=SECret.123
      
      ### format: request format, either pkcs10 or crmf
      format=pkcs10

   2. Generate the request using the CMCRequest command:

      # CMCRequest /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-kra_pkcs10.cfg
      
      cert/key prefix =
      path = /root/.dogtag/pki_rsa_bootstrap/certs_db
      CryptoManger initialized
      token internal logged in...
      got signerCert: PKI Bootstrap Administrator for RSA-SubCA
      createPKIData: begins
      k=0
      createPKIData:  format: pkcs10
      useSharedSecret is false...
      signData: begins:
      getPrivateKey: got signing cert
      signData:  got signer privKey
      createSignedData: begins
      getSigningAlgFromPrivate: begins.
      getSigningAlgFromPrivate: found signingKeyType=RSA
      getSigningAlgFromPrivate: using SignatureAlgorithm: RSASignatureWithSHA256Digest
      createSignedData: digest created for pkidata
      createSignedData: digest algorithm =RSASignatureWithSHA256Digest
      createSignedData: building cert chain
      signData: signed request generated.
      getCMCBlob: begins
      getCMCBlob: generating signed data
      
      The CMC enrollment request in base-64 encoded format:
      
      . . . Output omitted . . .
      
      The CMC enrollment request in binary format is stored in
      /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-kra_pkcs10.req

2. Submit the CMC request:

   1. Create a HttpClient configuration file. For example:

      # vim /root/.dogtag/pki_rsa_bootstrap/certs_db/HttpClient_dirsrv-kra.cfg

      ### host: host name for the http server
      host=rhcs10.example.com
      
      ### port: port number
      port=31443
      
      ### secure: true for secure connection, false for nonsecure connection
      secure=true
      
      ### input: full path for the enrollment request, the content must be in binary format
      input=/root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-kra_pkcs10.req
      
      ### output: full path for the response in binary format
      output=/root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-kra_pkcs10.resp
      
      ### tokenname: name of the token where the SSL client authentication cert can be found (default is internal)
      ### This parameter will be ignored if secure=false
      tokenname=internal
      
      ### dbdir: directory for cert8.db, key3.db and secmod.db
      ### This parameter will be ignored if secure=false
      dbdir=/root/.dogtag/pki_rsa_bootstrap/certs_db
      
      ### clientmode: true for client authentication, false for no client authentication
      ### This parameter will be ignored if secure=false
      clientmode=true
      
      ### password: password for cert8.db
      ### This parameter will be ignored if secure=false and clientauth=false
      password=SECret.123
      
      ### nickname: nickname for client certificate
      ### This parameter will be ignored if clientmode=false
      nickname=PKI Bootstrap Administrator for RSA-SubCA
      
      ### servlet: servlet name
      servlet=/ca/ee/ca/profileSubmitCMCFull?profileId=caCMCserverCert

   2. Submit the request using the HttpClient command:

      # HttpClient /root/.dogtag/pki_rsa_bootstrap/certs_db/HttpClient_dirsrv-kra.cfg
      
      Total number of bytes read = 3096
      after SSLSocket created, thread token is NSS FIPS 140-2 User Private Key
      client cert is not null
      handshake happened
      writing to socket
      
      ##Response Headers begin##
      HTTP/1.1 200
      Content-Type: application/pkcs7-mime
      Content-Length: 2492
      Date: Tue, 29 Sep 2020 15:20:21 GMT
      Connection: close
      ##end##
      
      . . . Output omitted . . .
      
      The response in binary format is stored in
      /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-kra_pkcs10.resp

3. Process the CMC Response:

   1. Process the response using CMCResponse to display all certificates in chain individually in PEM format:

      Important

      Running CMCResponse with the "-v" option returns the PEM of each certificate in the chain as Cert:0, Cert:1 etc. Below all the PEMs, the output also displays each certificate in the chain in pretty print format. Since the certificates are not displayed in a fixed order, in order to determine their position in the chain, you must examine the "Subject:" under each "Certificate". The corresponding PEM is displayed in the same position above.

      # CMCResponse -d /root/.dogtag/pki_rsa_bootstrap/certs_db -i /root/.dogtag/pki_rsa_bootstrap/certs_db/cmc.dirsrv-kra_pkcs10.resp -v
      
      Cert:0
      ...
      ===
      Cert:1
      ...
      ===
      Cert:2
      ...
      ===
      Certificates:
      
        Certificate:
            Data:
                Version:  v3
                Serial Number: 0x34F6548
                Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
                Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA
                Validity:
                    Not Before: Monday, September 25, 2023 8:28:24 PM EDT America/New_York
                    Not  After: Sunday, September 14, 2025 8:28:24 PM EDT America/New_York
                Subject: CN=rhds11.example.com
      
      . . . Output omitted . . .
      
          Certificate:
              Data:
                  Version:  v3
                  Serial Number: 0x66AA3D5
                  Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
                  Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
                  Validity:
                      Not Before: Friday, September 15, 2023 3:22:33 PM EDT America/New_York
                      Not  After: Tuesday, September 15, 2043 3:22:33 PM EDT America/New_York
                  Subject: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
      
      
      . . . Output omitted . . .
      
          Certificate:
              Data:
                  Version:  v3
                  Serial Number: 0xABA9C22
                  Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
                  Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-RootCA,O=Example-rhcs10-RSA-RootCA
                  Validity:
                      Not Before: Tuesday, September 19, 2023 3:55:59 PM EDT America/New_York
                      Not  After: Friday, September 19, 2042 3:55:59 PM EDT America/New_York
                  Subject: CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA
      
      
      . . . Output omitted . . .
      
      Number of controls is 1
      Control #0: CMCStatusInfoV2
      OID: {1 3 6 1 5 5 7 7 25}
      BodyList: 1
      Status: SUCCESS
      CMC Full Response.

   2. Save the new Server-Cert DS certificate into a file in the bootstrap certificate directory (e.g. /root/.dogtag/pki_rsa_bootstrap/certs_db/) named accordingly. The .pem file must start with the header -----BEGIN CERTIFICATE----- and end with the footer -----END CERTIFICATE-----. For example:

      # vi /root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-kra.pem

      Where Server-Cert-kra.pem is the new Server-Cert certificate of the Directory Server instance that serves as the internaldb of the KRA.

      Note

      The RootCA’s signing certificate should match with the output from the following command:

      # certutil -L -d /var/lib/pki/rhcs10-RSA-RootCA/alias/ -n "CA Signing Cert - rhcs10-RSA-RootCA" -a

4. Remote copy the new Server-Cert certificate to rhds11.example.com. For example:

   # scp /root/.dogtag/pki_rsa_bootstrap/certs_db/Server-Cert-kra.pem root@rhds11.example.com:/etc/dirsrv/slapd-CC-RSA-KRA-LDAP/

1. Save the contents of the dirsrv directory into a backup directory:

   # cp -r /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/ /etc/dirsrv/save-rsa/slapd-CC-RSA-KRA-LDAP/

2. Delete the old DS certificates:

   # certutil -D -d /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/pwdfile.txt -n "Server-Cert"

   # certutil -D -d /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/pwdfile.txt -n "Self-Signed-CA"

3. Import the newly created DS certificate and the CA certificates in its chain one by one. For example:

   # certutil -d /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/pwdfile.txt -A -t "CT,C,C" -n "CA Signing Cert - rhcs10-RSA-RootCA" -i /opt/pki_rsa/rootCA.pem

   # certutil -d /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/pwdfile.txt -A -t "CT,C,C" -n "CA Signing Cert - rhcs10-RSA-SubCA" -i /opt/pki_rsa/subCA.pem

   # certutil -d /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/ -f /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/pwdfile.txt -A -t "u,u,u" -n "Server-Cert" -i /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/Server-Cert-kra.pem

4. List the certificates:

   # certutil -L -d /etc/dirsrv/slapd-CC-RSA-KRA-LDAP/
   
   Certificate Nickname                           Trust Attributes
                                                  SSL,S/MIME,JAR/XPI
   CA Signing Cert - rhcs10-RSA-RootCA            CT,C,C
   CA Signing Cert - rhcs10-RSA-SubCA             CT,C,C
   Server-Cert                                    u,u,u

5. Start DS:

   # dsctl slapd-CC-RSA-KRA-LDAP start

6. Test to confirm that the LDAP server is up and running (in case of a separate system, test on the CA host as well):

   # ldapsearch -x -D "cn=Directory Manager" -H ldaps://rhds11.example.com:22636 -b "dc=example,dc=com" -w SECret.123

   If testing on a separate system, include the CA certificate chain in front of the ldapsearch command, for example:

   # LDAPTLS_CACERT=/opt/pki_rsa/ca-chain.pem ldapsearch -x -D "cn=Directory Manager" -H ldaps://rhds11.example.com:22636 -b "dc=example,dc=com" -w SECret.123

Procedure

1. Create a KRA installation file at a chosen location (e.g. /root/pki_rsa):

   # cd /root/pki_rsa

   # vi kra_inst.cfg

   Note

   Unless explicitly specified, system certificate nicknames are automatically named bearing the value specified for pki_instance_name. To avoid certificate nickname conflicts on a shared HSM, use a unique instance name for each instance creation.
   

   The values specified in the installation file below are examples. In addition to changing the HSM password, edit the values accordingly, for example ports, directories, nicknames, domains…​

   [DEFAULT]
   pki_instance_name=rhcs10-RSA-KRA
   pki_https_port=28443
   pki_http_port=28080
   
   ### Crypto Token
   pki_hsm_enable=True
   pki_hsm_libfile=/opt/nfast/toolkits/pkcs11/libcknfast.so
   pki_hsm_modulename=nfast
   pki_token_name=NHSM-CONN-XC
   pki_token_password=<YourHSMpassword>
   
   pki_audit_signing_token=NHSM-CONN-XC
   pki_audit_signing_key_algorithm=SHA256withRSA
   pki_audit_signing_key_size=2048
   pki_audit_signing_key_type=rsa
   pki_audit_signing_signing_algorithm=SHA256withRSA
   
   pki_subsystem_token=NHSM-CONN-XC
   pki_subsystem_key_algorithm=SHA256withRSA
   pki_subsystem_signing_algorithm=SHA256withRSA
   pki_subsystem_key_size=2048
   pki_subsystem_key_type=rsa
   
   pki_sslserver_token=NHSM-CONN-XC
   pki_sslserver_key_algorithm=SHA256withRSA
   pki_sslserver_signing_algorithm=SHA256withRSA
   pki_sslserver_key_size=2048
   pki_sslserver_key_type=rsa
   
   ### CA cert chain concatenated in PEM format
   pki_cert_chain_path=/opt/pki_rsa/ca-chain.pem
   
   ### Bootstrap Admin
   pki_admin_password=SECret.123
   pki_admin_key_type=rsa
   pki_admin_key_size=2048
   pki_admin_key_algorithm=SHA256withRSA
   
   ### Bootstrap Admin client dir
   pki_client_admin_cert_p12=/opt/pki_rsa/rhcs10-RSA-KRA/kra_admin_cert.p12
   pki_client_database_dir=/opt/pki_rsa/rhcs10-RSA-KRA/certs_db
   pki_client_database_password=SECret.123
   pki_client_database_purge=False
   pki_client_dir=/opt/pki_rsa/rhcs10-RSA-KRA
   pki_client_pkcs12_password=SECret.123
   
   ### Internal LDAP
   pki_ds_bind_dn=cn=Directory Manager
   pki_ds_ldap_port=22389
   pki_ds_ldaps_port=22636
   pki_ds_password=SECret.123
   pki_ds_remove_data=True
   pki_ds_secure_connection=True
   pki_ds_secure_connection_ca_pem_file=/opt/pki_rsa/ca-chain.pem
   pki_ds_secure_connection_ca_nickname=CA Signing Cert - rhcs10-RSA-SubCA
   
   ### Security Domain
   pki_security_domain_hostname=rhcs10.example.com
   pki_security_domain_https_port=31443
   pki_security_domain_password=SECret.123
   pki_security_domain_user=caadmin
   
   
   [Tomcat]
   pki_ajp_port=28009
   pki_tomcat_server_port=28005
   
   [KRA]
   pki_import_admin_cert=False
   
   pki_storage_token=NHSM-CONN-XC
   pki_storage_key_algorithm=SHA256withRSA
   pki_storage_key_size=2048
   pki_storage_key_type=rsa
   pki_storage_signing_algorithm=SHA256withRSA
   
   pki_transport_token=NHSM-CONN-XC
   pki_transport_key_algorithm=SHA256withRSA
   pki_transport_key_size=2048
   pki_transport_key_type=rsa
   pki_transport_signing_algorithm=SHA256withRSA
   
   pki_admin_nickname=PKI Bootstrap Administrator for RSA-KRA
   pki_admin_name=kraadmin
   pki_admin_uid=kraadmin
   pki_admin_email=kraadmin@example.com
   
   pki_ds_hostname=rhds11.example.com
   pki_ds_base_dn=dc=RSA-KRA
   pki_ds_database=CC-RSA-KRA-LDAP
   pki_share_db=False

2. Run the pkispawn tool to install the KRA subsystem:

   # pkispawn -s KRA -f kra_inst.cfg --debug

   This will create the KRA instance in /var/lib/pki/rhcs10-RSA-KRA.

Verification

1. Show the status of the installed KRA instance:

   # pki-server status rhcs10-RSA-KRA

   Note down the Secure Agent, Admin and pkiconsole URLs.

2. Verify that the KRA agent web page is accessible.

3. Import the KRA bootstrap administrator certificate into the nssdb:

   # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db client-cert-import --pkcs12 /opt/pki_rsa/rhcs10-RSA-KRA/kra_admin_cert.p12 --pkcs12-password SECret.123

4. Verify the sanity of the KRA by running the kra-key-request-find command. It should display certificates:

   # pki -p 28443 -d /root/.dogtag/pki_rsa_bootstrap/certs_db -n “PKI Bootstrap Administrator for RSA-KRA” kra-key-request-find

Procedure

1. Stop the KRA:

   # pki-server stop rhcs10-RSA-KRA

2. Edit the /var/lib/pki/rhcs10-RSA-KRA/kra/conf/CS.cfg configuration file and add the following three lines:
   

1. Start the KRA:

   # pki-server start rhcs10-RSA-KRA

2. Restart the SubCA:

   # pki-server restart rhcs10-RSA-SubCA

1. Create a client nssdb if it does not already exist:

   $ pki -d /home/FooUser123/certs_db -c SECret.123 client-init

2. Create a CRMF request using the KRA transport certificate:

   1. Find the KRA transport certificate serial number in the SubCA’s EE page (in this example, 0x555251b).
      Alternatively, you can also find its serial number if you know the certificate’s common name, for example:

      # pki -p 31443 ca-cert-find --name "DRM Transport Certificate"
      ---------------
      1 entries found
      ---------------
       Serial Number: 0x555251b
       Subject DN: CN=DRM Transport Certificate,OU=rhcs10-RSA-KRA,O=Example-rhcs10-RSA-KRA
       Status: VALID
      ...
      ----------------------------
      Number of entries returned 1
      ----------------------------

   2. Export the KRA transport certificate using its serial number:

      # pki -d /home/FooUser123/certs_db -c SECret.123 -p 31443 ca-cert-export 0x555251b --output-file /home/FooUser123/certs_db/kra_transport.txt

   3. Create the CRMF request using the transport certificate:

      # CRMFPopClient -d /home/FooUser123/certs_db -p SECret.123 -n "cn=FooUser123, uid=FooUser123" -q POP_SUCCESS -b /home/FooUser123/certs_db/kra_transport.txt -w "AES KeyWrap/Wrapped" -y -o /home/FooUser123/certs_db/crmf.req -oaep
      
      CryptoUtil: generateRSAKeyPair: calling kg.setKeyPairUsages
      Keypair private key id: 56906e65ef43a2e756908726758e9061d8d7ee9c
      CRMFPopClient: use_shared_secret true. Generating SubjectKeyIdentifier extension.
      Storing CRMF request into /home/FooUser123/certs_db/crmf.req
      Storing CRMF request key id into /home/FooUser123/certs_db/crmf.req.keyId

3. Generate a CMC request:

   1. Create a CMCRequest configuration file, using the CRMF request and private key id you obtained from the previous step. For example:

      # vi /home/FooUser123/certs_db/cmc-crmf-self.cfg

      ### numRequests: Total number of PKCS10 requests or CRMF requests.
      numRequests=1
      
      ### input: full path for the PKCS10 request or CRMF request,
      ### The content must be in Base-64 encoded format.
      ### Multiple files are supported. They must be separated by a space.
      input=/home/FooUser123/certs_db/crmf.req
      
      ### output: full path for the CMC request in binary format
      output=/home/FooUser123/certs_db/cmc.self.req
      
      ### tokenname: name of the token where agent signing cert can be found (default is internal)
      tokenname=internal
      request.useSharedSecret=true
      
      ### nickname: nickname for the agent certificate which will be used to sign the CMC full request.
      #nickname=
      
      ### dbdir: directory for cert8.db, key3.db and secmod.db
      dbdir=/home/FooUser123/certs_db
      
      ### password: password for cert8.db which stores the agent certificate
      password=SECret.123
      
      ### format: request format, either pkcs10 or crmf
      format=crmf
      
      ### identityProofV2.enable: if true, then the request will contain this control. Otherwise, false.
      ### Note that if both identityProof and identityProofV2 are enabled,
      ### identityProofV2 takes precedence; Only one of them can be active at a time
      ### Supported hashAlg are:
      ### SHA-256, SHA-384, and SHA-512
      ### Supported macAlg are:
      ### SHA-256-HMAC, SHA-384-HMAC, and SHA-512-HMAC
      identityProofV2.enable=true
      identityProofV2.hashAlg=SHA-512
      identityProofV2.macAlg=SHA-256-HMAC
      
      ### identityProofV2.sharedSecret: Shared Secret
      witness.sharedSecret=secretShrTokFooUser123
      
      popLinkWitnessV2.enable=true
      popLinkWitnessV2.keyGenAlg=SHA-256
      popLinkWitnessV2.macAlg=SHA-256-HMAC
      
      request.privKeyId=<output from PKCS10Client|CRMFPopClient xxx.priv>
      
      ### identification works with identityProofV2
      identification.enable=true
      identification=FooUser123

   2. Generate the request using the CMCRequest command:

      # CMCRequest /home/FooUser123/certs_db/cmc-crmf-self.cfg
      
      cert/key prefix =
      path = /home/FooUser123/certs_db
      CryptoManger initialized
      token internal logged in...
      got request privKeyId: 56906e65ef43a2e756908726758e9061d8d7ee9c
      got private key
      createPKIData: begins
      createPopLinkWitnessV2Attr: begins
      createPopLinkWitnessV2Attr: keyGenAlg=SHA-256; macAlg=SHA-256-HMAC
      createPopLinkWitnessV2Attr: Successfully created id_cmc_idPOPLinkRandom control. bpid = 1
      createPopLinkWitnessV2Attr: Successfully created PopLinkWitnessV2 control.
      createPopLinkWitnessV2Attr: returning...
      
      k=0
      createPKIData:  format: crmf
      CryptoUtil: getSKIExtensionFromCertTemplate: SKIoid == jssOID
      createPKIData:  SubjectKeyIdentifier extension found in use_shared_secret request
      createPKIData: popLinkWitnessV2 enabled. reconstructing crmf
      createNewPOP: begins
      createNewPOP: about to create POPOSigningKey
      createNewPOP: creating and returning newPopOfSigningKey
      createPKIData: new CRMF b64encode completes.
      -----BEGIN CERTIFICATE REQUEST-----
      MIIIsDCCCKwwggeQAgEBMIIBfYABAqUzMDExGjAYBgoJkiaJk/IsZAEBEwpGb29Vc2VyMTIzMRMw
      
      . . . Output omitted . . .
      
      -----END CERTIFICATE REQUEST-----
      
      identification control: identification =FooUser123
      Successfully create identification control. bpid = 1
      
      CMCRequest: addIdentityProofV2Attr: hashAlg=SHA-512; macAlg=SHA-256-HMAC
      Identity Proof V2 control:
         Value: -50 -36 103 -38 70 85 70 91 -71 96 -121 100 -127 50 -63 -57 123 -30 115 58 -55 -34 -22 104 90 -20 48 46 80 -85 64 68
      Successfully create identityProofV2 control. bpid = 2
      
      useSharedSecret is true...
      signData for useSharedSecret begins: begins:
      createSignedData: begins
      getSigningAlgFromPrivate: begins.
      getSigningAlgFromPrivate: found signingKeyType=RSA
      getSigningAlgFromPrivate: using SignatureAlgorithm: RSASignatureWithSHA256Digest
      createSignedData: digest created for pkidata
      createSignedData: digest algorithm =RSASignatureWithSHA256Digest
      getCMCBlob: begins
      getCMCBlob: generating signed data
      
      The CMC enrollment request in base-64 encoded format:
      MIILlAYJKoZIhvcNAQcCoIILhTCCC4ECAQMxDzANBglghkgBZQMEAgEFADCCCdgGCCsGAQUFBwwC
      
      . . . Output omitted . . .
      
      The CMC enrollment request in binary format is stored in /home/FooUser123/certs_db/cmc.self.req

4. Submit the CMC request:

   1. Create a HttpClient configuration file. For example:

      # vim /home/FooUser123/certs_db/HttpClient-cmc-crmf.self.cfg

      ### host: host name for the http server
      host=rhcs10.example.com
      
      ### port: port number
      port=31443
      
      ### secure: true for secure connection, false for nonsecure connection
      secure=true
      
      ### input: full path for the enrollment request, the content must be in binary format
      input=/home/FooUser123/certs_db/cmc.self.req
      
      ### output: full path for the response in binary format
      output=/home/FooUser123/certs_db/cmc.self.Resp
      
      ### tokenname: name of the token where the SSL client authentication cert can be found (default is internal)
      ### This parameter will be ignored if secure=false
      tokenname=internal
      
      ### dbdir: directory for cert8.db, key3.db and secmod.db
      ### This parameter will be ignored if secure=false
      dbdir=/home/FooUser123/certs_db
      
      ### clientmode: true for client authentication, false for no client authentication
      ### This parameter will be ignored if secure=false
      clientmode=false
      
      ### password: password for cert8.db
      ### This parameter will be ignored if secure=false and clientauth=false
      password=SECret.123
      
      ### nickname: nickname for client certificate
      ### This parameter will be ignored if clientmode=false
      nickname=
      
      ### servlet: servlet name
      servlet=/ca/ee/ca/profileSubmitCMCFull?profileId=caFullCMCSharedTokenCert

   2. Submit the request using the HttpClient command:

      # HttpClient /home/FooUser123/certs_db/HttpClient-cmc-crmf.self.cfg
      
      Total number of bytes read = 2968
      after SSLSocket created, thread token is NSS FIPS 140-2 User Private Key
      handshake happened
      writing to socket
      
      #Response Headers begin
      HTTP/1.1 200
      Content-Type: application/pkcs7-mime
      Content-Length: 4348
      Date: Thu, 08 Sep 2022 20:51:44 GMT
      Connection: close
      #end
      
      Total number of bytes read = 4348
      MIIQ+AYJKoZIhvcNAQcCoIIQ6TCCEOUCAQMxDzANBglghkgBZQMEAgEFADAxBggrBgEFBQcMA6Al
      
      . . . Output omitted . . .
      
      The response in binary format is stored in /home/FooUser123/certs_db/cmc.self.Resp

5. Process the response using the CMCResponse command:

   # CMCResponse -d /home/FooUser123/certs_db -i /home/FooUser123/certs_db/cmc.self.Resp
   
   Certificates:
       Certificate:
           Data:
               Version:  v3
               Serial Number: 0x98D0212
               Signature Algorithm: SHA256withRSA - 1.2.840.113549.1.1.11
               Issuer: CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA
               Validity:
                   Not Before: Thursday, September 8, 2022 4:51:44 PM EDT America/New_York
                   Not  After: Tuesday, March 7, 2023 4:51:44 PM EST America/New_York
               Subject: UID=FooUser123,DC=example,DC=com
               Subject Public Key Info:
                   Algorithm: RSA - 1.2.840.113549.1.1.1
                   Public Key:
                       Exponent: 65537
                       Public Key Modulus: (2048 bits) :
                           BB:F3:C6:66:AC:9E:39:02:59:B8:E7:5A:6D:9E:29:8C:
   
   . . . Output omitted . . .
   
   Number of controls is 1
   Control #0: CMCStatusInfoV2
      OID: {1 3 6 1 5 5 7 7 25}
      BodyList: 1
      Status: SUCCESS
   CMC Full Response.