Red Hat Summit Red Hat SummitSuporteConsoleDesenvolvedoresComeçar um testeContato

Este conteúdo não está disponível no idioma selecionado.

Chapter 23. Migrating an OpenSSL CA to Certificate System

Red Hat Certificate System provides a mechanism to migrate an existing OpenSSL Certificate Authority (CA) to a new Certificate System CA that uses the existing CA signing key.

Note

The migration of Certificate System 8 to 9 is a special implementation of this procedure and is described in Chapter 22, Migrating From Certificate System 8 to 9.
Depending on your environment, see:

23.1. Migrating an OpenSSL CA to Certificate System When Not Using an HSM
Copiar o link

  1. Create a file with a password that will be used in the next step. For example: 
    # echo password > ~/password.txt
    Copy to Clipboard Toggle word wrap
  2. Import the OpenSSL CA certificate and key into a PKCS #12 file using the openssl pkcs12 command. Use the following options:
    • -export instructs the openssl command to export the data.
    • -in path_to_ca_certificate sets the path to the OpenSSL CA certificate.
    • -inkey path_to_CA_signing_key sets the path to the OpenSSL CA signing key.
    • -out path_to_PKCS_#12_file sets the path to the PKCS #12 file in which the output is stored.
    • -name "friendly_name" sets the friendly name of the certificate and key.
    • -passout file:path_to_password_file sets the path to the text file that contains the password used to encrypt the PKCS #12 file.
    For example, to export the OpenSSL CA certificate and key into the ~/ca.p12 file: 
    # openssl pkcs12 -export -in ~/ca.crt -inkey ~/ca.key -out ~/ca.p12 \
     -name "CA Certificate" -passout file:~/password.txt
    Copy to Clipboard Toggle word wrap
  3. Initialize a password protected Network Security Services (NSS) database for the Public Key Infrastructure (PKI) command-line interface. For example: 
    # pki -c password client-init
    Copy to Clipboard Toggle word wrap
  4. Set the CTu,Cu,Cu trust flags for the CA certificate with the CA Certificate nick name stored in the ~/ca.12 file using the password in the ~/password.txt file: 
    # pki pkcs12-cert-mod --pkcs12-file ~/ca.p12 "CA Certificate" \
     --pkcs12-password-file ~/password.txt --trust-flags "CTu,Cu,Cu"
    Copy to Clipboard Toggle word wrap

    Important

    Enter the trust flags without spaces.
  5. Display the CA certificate stored in the ~/ca.p12 file: 
    # pki pkcs12-cert-find --pkcs12-file ~/ca.p12 \
     --pkcs12-password-file ~/password.txt
---------------
1 entries found
--------------
  Certificate ID: 9311084d08b37d12e856b904b7e52eb3b1cece4a
  Serial Number: 0xe3f2b350edcd875c
  Nickname: CA Certificate
  Subject DN: O=Example,CN=CA Certificate
  Issuer DN: O=Example,CN=CA Certificate
  Trust Flags: CTu,Cu,Cu
  Has Key: true
    Copy to Clipboard Toggle word wrap
  6. Display the CA signing key stored in the ~/ca.p12 file: 
    # pki pkcs12-key-find --pkcs12-file ~/ca.p12 \
     --pkcs12-password-file ~/password.txt
---------------
1 entries found
---------------
  Key ID: 9311084d08b37d12e856b904b7e52eb3b1cece4a
  Subject DN: CA Certificate
  Algorithm: RSA
    Copy to Clipboard Toggle word wrap
  7. Copy the following files to the new Certificate System host:
    • OpenSSL CA Signing Certificate Request (CSR)
    • OpenSSL CA certificate chain (if available)
    • PKCS #12 file that contains the OpenSSL CA signing certificate and key
    • Password file used to protect the PKCS #12 file
    For example, to copy the files using secure copy: 
    # scp ~/ca.csr ~/certificate_chain.p7b ~/ca.p12 ~/password.txt new_server:~/
    Copy to Clipboard Toggle word wrap
  8. Set up the CA on the new host. For details, see Section 22.2, “Setting up the CA on the New Host”.
After the migration, you can deactivate the OpenSSL CA or run it in read-only mode, where it only responds to Online Certificate Status Protocol (OCSP) requests.
Voltar ao topo
Red Hat logoGithubredditYoutubeTwitter

Aprender

Experimente, compre e venda

Comunidades

Sobre a documentação da Red Hat

Ajudamos os usuários da Red Hat a inovar e atingir seus objetivos com nossos produtos e serviços com conteúdo em que podem confiar. Explore nossas atualizações recentes.

Tornando o open source mais inclusivo

A Red Hat está comprometida em substituir a linguagem problemática em nosso código, documentação e propriedades da web. Para mais detalhes veja o Blog da Red Hat.

Sobre a Red Hat

Fornecemos soluções robustas que facilitam o trabalho das empresas em plataformas e ambientes, desde o data center principal até a borda da rede.

Theme

© 2025 Red Hat