红帽全球峰会20.2. 迁移 KRA
简单 KRA 迁移需要以下步骤：
位于 alpha.example.com 上的 KRA 包含数据，而位于 omega.example.com 上的 KRA 尚不存在。
| Hostname | PKI KRA 版本 |
|---|---|
| alpha.example.com | RHCS 9.7 上的 PKI KRA 10.5 |
| omega.example.com | RHCS 10.4 中的 PKI KRA 10.13 |
20.2.1. 在新主机上设置 KRA
以 root 用户身份在 omega.example.com 上：
- 在 omega.example.com 上安装和配置一个新的 PKI 10.13 KRA。
停止 KRA 实例。
# systemctl stop pki-tomcatd@<pki-kra>创建目录以导出所有必需的文件。
# mkdir -p /export/pki将 KRA 存储证书导出到文件。稍后您将需要 KRA 存储证书来重新加密 alpha 上 KRA 的解密的旧数据。在以下示例中，该文件名为
omega.crt：# cd /var/lib/pki/<pki-kra>/alias/ # pki-server cert-export kra_storage -i <pki-kra> --cert-file <omega.crt> Certificate: Data: Version: 3 (0x2) Serial Number: 8 (0x8) Signature Algorithm: sha256WithRSAEncryption Issuer: O = example.com Security Domain, OU = topology-02-CA, CN = CA Signing Certificate Validity Not Before: Dec 19 10:58:02 2019 GMT Not After : Dec 8 10:58:02 2021 GMT Subject: O = example.com Security Domain, OU = topology-02-KRA, CN = DRM Storage Certificate Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:99:c1:f6:f4:0d:75:67:ff:58:3a:28:ee:34:f1: 40:0a:e1:5b:f3:9d:f4:c2:5a:1e:d0:d5:0c:62:c1:-
将
omega.crt文件移到/export/pki目录。 停止 Directory 服务器。
# systemctl stop dirsrv@omega注意如果缺少
db2ldif，请安装389-ds-base-legacy-tools软件包。提取 KRA LDAP 数据库配置。您需要新的 KRA LDAP 数据库配置，才能将旧数据转换为新数据。
# /usr/lib64/dirsrv/slapd-omega/db2ldif -n <pki-kra-KRA> -a /tmp/omega.ldif将
/tmp/omega.ldif文件移动到/export/pki目录。# mv /tmp/omega.ldif /export/pki/
20.2.2. 从上一个系统中导出内容
以 root 用户身份在 alpha.example.com 上：
创建通用目录：
# mkdir -p /export/pki停止 Directory 服务器。在本例中，服务器名为 alpha ：
# systemctl stop dirsrv@alpha从 KRA LDAP 数据库生成 LDIF：
# /usr/lib64/dirsrv/slapd-alpha/db2ldif -n <pki-kra-KRA> -a /tmp/alpha.ldif将
/tmp/alpha.ldif文件移到/export/pki目录中：# mv /tmp/alpha.ldif /export/pki/将 KRA NSS 安全数据库复制到数据区域：
# cp -p /var/lib/pki/<pki-kra>/alias/* /export/pki/进入
/export/pki目录：# cd /export/pki从 omega.example.com 获取包含新 KRA 存储证书的 flat-file ：
sftp root@omega.example.com sftp> cd /export/pki sftp> get omega.crt sftp> quit获取内部密码：
# cat /var/lib/<instance_name>/conf/password.conf在 alpha.example.com 上运行
KRATool：# KRATool \ -kratool_config_file /usr/share/pki/java-tools/KRATool.cfg \ -source_ldif_file /export/pki/alpha.ldif \ -target_ldif_file /export/pki/alpha2omega.ldif \ -log_file /tmp/KRATool_26_05_2023.log \ -source_pki_security_database_path /export/pki/ \ -source_storage_token_name "Internal Key Storage Token" \ -source_storage_certificate_nickname "<storageCert cert-pki-tomcat KRA>" \ -target_storage_certificate_file /export/pki/omega.crt \ -source_kra_naming_context alpha.example.com \ -target_kra_naming_context omega.example.com \ -unwrap_algorithm AES \ -process_requests_and_key_records_only PROCESSING KRATOOL CONFIG FILE: ................................... FINISHED. SUCCESSFULLY processed kratool config file! Initializing source PKI security databases in '/export/pki/'. Retrieving token from CryptoManager. Retrieving source storage token called 'Internal Key Storage Token'. Retrieving source storage cert with nickname of 'storageCert cert-pki-tomcat KRA'. BEGIN: Obtaining the private key from the source storage token . . . Enter password for Internal Key Storage Token ** FINISHED: Obtaining the private key from the source storage token. BEGIN: Obtaining the public key from the target storage certificate . . . FINISHED: Obtaining the public key from the target storage certificate. PROCESSING: xxxxxxxxxxxxxxxxxxxxxxxxx...... SUCCESSFULLY converted source LDIF file --> target LDIF file! FINISHED "KRATool -kratool_config_file /usr/share/pki/java-tools/KRATool.cfg -source_ldif_file /export/pki/alpha.ldif -target_ldif_file /export/pki/alpha2omega.ldif -log_file /tmp/DRMTool_20_05_2021.log -source_pki_security_database_path /export/pki/ -source_storage_token_name 'Internal Key Storage Token' -source_storage_certificate_nickname 'storageCert cert-pki-tomcat KRA' -target_storage_certificate_file /export/pki/omega.crt -source_pki_security_database_pwdfile '/export/pki/password.cfg' -source_kra_naming_context 'alpha.example.com' -target_kra_naming_context 'omega.example.com' -process_requests_and_key_records_only"注意或者，您可以创建一个受未授权访问保护的纯文本文件，该文件仅包含证书或证书数据库自动访问的密码。使用
-source_pki_security_database_pwdfile < path_to_PKI_password_file> 命令行选项将此文件添加到KRATool中。将
alpha2omega.ldif文件复制到 omega.example.com ：sftp root@omega.example.com sftp> cd /export/pki sftp> put alpha2omega.ldif sftp> quit
20.2.3. 将数据导入到新的 KRA
以 root 用户身份在 omega.example.com 上：
前往
/export/pki目录。# cd /export/pki连接
ldif文件：# cat omega.ldif alpha2omega.ldif > omega_alpha.ldif将
omega_alpha.ldif文件导入到与 PKI KRA 关联的 LDAP 数据库中：# /usr/lib64/dirsrv/slapd-omega/ldif2db -n <pki-kra-KRA> -i /export/pki/omega_alpha.ldif启动 Directory 服务器：
# systemctl start dirsrv@omega启动 KRA 实例。
# systemctl start pki-tomcatd@<pki-kra>
20.2.4. 从 KRA Agent Page 验证迁移的密钥是否存在
最后一步是执行从 KRA Agent 页面迁移的密钥恢复。
[root@pki1 pki]# pki -d /root/nssdb/ -p 21080 -n '<PKI Administrator - example.com Security Domain>' kra-key-find
Enter password for Internal Key Storage Token
----------------
3 key(s) matched
----------------
Key ID: 0x1
Algorithm: 1.2.840.113549.1.1.1
Size: 1024
Owner: UID=alpha1
Key ID: 0x2
Algorithm: 1.2.840.113549.1.1.1
Size: 1024
Owner: UID=alpha2
Key ID: 0x3
Algorithm: 1.2.840.113549.1.1.1
Size: 1024
Owner: UID=alpha3
----------------------------
Number of entries returned 3
----------------------------20.2.5. 升级后测试
在升级前跟踪用户密钥的关键恢复操作。
流程 21.1.密钥恢复测试
显示升级前创建的 base64 用户证书。
# <pki -n 'PKI Administrator - example.com>' -c <Secret.123> ca-cert-export <0xd> Serial Number: 0xd Subject DN: UID=alpha Issuer DN: CN=CA Signing Certificate,OU=pki-tomcat,O=example.com Security Domain Status: VALID Not Valid Before: Wed Jun 07 01:49:07 EDT 2023 Not Valid After: Mon Dec 04 01:49: ----BEGIN CERTIFICATE---- MIIDODCCAiCgAwIBAgIBDTANBgkqhkiG9w0BAQsFADBtMTUwMwYDVQQKDCxpZG1xZS5sYWIuZW5n LmJvcy5yZWRoYXQuY29tIFNlY3VyaXR5IERvbWFpbjETMBEGA1UECwwKcGtpLXRvbWNhdDEfMB0G A1UEAwwWQ0EgU2lnbmluZyBDZXJ0aWZpY2F0ZTAeFw0yMzA2MDcwNTQ5MDdaFw0yMzEyMDQwNjQ5 [...output truncated...] EJyoMFM+RaAcTh+C3S0JZEoKlAS3UlJOMxk3BFZdWpv7ia+1faV6LFPZSCZ/m8i2c3KZNxFW2xv1 DTIIVc7a1uEDApVDHf5aFcm0nGpEVeK+yvP4r1eD ----END CERTIFICATE----- 使用此证书通过 KRA Agent UI 生成密钥恢复请求。
批准恢复请求。
# pki -c <Secret.123> -n '<PKI Administrator - example.com Security Domain>' -p 8443 -P https kra-key-request-review <0x2> --action approve ----- Result ------ Request ID: 0x2 Type: recovery Status: approved- 从 KRA UI 下载密钥。
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}