10.5. Cloning KRA Subsystems

  1. Configure the master subsystem and back up the keys.
  2. Create the clone subsystem instance using the pkispawn utility: 
    $ pkispawn -s <subsystem> -f myconfig.txt
    An example of the configuration file required by pkispawn when cloning KRA subsystems: 
    [DEFAULT]
pki_admin_password=<Secret.123>
pki_client_database_password=<Secret.123>
pki_client_pkcs12_password=<Secret.123>
pki_ds_password=<Secret.123>
pki_security_domain_password=<Secret.123>
pki_security_domain_hostname=<master_ca_hostname>
pki_security_domain_https_port=<master_ca_https_port>
pki_security_domain_user=caadmin

[KRA]
pki_clone=True
pki_clone_pkcs12_password=<Secret.123>
pki_clone_pkcs12_path=<path_to_pkcs12_file>
pki_clone_replicate_schema=True
pki_clone_uri=https://<master_subsystem_host:master_subsystem_https_port>
pki_issuing_ca=https://<ca_hostname:ca_https_port>
  3. Restart the Directory Server instance used by the clone. 
    # systemctl dirsrv@instance_name.service

    Note

    Restarting the Directory Server reloads the updated schema, which is required for proper performance.
  4. Restart the clone instance. 
    # pki-server restart instance_name
For the KRA clone, test to make sure that the master-clone relationship is functioning:
  1. Go to the KRA agent's page.
  2. Click List Requests.
  3. Select Show all requests for the request type and status.
  4. Click Submit.
  5. Compare the results from the cloned KRA and the master KRA. The results ought to be identical.