10.6. Cloning TKS Subsystems

  1. Configure the master subsystem and back up the keys.
  2. Create the clone subsystem instance using the pkispawn utility. 
    $ pkispawn -s <subsystem> -f myconfig.txt
    An example of the configuration file required by pkispawn when cloning TKS subsystems: 
    [DEFAULT]
pki_admin_password=<Secret.123>
pki_client_database_password=<Secret.123>
pki_client_pkcs12_password=<Secret.123>
pki_ds_password=<Secret.123>
pki_security_domain_password=<Secret.123>
pki_security_domain_hostname=<master_ca_hostname>
pki_security_domain_https_port=<master_ca_https_port>
pki_security_domain_user=caadmin

[TKS]
pki_clone=True
pki_clone_pkcs12_password=<Secret.123>
pki_clone_pkcs12_path=<path_to_pkcs12_file>
pki_clone_replicate_schema=True
pki_clone_uri=https://<master_subsystem_host:master_subsystem_https_port>
pki_issuing_ca=https://<ca_hostname:ca_https_port>
  3. Restart the clone instance. 
    # pki-server restart instance_name
For the TKS, enroll a smart card and then run an ldapsearch to make sure that the same key information is contained in both databases.