16.8. Managing Tokens Used by the Subsystems
Certificate System managers two groups of tokens: tokens used by the subsystems to perform PKI tasks and tokens issued through the subsystem. These management tasks refer specifically to tokens that are used by the subsystems.
For information on managing smart card tokens, see Chapter 6, Using and Configuring the Token Management System: TPS and TKS.
16.8.1. Detecting Tokens
To see if a token can be detected by Certificate System to be installed or configured, use the
TokenInfo /var/lib/pki/instance_name/alias Database Path: /var/lib/pki/instance_name/alias Found external module 'NSS Internal PKCS #11 Module'
This utility will return all tokens which can be detected by the Certificate System, not only tokens which are installed in the Certificate System.
16.8.2. Viewing Tokens
To view a list of the tokens currently installed for a Certificate System instance, use the
- Open the instance
aliasdirectory. For example:
- Show the information about the installed PKCS #11 modules installed as well as information on the corresponding tokens using the
modutil -dbdir . -nocertdb -list
16.8.3. Changing a Token's Password
The token, internal or external, that stores the key pairs and certificates for the subsystems is protected (encrypted) by a password. To decrypt the key pairs or to gain access to them, enter the token password. This password is set when the token is first accessed, usually during Certificate System installation.
It is good security practice to change the password that protects the server's keys and certificates periodically. Changing the password minimizes the risk of someone finding out the password. To change a token's password, use the
For information about
certutil, see http://www.mozilla.org/projects/security/pki/nss/tools/.
The single sign-on password cache stores token passwords in the
password.conffile. This file must be manually updated every time the token password is changed. For more information on managing passwords through the
password.conffile, see Red Hat Certificate System Planning, Installation, and Deployment Guide.