10.2. Cloning a CA
- Configure the master CA, and back up the keys.
- In the
CS.cfgfile for the master CA, enable the master CA to monitor replication database changes by adding the
- Create the clone subsystem instance.For examples of the configuration file required by
pkispawnwhen cloning CA subsystems, see the
Installing a CA cloneand
Installing a CA clone on the same hostsections of the pkispawn(8) man page.
- Restart the Directory Server instance used by the clone.
systemctl restart firstname.lastname@example.org
NoteRestarting the Directory Server reloads the updated schema, which is required for proper performance.
- Restart the clone instance.
systemctl restart pki-tomcatd@instance_name.service
After configuring the clone, test to make sure that the master-clone relationship is functioning:
- Request a certificate from the cloned CA.
- Approve the request.
- Download the certificate to the browser.
- Revoke the certificate.
- Check master CA's CRL for the revoked certificate. In the master Certificate Manager's agent services page, click Update Certificate Revocation List. Find the CRL in the list.The CRL should show the certificate revoked by the cloned Certificate Manager. If that certificate is not listed, check logs to resolve the problem.