21.2. Migrating a KRA

Simple KRA migration requires the following steps:
  1. Section 21.2.1, “Setting Up the KRA on the New Host”
  2. Section 21.2.2, “Exporting Contents from the Previous System”
  3. Section 21.2.3, “Importing the Data into the New KRA”
  4. Section 21.2.4, “Validating the presence of migrated keys from the KRA Agent Page”
The KRA located on alpha.example.com contains the data, while the KRA located on omega.example.com does not exist yet.
HostnamePKI KRA Version
alpha.example.comPKI KRA 10.5 on RHCS 9.7
omega.example.comPKI KRA 10.13 on RHCS 10.4

21.2.1. Setting Up the KRA on the New Host

On omega.example.com as the root user:
  1. Install and configure a new PKI 10.13 KRA on omega.example.com.
  2. Stop the KRA instance. 
    # systemctl stop pki-tomcatd@<pki-kra>
  3. Create a directory to export all required files. 
    # mkdir -p /export/pki
  4. Export KRA storage certificates to a file. You will need the KRA storage certificate later to re-encrypt the decrypted old data from the KRA on alpha. In the following example, the file is called omega.crt: 
    # cd /var/lib/pki/<pki-kra>/alias/
# pki-server cert-export kra_storage -i <pki-kra> --cert-file <omega.crt>
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8 (0x8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = example.com Security Domain, OU = topology-02-CA, CN = CA Signing Certificate
        Validity
            Not Before: Dec 19 10:58:02 2019 GMT
            Not After : Dec  8 10:58:02 2021 GMT
        Subject: O = example.com Security Domain, OU = topology-02-KRA, CN = DRM Storage Certificate
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:99:c1:f6:f4:0d:75:67:ff:58:3a:28:ee:34:f1:
                    40:0a:e1:5b:f3:9d:f4:c2:5a:1e:d0:d5:0c:62:c1:
  5. Move the omega.crt file to the /export/pki directory. 
    # mv omega.crt /export/pki/
  6. Stop the Directory Server. 
    # systemctl stop dirsrv@omega

    Note

    If db2ldif is missing, install the 389-ds-base-legacy-tools package.
  7. Extract the KRA LDAP database configurations. You will need the new KRA LDAP database configurations for transforming the old data to the new. 
    # /usr/lib64/dirsrv/slapd-omega/db2ldif -n <pki-kra-KRA> -a /tmp/omega.ldif
  8. Move the /tmp/omega.ldif file to the /export/pki directory. 
    # mv /tmp/omega.ldif /export/pki/

21.2.2. Exporting Contents from the Previous System

On alpha.example.com as the root user:
  1. Create a common directory: 
    # mkdir -p /export/pki
  2. Stop the Directory Server. In this example, the server is named alpha: 
    # systemctl stop dirsrv@alpha
  3. Generate the LDIF from the KRA LDAP database: 
    # /usr/lib64/dirsrv/slapd-alpha/db2ldif -n <pki-kra-KRA> -a /tmp/alpha.ldif
  4. Move the /tmp/alpha.ldif file to /export/pki directory: 
    # mv /tmp/alpha.ldif /export/pki/
  5. Copy the KRA NSS security databases to the data area: 
    # cp -p /var/lib/pki/<pki-kra>/alias/* /export/pki/
  6. Go to the /export/pki directory: 
    # cd /export/pki
  7. Obtain the flat-file containing the new KRA’s storage certificate from omega.example.com: 
    sftp root@omega.example.com
sftp> cd /export/pki
sftp> get omega.crt
sftp> quit
  8. Obtain the internal password: 
    # cat /var/lib/<instance_name>/conf/password.conf
  9. Run the KRATool on alpha.example.com: 
    # KRATool \
    -kratool_config_file /usr/share/pki/java-tools/KRATool.cfg \
    -source_ldif_file /export/pki/alpha.ldif \
    -target_ldif_file /export/pki/alpha2omega.ldif \
    -log_file /tmp/KRATool_26_05_2023.log \
    -source_pki_security_database_path /export/pki/ \
    -source_storage_token_name "Internal Key Storage Token" \
    -source_storage_certificate_nickname "<storageCert cert-pki-tomcat KRA>" \
    -target_storage_certificate_file /export/pki/omega.crt \
    -source_kra_naming_context alpha.example.com \
    -target_kra_naming_context omega.example.com \
    -unwrap_algorithm AES \
    -process_requests_and_key_records_only

PROCESSING KRATOOL CONFIG FILE: ................................... FINISHED.
SUCCESSFULLY processed kratool config file!
Initializing source PKI security databases in '/export/pki/'.
Retrieving token from CryptoManager.
Retrieving source storage token called 'Internal Key Storage Token'.
Retrieving source storage cert with nickname of 'storageCert cert-pki-tomcat KRA'.

BEGIN: Obtaining the private key from the source storage token . . .
Enter password for Internal Key Storage Token
************

FINISHED: Obtaining the private key from the source storage token.
BEGIN: Obtaining the public key from the target storage certificate . . .
FINISHED: Obtaining the public key from the target storage certificate.
PROCESSING: xxxxxxxxxxxxxxxxxxxxxxxxx......
SUCCESSFULLY converted source LDIF file --> target LDIF file!

FINISHED "KRATool -kratool_config_file /usr/share/pki/java-tools/KRATool.cfg -source_ldif_file /export/pki/alpha.ldif -target_ldif_file /export/pki/alpha2omega.ldif -log_file /tmp/DRMTool_20_05_2021.log -source_pki_security_database_path /export/pki/ -source_storage_token_name 'Internal Key Storage Token' -source_storage_certificate_nickname 'storageCert cert-pki-tomcat KRA' -target_storage_certificate_file /export/pki/omega.crt -source_pki_security_database_pwdfile '/export/pki/password.cfg' -source_kra_naming_context 'alpha.example.com' -target_kra_naming_context 'omega.example.com' -process_requests_and_key_records_only"

    Note

    Alternatively, you can create a plain-text file protected from unauthorized access containing one and only password that will be automatically accessed by a certificate or a certificate database. Add this file to KRATool with the -source_pki_security_database_pwdfile <path_to_PKI_password_file> command-line option.
  10. Copy the alpha2omega.ldif file to omega.example.com: 
    sftp root@omega.example.com
sftp> cd /export/pki
sftp> put alpha2omega.ldif
sftp> quit

21.2.3. Importing the Data into the New KRA

On omega.example.com as the root user:
  1. Go to /export/pki directory 
    # cd /export/pki
  2. Concatenate the ldif files: 
    # cat omega.ldif alpha2omega.ldif > omega_alpha.ldif
  3. Import the omega_alpha.ldif file into the LDAP database associated with the PKI KRA: 
    # /usr/lib64/dirsrv/slapd-omega/ldif2db -n <pki-kra-KRA> -i /export/pki/omega_alpha.ldif
  4. Start the Directory Server: 
    # systemctl start dirsrv@omega
  5. Start the KRA instance. 
    # systemctl start pki-tomcatd@<pki-kra>

21.2.4. Validating the presence of migrated keys from the KRA Agent Page

The last step is to perform key recovery of migrated keys from the KRA Agent page. 
[root@pki1 pki]# pki -d /root/nssdb/ -p 21080 -n '<PKI Administrator - example.com Security Domain>' kra-key-find
Enter password for Internal Key Storage Token

----------------
3 key(s) matched
----------------
  Key ID: 0x1
  Algorithm: 1.2.840.113549.1.1.1
  Size: 1024
  Owner: UID=alpha1

  Key ID: 0x2
  Algorithm: 1.2.840.113549.1.1.1
  Size: 1024
  Owner: UID=alpha2

  Key ID: 0x3
  Algorithm: 1.2.840.113549.1.1.1
  Size: 1024
  Owner: UID=alpha3
----------------------------
Number of entries returned 3
----------------------------

21.2.5. Post-Upgrade Testing

Follow the key recovery operation for user key archived before upgrade.

Procedure 21.1. Key Recovery Test

  1. Display the base64 user certificate created before upgrade. 
    # <pki -n 'PKI Administrator - example.com>' -c <Secret.123> ca-cert-export <0xd>
  Serial Number: 0xd
  Subject DN: UID=alpha
  Issuer DN: CN=CA Signing Certificate,OU=pki-tomcat,O=example.com Security Domain
  Status: VALID
  Not Valid Before: Wed Jun 07 01:49:07 EDT 2023
  Not Valid After: Mon Dec 04 01:49:07 EST 2023

----BEGIN CERTIFICATE----
MIIDODCCAiCgAwIBAgIBDTANBgkqhkiG9w0BAQsFADBtMTUwMwYDVQQKDCxpZG1xZS5sYWIuZW5n
LmJvcy5yZWRoYXQuY29tIFNlY3VyaXR5IERvbWFpbjETMBEGA1UECwwKcGtpLXRvbWNhdDEfMB0G
A1UEAwwWQ0EgU2lnbmluZyBDZXJ0aWZpY2F0ZTAeFw0yMzA2MDcwNTQ5MDdaFw0yMzEyMDQwNjQ5

            [...output truncated...]

EJyoMFM+RaAcTh+C3S0JZEoKlAS3UlJOMxk3BFZdWpv7ia+1faV6LFPZSCZ/m8i2c3KZNxFW2xv1
DTIIVc7a1uEDApVDHf5aFcm0nGpEVeK+yvP4r1eD
----END CERTIFICATE----
  2. Use this certificate to generate a key recovery request through KRA Agent UI.
  3. Approve the recovery request. 
    # pki -c <Secret.123> -n '<PKI Administrator - example.com Security Domain>' -p 8443 -P https kra-key-request-review <0x2> --action approve
-----
Result
------
Request ID: 0x2
Type: recovery
Status: approved
  4. Download the key from the KRA UI.