Installing CA Clone with Replicated DS

Overview

This page describes the process to install CA clone with existing DS instance which has been set up as a replica of the DS instance used by the primary CA.

Availability: Since PKI 11.5

Prerequisites

• A primary DS has been installed.

• A primary CA has been installed using the primary DS.

• A secondary DS has been installed.

Creating Secondary CA

Create the secondary CA with the following commands:

$ pki-server create
$ pki-server nss-create
$ pki-server ca-create

Clone System Certificates and Keys

Export the system certificates and keys from primary CA with the following commands:

$ pki-server ca-clone-prepare \
    --pkcs12-file ca-certs.p12 \
    --pkcs12-password Secret.123

$ pki-server cert-export ca_signing \
    --cert-file ca_signing.crt

Optionally, the CSRs for the above certificates can be exported as well with the following commands:

$ pki-server cert-export ca_signing \
    --csr-file ca_signing.csr

$ pki-server cert-export ca_ocsp_signing \
    --csr-file ca_ocsp_signing.csr

$ pki-server cert-export ca_audit_signing \
    --csr-file ca_audit_signing.csr

$ pki-server cert-export subsystem \
    --csr-file subsystem.csr

Import the system certificates and keys into the secondary CA with the following command:

$ pki \
    -d /var/lib/pki/pki-tomcat/conf/alias \
    -f /var/lib/pki/pki-tomcat/conf/password.conf \
    pkcs12-import \
    --pkcs12 ca-certs.p12 \
    --password Secret.123

Setting up Secondary DS

First, configure DS connection in the secondary CA with the following commands:

$ pki-server password-add \
    --password Secret.123 \
    internaldb

$ pki-server ca-db-config-mod \
    --hostname secondaryds.example.com \
    --port 3389 \
    --secure false \
    --auth BasicAuth \
    --bindDN "cn=Directory Manager" \
    --bindPWPrompt internaldb \
    --database ca \
    --baseDN dc=ca,dc=pki,dc=example,dc=com \
    --multiSuffix false \
    --maxConns 15 \
    --minConns 3

Create a DS backend with the following command:

$ pki-server ca-db-create

Configure replication between the primary DS and the secondary DS.

Once the schema and entries are replicated, create search indexes with the following commands:

$ pki-server ca-db-index-add
$ pki-server ca-db-index-rebuild

Create VLV indexes with the following commands:

$ pki-server ca-db-vlv-add
$ pki-server ca-db-vlv-reindex

Finalize Secondary CA Installation

Prepare a deployment configuration (e.g. ca-clone.cfg) to deploy CA subsystem clone.

A sample deployment configuration is available at /usr/share/pki/server/examples/installation/ca-clone.cfg. It assumes that the primary CA subsystem is running at https://primary.example.com:8443, the CA signing certificate has been exported into ca_signing.crt, and the admin certificate and key have been exported into ca_admin_cert.p12. The PKCS #12 password is specified in the pki_client_pkcs12_password parameter.

To finalize the secondary CA installation execute the following command:

$ pkispawn \
    -f /usr/share/pki/server/examples/installation/ca-clone.cfg \
    -s CA \
    -D pki_cert_chain_path=ca_signing.crt \
    -D pki_clone_pkcs12_path=ca-certs.p12 \
    -D pki_clone_pkcs12_password=Secret.123 \
    -D pki_ds_url=ldap://secondaryds.example.com:389 \
    -D pki_ds_setup=False \
    -v

If the CSRs are available, they can be specified with the following parameters:

    -D pki_ca_signing_csr_path=ca_signing.csr \
    -D pki_ocsp_signing_csr_path=ca_ocsp_signing.csr \
    -D pki_audit_signing_csr_path=ca_audit_signing.csr \
    -D pki_subsystem_csr_path=subsystem.csr \