Exporting KRA System Certificates - dogtagpki/pki GitHub Wiki
This page describes the process to export KRA system certificates, the keys, and the CSRs.
To export the certificates without their keys into separate files execute the following commands:
$ pki-server cert-export kra_storage --cert-file kra_storage.crt $ pki-server cert-export kra_transport --cert-file kra_transport.crt $ pki-server cert-export kra_audit_signing --cert-file kra_audit_signing.crt $ pki-server cert-export subsystem --cert-file subsystem.crt $ pki-server cert-export sslserver --cert-file sslserver.crt
To export the certificates with their keys into a PKCS #12 file execute the following command:
$ pki \
-d /var/lib/pki/pki-tomcat/conf/alias \
-f /var/lib/pki/pki-tomcat/conf/password.conf \
pkcs12-export \
--pkcs12 kra-certs.p12 \
--password Secret.123 \
kra_storage \
kra_transport \
kra_audit_signing \
subsystem \
sslserver
In PKI 11.5 or later the CSRs can be obtained directly from the /var/lib/pki/pki-tomcat/conf/certs folder:
-
kra_storage.csr -
kra_transport.csr -
kra_audit_signing.csr -
subsystem.csr -
sslserver.csr
In older PKI versions the CSRs need to be exported with the following commands:
$ echo "-----BEGIN CERTIFICATE REQUEST-----" > kra_storage.csr $ sed -n "/^kra.storage.certreq=/ s/^[^=]*=// p" < /var/lib/pki/pki-tomcat/conf/kra/CS.cfg >> kra_storage.csr $ echo "-----END CERTIFICATE REQUEST-----" >> kra_storage.csr $ echo "-----BEGIN CERTIFICATE REQUEST-----" > kra_transport.csr $ sed -n "/^kra.transport.certreq=/ s/^[^=]*=// p" < /var/lib/pki/pki-tomcat/conf/kra/CS.cfg >> kra_transport.csr $ echo "-----END CERTIFICATE REQUEST-----" >> kra_transport.csr $ echo "-----BEGIN CERTIFICATE REQUEST-----" > kra_audit_signing.csr $ sed -n "/^kra.audit_signing.certreq=/ s/^[^=]*=// p" < /var/lib/pki/pki-tomcat/conf/kra/CS.cfg >> kra_audit_signing.csr $ echo "-----END CERTIFICATE REQUEST-----" >> kra_audit_signing.csr $ echo "-----BEGIN CERTIFICATE REQUEST-----" > subsystem.csr $ sed -n "/^kra.subsystem.certreq=/ s/^[^=]*=// p" < /var/lib/pki/pki-tomcat/conf/kra/CS.cfg >> subsystem.csr $ echo "-----END CERTIFICATE REQUEST-----" >> subsystem.csr $ echo "-----BEGIN CERTIFICATE REQUEST-----" > sslserver.csr $ sed -n "/^kra.sslserver.certreq=/ s/^[^=]*=// p" < /var/lib/pki/pki-tomcat/conf/kra/CS.cfg >> sslserver.csr $ echo "-----END CERTIFICATE REQUEST-----" >> sslserver.csr