KRATool(1)

📦
version 11.7.1 · 3 versions
, in centos-stream 9, ubuntu jammy

✨ KRATool(1) ✨

Okay bestie, welcome to the PKI Key Recovery Authority (KRA) Tool manual 💖 It's giving tech-nerd heaven and I'm so here for it 🧚

✨ NAME ✨

KRATool is a command-line utility that exports private keys from one or more KRA instances (usually the old-school ones) into a KRA instance (usually the modern one) 🦋 While it's moving the keys around, KRATool can rewrap keys, renumber keys, or literally both 💅

✨ SYNOPSIS ✨

Okay so here's the vibe for rewrapping keys 🎀

KRATool -kratool_config_file <tool_config_file>
     -source_ldif_file <original_ldif_file>
     -target_ldif_file <newinstance_ldif_file>
     -log_file <tool_log_file>
     [-source_pki_security_database_path <nss_database>
     -source_storage_token_name <token>
     -source_storage_certificate_nickname <storage_certificate_nickname>
     -target_storage_certificate_file <new_ASCII_storage_cert>
     [-source_pki_security_database_pwdfile <password_file>]
     [-source_kra_naming_context <name> -target_kra_naming_context <name>]
     [-process_requests_and_key_records_only]
     [-unwrap_algorithm AES|DES3]

And here's the vibe for renumbering keys ✨

KRATool -kratool_config_file <tool_config_file>
     -source_ldif_file <original_ldif_file>
     -target_ldif_file <newinstance_ldif_file>
     -log_file <tool_log_file>
     [-append_id_offset <prefix_to_add> | -remove_id_offset <prefix_to_remove>]
     [-source_kra_naming_context <name> -target_kra_naming_context <name>]
     [-process_requests_and_key_records_only]

✨ DESCRIPTION ✨

The KRATool command is your go-to for rewrapping keys, renumbering keys, or doing both 🌸 Okay so, some private keys (mainly in older deployments) got wrapped in SHA-1, 1024-bit storage keys when they were archived in the Key Recovery Authority (KRA). Those algorithms have gotten less secure as processor speeds improve and algorithms get broken 💀 For safety, you can rewrap the private keys in a new, stronger storage key (SHA-256, 2048-bit keys) 🔥

Note: Because KRATool can export private keys from one KRA, rewrap them with a new storage key, and then import them into a new KRA, this tool can be part of the process of combining multiple KRA instances into a single KRA 👑

✨ OPTIONS ✨

The following parameters are mandatory for both rewrapping and renumbering keys 🍓

  • -kratool_config_file <tool_config_file> — This is the complete path and filename of the config file the tool uses 🎀 It tells the tool how to handle certain parameters in the existing key records, whether to apply formatting changes (like changing the naming context or adding an offset), or even whether to update the modify date. The config file is required, and a default one comes with the tool. The file format is covered in the section entitled Configuration File (.cfg) 💜
  • -source_ldif_file <original_ldif_file> — The complete path and filename of the LDAP Data Interchange Format (LDIF) file that holds all of the key data from the old KRA 🌈
  • -target_ldif_file <newinstance_ldif_file> — The complete path and filename of the LDIF file where the tool will write all of the key data for the new KRA. The tool creates this file as it runs ✨
  • -log_file <tool_log_file> — The path and filename of the log file where the tool records its progress and messages. The tool creates this file as it runs 📝

The following parameters are optional for both rewrapping and renumbering keys 🌸

  • -source_kra_naming_context <name> — The naming context of the original KRA instance, which is the Distinguished Name (DN) element that refers to the original KRA 🦋 Key-related LDIF entries have a DN with the KRA instance name in it, like cn=1,ou=kra,ou=requests,dc=alpha.example.com-pki-kra. The naming context for that entry is the DN value, alpha.example.com-pki-kra. These entries can be renamed automatically, from the old KRA instance naming context to the new KRA instance naming context. This one is optional, but it's highly recommended because the LDIF file doesn't have to be edited before it's imported into the target KRA 🫶 If you use this argument, you must also use -target_kra_naming_context.
  • -target_kra_naming_context <name> — The naming context of the new KRA instance, which is the name the original key entries should be changed to 👑 Key-related LDIF entries have a DN with the KRA instance name in it, like cn=1,ou=kra,ou=requests,dc=omega.example.com-pki-kra. The naming context for that entry is the DN value, omega.example.com-pki-kra. These entries can be renamed automatically, from the old KRA instance to the new KRA instance naming context. This one is optional, but it's recommended because the LDIF file doesn't have to be edited before it's imported into the target KRA 💅 If you use this argument, you must also use -source_kra_naming_context.
  • -process_requests_and_key_records_only — Removes configuration entries from the source LDIF file, so only the key and request entries are left 🧚 This one is optional, but it's recommended because the LDIF file doesn't have to be edited before it's imported into the target KRA 🙈

Okay so the fun part is that most of that info just floats right through the script untouched 🫶 It gets dropped into the new target KRA exactly as it was, no cap. 🦋 But some attributes need a glow-up, like the Common Name (CN) and DN, which have to change to match the new KRA instance 💖 The fields that are safe to change are listed in the configuration file for each type of key entry. ✨ And bestie, anything that isn't listed gets left alone under any circumstances 🙅‍♀️

If a field should be edited (meaning the tool can update the record ID number or rename the entry), you set its value to true in the configuration file 💅 For example, this config updates the CN, DN, ID number, last modified date, and associated entry notes for all CA enrollment requests 🎀

kratool.ldif.caEnrollmentRequest.cn=true
kratool.ldif.caEnrollmentRequest.dateOfModify=true
kratool.ldif.caEnrollmentRequest.dn=true
kratool.ldif.caEnrollmentRequest.extdata.keyRecord=true
kratool.ldif.caEnrollmentRequest.extdata.requestNotes=true
kratool.ldif.caEnrollmentRequest.requestId=true

So if a line is true, the attribute gets processed in the LDIF file 🌸 By default, every possible attribute gets processed, so it's giving "everything gets a makeover" 👑 If you set a line to false, the KRATool skips that attribute and passes the value through unchanged 🙈 For example, this leaves the last modified time alone so it doesn't update every time the KRATool runs 🧚

kratool.ldif.caEnrollmentRequest.dateOfModify=false

NOTE: Key enrollments, records, and requests all have an optional notes attribute where admins can jot down notes about the process 📝 When the KRATool runs, it either adds to that notes attribute or creates it, with info about the tool running, what operations were performed, and a timestamp ⏰ It's giving very detailed diary energy, iykyk 💜

extdata-requestnotes: [20110701150056Z]: REWRAPPED the 'existing DES3 symmetric
 session key' with the '2048-bit RSA public key' obtained from the target storage
  certificate + APPENDED ID offset '100000000000' + RENAMED source KRA naming con
 text 'alpha.example.com-pki-kra' to target KRA naming context 'omega.example.com
 -pki-kra' + PROCESSED requests and key records ONLY!

This info is super useful for both audit and maintenance of the KRA, so it's lowkey essential to keep the extdata.requestNotes parameter set to true for all of the key record types 🔥 Bestie, trust me on this one 🫶

IMPORTANT: Every parameter line in the default kratool.cfg must be present in the .cfg file used when the tool is invoked 💀 No line can be omitted, and every line must have a valid value (true or false). If the file isn't properly formatted, the KRATool will fail 😭

The formatting of the .cfg file is the same as the formatting used in the instance CS.cfg files 💖

A default .cfg file comes included with the KRATool script 🎀 That file (shown in the example entitled Default kratool.cfg File) can be copied and edited into a custom file, or edited directly and used with the tool 🦋 Choose your own adventure, queen 👑✨

🎀 Default kratool.cfg File 🎀

Okay bestie, this is the default config, and it's basically a giant list of kratool.ldif.<record> settings 💅 Each one is set to true, and the chunks of # boxes are warnings that tell you what KRATOOL must never touch 🙈

kratool.ldif.caEnrollmentRequest._000=########################################
kratool.ldif.caEnrollmentRequest._001=##     KRA CA Enrollment Request      ##
kratool.ldif.caEnrollmentRequest._002=########################################
kratool.ldif.caEnrollmentRequest._003=##                                    ##
kratool.ldif.caEnrollmentRequest._004=##  NEVER allow 'KRATOOL' the ability ##
kratool.ldif.caEnrollmentRequest._005=##  to change the CA 'naming context' ##
kratool.ldif.caEnrollmentRequest._006=##  data in the following fields:     ##
kratool.ldif.caEnrollmentRequest._007=##                                    ##
kratool.ldif.caEnrollmentRequest._008=##    extdata-auth--005ftoken;uid     ##
kratool.ldif.caEnrollmentRequest._009=##    extdata-auth--005ftoken;userid  ##
kratool.ldif.caEnrollmentRequest._010=##    extdata-updatedby               ##
kratool.ldif.caEnrollmentRequest._011=##                                    ##
kratool.ldif.caEnrollmentRequest._012=##  NEVER allow 'KRATOOL' the ability ##
kratool.ldif.caEnrollmentRequest._013=##  to change CA 'numeric' data in    ##
kratool.ldif.caEnrollmentRequest._014=##  the following fields:             ##
kratool.ldif.caEnrollmentRequest._015=##                                    ##
kratool.ldif.caEnrollmentRequest._016=##    extdata-requestId               ##
kratool.ldif.caEnrollmentRequest._017=##                                    ##
kratool.ldif.caEnrollmentRequest._018=########################################
kratool.ldif.caEnrollmentRequest.cn=true
kratool.ldif.caEnrollmentRequest.dateOfModify=true
kratool.ldif.caEnrollmentRequest.dn=true
kratool.ldif.caEnrollmentRequest.extdata.keyRecord=true
kratool.ldif.caEnrollmentRequest.extdata.requestNotes=true
kratool.ldif.caEnrollmentRequest.requestId=true
kratool.ldif.caKeyRecord._000=#########################################
kratool.ldif.caKeyRecord._001=##          KRA CA Key Record          ##
kratool.ldif.caKeyRecord._002=#########################################
kratool.ldif.caKeyRecord._003=##                                     ##
kratool.ldif.caKeyRecord._004=##  NEVER allow 'KRATOOL' the ability  ##
kratool.ldif.caKeyRecord._005=##  to change the CA 'naming context'  ##
kratool.ldif.caKeyRecord._006=##  data in the following fields:      ##
kratool.ldif.caKeyRecord._007=##                                     ##
kratool.ldif.caKeyRecord._008=##    archivedBy                       ##
kratool.ldif.caKeyRecord._009=##                                     ##
kratool.ldif.caKeyRecord._010=#########################################
kratool.ldif.caKeyRecord.cn=true
kratool.ldif.caKeyRecord.dateOfModify=true
kratool.ldif.caKeyRecord.dn=true
kratool.ldif.caKeyRecord.privateKeyData=true
kratool.ldif.caKeyRecord.serialno=true
kratool.ldif.namingContext._000=############################################
kratool.ldif.namingContext._001=##       KRA Naming Context Fields        ##
kratool.ldif.namingContext._002=############################################
kratool.ldif.namingContext._003=##                                        ##
kratool.ldif.namingContext._004=##  NEVER allow 'KRATOOL' the ability to  ##
kratool.ldif.namingContext._005=##  change the CA 'naming context' data   ##
kratool.ldif.namingContext._006=##  in the following 'non-KeyRecord /     ##
kratool.ldif.namingContext._007=##  non-Request' fields (as these records ##
kratool.ldif.namingContext._008=##  should be removed via the option to   ##
kratool.ldif.namingContext._009=##  process requests and key records only ##
kratool.ldif.namingContext._010=##  if this is a KRA migration):          ##
kratool.ldif.namingContext._011=##                                        ##
kratool.ldif.namingContext._012=##    cn                                  ##
kratool.ldif.namingContext._013=##    sn                                  ##
kratool.ldif.namingContext._014=##    uid                                 ##
kratool.ldif.namingContext._015=##    uniqueMember                        ##
kratool.ldif.namingContext._016=##                                        ##
kratool.ldif.namingContext._017=##  NEVER allow 'KRATOOL' the ability to  ##
kratool.ldif.namingContext._018=##  change the KRA 'naming context' data  ##
kratool.ldif.namingContext._019=##  in the following 'non-KeyRecord /     ##
kratool.ldif.namingContext._020=##  non-Request' fields (as these records ##
kratool.ldif.namingContext._021=##  should be removed via the option to   ##
kratool.ldif.namingContext._022=##  process requests and key records only ##
kratool.ldif.namingContext._023=##  if this is a KRA migration):          ##
kratool.ldif.namingContext._024=##                                        ##
kratool.ldif.namingContext._025=##      dc                                ##
kratool.ldif.namingContext._026=##      dn                                ##
kratool.ldif.namingContext._027=##      uniqueMember                      ##
kratool.ldif.namingContext._028=##                                        ##
kratool.ldif.namingContext._029=##  NEVER allow 'KRATOOL' the ability to  ##
kratool.ldif.namingContext._030=##  change the TPS 'naming context' data  ##
kratool.ldif.namingContext._031=##  in the following 'non-KeyRecord /     ##
kratool.ldif.namingContext._032=##  non-Request' fields (as these records ##
kratool.ldif.namingContext._033=##  should be removed via the option to   ##
kratool.ldif.namingContext._034=##  process requests and key records only ##
kratool.ldif.namingContext._035=##  if this is a KRA migration):          ##
kratool.ldif.namingContext._036=##                                        ##
kratool.ldif.namingContext._037=##    uid                                 ##
kratool.ldif.namingContext._038=##    uniqueMember                        ##
kratool.ldif.namingContext._039=##                                        ##
kratool.ldif.namingContext._040=##  If '-source_naming_context            ##
kratool.ldif.namingContext._041=##  <original source KRA naming context>' ##
kratool.ldif.namingContext._042=##  and '-target_naming_context           ##
kratool.ldif.namingContext._043=##  <renamed target KRA naming context>   ##
kratool.ldif.namingContext._044=##  options are specified, ALWAYS         ##
kratool.ldif.namingContext._045=##  require 'KRATOOL' to change the       ##
kratool.ldif.namingContext._046=##  KRA 'naming context' data in ALL of   ##
kratool.ldif.namingContext._047=##  the following fields in EACH of the   ##
kratool.ldif.namingContext._048=##  following types of records:           ##
kratool.ldif.namingContext._049=##                                        ##
kratool.ldif.namingContext._050=##    caEnrollmentRequest:                ##
kratool.ldif.namingContext._051=##                                        ##
kratool.ldif.namingContext._052=##      dn                                ##
kratool.ldif.namingContext._053=##      extdata-auth--005ftoken;user      ##
kratool.ldif.namingContext._054=##      extdata-auth--005ftoken;userdn    ##
kratool.ldif.namingContext._055=##                                        ##
kratool.ldif.namingContext._056=##    caKeyRecord:                        ##
kratool.ldif.namingContext._057=##                                        ##
kratool.ldif.namingContext._058=##      dn                                ##
kratool.ldif.namingContext._059=##                                        ##
kratool.ldif.namingContext._060=##    recoveryRequest:                    ##
kratool.ldif.namingContext._061=##                                        ##
kratool.ldif.namingContext._062=##      dn                                ##
kratool.ldif.namingContext._063=##                                        ##
kratool.ldif.namingContext._064=##    tpsKeyRecord:                       ##
kratool.ldif.namingContext._065=##                                        ##
kratool.ldif.namingContext._066=##      dn                                ##
kratool.ldif.namingContext._067=##                                        ##
kratool.ldif.namingContext._068=##    tpsNetkeyKeygenRequest:             ##
kratool.ldif.namingContext._069=##                                        ##
kratool.ldif.namingContext._070=##      dn                                ##
kratool.ldif.namingContext._071=##                                        ##
kratool.ldif.namingContext._072=##    tpsNetkeyKeyRecoveryRequest:        ##
kratool.ldif.namingContext._073=##                                        ##
kratool.ldif.namingContext._074=##      dn                                ##
kratool.ldif.namingContext._075=##                                        ##
kratool.ldif.namingContext._076=############################################
kratool.ldif.recoveryRequest._000=#####################################
kratool.ldif.recoveryRequest._001=##  KRA CA / TPS Recovery Request  ##
kratool.ldif.recoveryRequest._002=#####################################
kratool.ldif.recoveryRequest.cn=true
kratool.ldif.recoveryRequest.dateOfModify=true
kratool.ldif.recoveryRequest.dn=true
kratool.ldif.recoveryRequest.extdata.requestId=true
kratool.ldif.recoveryRequest.extdata.requestNotes=true
kratool.ldif.recoveryRequest.extdata.serialnumber=true
kratool.ldif.recoveryRequest.requestId=true
kratool.ldif.tpsKeyRecord._000=#########################################
kratool.ldif.tpsKeyRecord._001=##         KRA TPS Key Record          ##
kratool.ldif.tpsKeyRecord._002=#########################################
kratool.ldif.tpsKeyRecord._003=##                                     ##
kratool.ldif.tpsKeyRecord._004=##  NEVER allow 'KRATOOL' the ability  ##
kratool.ldif.tpsKeyRecord._005=##  to change the TPS 'naming context' ##
kratool.ldif.tpsKeyRecord._006=##  data in the following fields:      ##
kratool.ldif.tpsKeyRecord._007=##                                     ##
kratool.ldif.tpsKeyRecord._008=##    archivedBy                       ##
kratool.ldif.tpsKeyRecord._009=##                                     ##

💖 What's in the box 💖

The file is split into blocks, one per record type, and each one has a little warning banner at the top 🫶

  • caEnrollmentRequest 🌸 has the "NEVER allow" warnings for the CA naming context fields (extdata-auth--005ftoken;uid, extdata-auth--005ftoken;userid, extdata-updatedby) and the CA numeric field extdata-requestId. Its =true settings cover cn, dateOfModify, dn, extdata.keyRecord, extdata.requestNotes and requestId.
  • caKeyRecord 🦋 has its own NEVER warning for the CA naming context field archivedBy. Its =true settings cover cn, dateOfModify, dn, privateKeyData and serialno.
  • namingContext 👑 is the longest block by far, and it's giving main character energy 💅 It has warnings for the CA, KRA and TPS naming contexts. The KRA and TPS warnings say these non-KeyRecord and non-Request records should be removed via the option to process requests and key records only, if this is a KRA migration. The block also lists the dn, uid, uniqueMember and friends for each record type.
  • recoveryRequest 🧚 has =true settings for cn, dateOfModify, dn, extdata.requestId, extdata.requestNotes, extdata.serialnumber and requestId.
  • tpsKeyRecord 🍓 has its own NEVER warning, this time for the TPS naming context field archivedBy.
⚠️ NEVER allow 'KRATOOL' the ability to change the naming context data or the numeric data in the fields listed in these blocks! The namingContext block also says that if -source_naming_context <original source KRA naming context> and -target_naming_context <renamed target KRA naming context> are specified, KRATOOL must ALWAYS be required to change the KRA naming context data in ALL of the listed fields in EACH of the listed record types. 🙈💀
              kratool.ldif.tpsKeyRecord._010=#########################################
              kratool.ldif.tpsKeyRecord.cn=true
              kratool.ldif.tpsKeyRecord.dateOfModify=true
              kratool.ldif.tpsKeyRecord.dn=true
              kratool.ldif.tpsKeyRecord.privateKeyData=true
              kratool.ldif.tpsKeyRecord.serialno=true
              kratool.ldif.tpsNetkeyKeygenRequest._000=#####################################
              kratool.ldif.tpsNetkeyKeygenRequest._001=##  KRA TPS Netkey Keygen Request  ##
              kratool.ldif.tpsNetkeyKeygenRequest._002=#####################################
              kratool.ldif.tpsNetkeyKeygenRequest._003=##                                 ##
              kratool.ldif.tpsNetkeyKeygenRequest._004=##  NEVER allow 'KRATOOL' the      ##
              kratool.ldif.tpsNetkeyKeygenRequest._005=##  ability to change the          ##
              kratool.ldif.tpsNetkeyKeygenRequest._006=##  TPS 'naming context' data in   ##
              kratool.ldif.tpsNetkeyKeygenRequest._007=##  the following fields:          ##
              kratool.ldif.tpsNetkeyKeygenRequest._008=##                                 ##
              kratool.ldif.tpsNetkeyKeygenRequest._009=##    extdata-updatedby            ##
              kratool.ldif.tpsNetkeyKeygenRequest._010=##                                 ##
              kratool.ldif.tpsNetkeyKeygenRequest._011=#####################################
              kratool.ldif.tpsNetkeyKeygenRequest.cn=true
              kratool.ldif.tpsNetkeyKeygenRequest.dateOfModify=true
              kratool.ldif.tpsNetkeyKeygenRequest.dn=true
              kratool.ldif.tpsNetkeyKeygenRequest.extdata.keyRecord=true
              kratool.ldif.tpsNetkeyKeygenRequest.extdata.requestId=true
              kratool.ldif.tpsNetkeyKeygenRequest.extdata.requestNotes=true
              kratool.ldif.tpsNetkeyKeygenRequest.requestId=true
              kratool.ldif.tpsNetkeyKeyRecoveryRequest._000=########################################
              kratool.ldif.tpsNetkeyKeyRecoveryRequest._001=## KRA TPS Netkey Keyrecovery Request ##
              kratool.ldif.tpsNetkeyKeyRecoveryRequest._002=########################################
              kratool.ldif.tpsNetkeyKeyRecoveryRequest._003=##                                    ##
              kratool.ldif.tpsNetkeyKeyRecoveryRequest._004=##  NEVER allow 'KRATOOL' the ability ##
              kratool.ldif.tpsNetkeyKeyRecoveryRequest._005=##  to change the TPS 'naming context'##
              kratool.ldif.tpsNetkeyKeyRecoveryRequest._006=##  data in the following fields:     ##
              kratool.ldif.tpsNetkeyKeyRecoveryRequest._007=##                                    ##
              kratool.ldif.tpsNetkeyKeyRecoveryRequest._008=##        extdata-updatedby           ##
              kratool.ldif.tpsNetkeyKeyRecoveryRequest._009=##                                    ##
              kratool.ldif.tpsNetkeyKeyRecoveryRequest._010=########################################
              kratool.ldif.tpsNetkeyKeyRecoveryRequest.cn=true
              kratool.ldif.tpsNetkeyKeyRecoveryRequest.requestId=true
              kratool.ldif.tpsNetkeyKeyRecoveryRequest.dn=true
              kratool.ldif.tpsNetkeyKeyRecoveryRequest.dateOfModify=true
              kratool.ldif.tpsNetkeyKeyRecoveryRequest.extdata.requestId=true
              kratool.ldif.tpsNetkeyKeyRecoveryRequest.extdata.requestNotes=true
NEVER let KRATOOL change the TPS naming context data in the extdata-updatedby field. Those banners in the keygen and key recovery blocks are a big warning, bestie! 🚨💀

✨ EXAMPLES ✨

The KRATool does two things: it can rewrap keys with a new private key, and it can renumber attributes in the LDIF file entries for key records, including enrollments and recovery requests. At least one operation (rewrap or renumber) must be performed, and both can be performed in a single invocation. 💅

🔐 Rewrapping Keys

When rewrapping keys, the tool needs to be able to access the original NSS databases for the source KRA and its storage certificate to unwrap the keys. It also needs the storage certificate for the new KRA, which is used to rewrap the keys. 🌸

$ KRATool -kratool_config_file KRATool.cfg \
    -source_ldif_file originalKRA.ldif \
    -target_ldif_file newKRA.ldif \
    -log_file kratool.log \
    -source_pki_security_database_path nssdb \
    -source_storage_token_name "Internal Key Storage Token" \
    -source_storage_certificate_nickname "storageCert cert-pki-kra" \
    -target_storage_certificate_file omega.crt

🔢 Renumbering Keys

When multiple KRA instances are being merged into a single instance, it is important to make sure that no key or request records have conflicting CNs, DNs, serial numbers, or request ID numbers. 😭 These values can be processed to append a new, larger number to the existing values. ✨

For the CN, the new number is the addition of the original CN plus the appended number. For example, if the CN is 4 and the append number is 1000000, the new CN is 1000004. 🧚

For serial numbers and request IDs, the value is always a digit count plus the value. So a CN of 4 has a serial number of 014, or one digit and the CN value. If the append number is 1000000, the new serial number is 071000004, for seven digits and then the sum of the append number (1000000) and the original value (4). 🤯

$ KRATool -kratool_config_file KRATool.cfg \
    -source_ldif_file originalKRA.ldif \
    -target_ldif_file newKRA.ldif \
    -log_file kratool.log \
    -append_id_offset 100000000000

⏪ Restoring the Original Numbering

If a number has been appended to key entries, as in the example entitled Renumbering Keys, that number can also be removed. Along with updating the CN, it also reconstructs any associated numbers, like serial numbers and request ID numbers. 🦋

Undoing a renumbering action may be necessary if the original number wasn't large enough to prevent conflicts, or as part of testing a migration or KRA consolidation process. 🫶

$ KRATool -kratool_config_file KRATool.cfg \
    -source_ldif_file originalKRA.ldif \
    -target_ldif_file newKRA.ldif \
    -log_file kratool.log \
    -remove_id_offset 100000000000

🎀 Renumbering and Rewrapping in a Single Command

Rewrapping and renumbering operations can be performed in the same invocation. Main character energy! 👑

$ KRATool -kratool_config_file KRATool.cfg \
    -source_ldif_file originalKRA.ldif \
    -target_ldif_file newKRA.ldif \
    -log_file kratool.log \
    -source_pki_security_database_path nssdb \
    -source_storage_token_name "Internal Key Storage Token" \
    -source_storage_certificate_nickname "storageCert cert-pki-kra" \
    -target_storage_certificate_file omega.crt \
    -append_id_offset 100000000000

🧚 SEE ALSO 🧚

pki(1)

👑 AUTHORS 👑

Matthew Harmsen lt;mharmsen@redhat.comgt; and Dinesh Prasanth M K lt;dmoluguw@redhat.comgt;.

Copyright (c) 2019 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.

bestie, that's the whole tea! ✨ This page came from the PKI crew and got its glow-up on Sep 11, 2019 🌸 Now go rewrap those keys like the unbothered queen you are 💖💅

📦 where this page comes from