Migrating Key Constraint Parameters

Migrating Key Constraint Parameters

Since PKI 11.10.2, certificate profile Key Constraints should use allowedKeys parameters instead of keyType/keyParameters.

Automatic Migration (On-Disk Profiles)

On upgrade to PKI 11.10.2, the script 01-UpdateKeyParameters.py converts on-disk CA profile files under the instance configuration directory.

Manual Migration (LDAP-Stored Profiles)

Profiles stored only in LDAP are not modified by the upgrade script. To migrate a profile:

1. Disable the profile:

   $ pki -n caadmin ca-profile-disable <profileID>

2. Edit the profile and replace keyType/keyParameters with allowedKeys entries (see Key Constraint).

3. Re-enable the profile:

   $ pki -n caadmin ca-profile-enable <profileID>

Alternatively, import an updated profile from the shipped files:

+

$ pki -n caadmin ca-profile-mod --raw /usr/share/pki/ca/profiles/ca/<profile>.cfg

See Also

• PKI 11.10.2 Server Changes

• Key Constraint

• Exporting Certificate Profile