EJBCA CA Key Migration

[Seculogic]

Hi All,

We are running EBCA community edition 3.9.7 on Centos 6.7 with Jboss version 4.2.3. And our Root and Policy CAs are running on this server as offline server. The cryptographic keys are stored in PCI form factor HSM and now we are in the process of migrating it to USB HSM. As a rollback process could you please guide me what all things that I need to backup from EJBCA perspective? I'll be taking the backup of HSM configuration, but please let me know what do I need to take the backup of EJBCA configuration? This will help to restore the service incase of issue with migration.

[Realiserad]

I would make a snapshot of the server if possible.

If you decide to perform a manual backup, make a copy of the following folders (note, I have never deployed such an old version of EJBCA, but I doubt this has changed much):

• ${APPSRV_HOME} - The directory containing the application server, probably something like /opt/jboss.
• Any configuration files in /etc/cesecore and /etc/ejbca.
• ${EJBCA_HOME} - The directory with the EJBCA source code, may not be present on the server if EJBCA was built elsewhere.
• Any scripts used to start EJBCA.
• And most importantly, EJBCA's database (thanks @primetomas!)

Also, EJBCA 3 is very old, so I would try to reinstall the system with a newer software stack and then migrate the database over to the new system.

According to the documentation, you need to upgrade from 3.9.7 to 4.0.16, and then from 4.0.16 to 6.3.2.6, before you can go to EJBCA 7. So maybe it's easier to export the CRLs and certificates with ejbca.sh and import them on a fresh installation without trying to migrate the database content.

[primetomas]

Also always make a backup of the database before upgrading. The database contains all CA data, and in case you need to rollback an upgrade you can restore the database backup.