How To Install pki-kra on CentOS 7
Introduction
In this tutorial we learn how to install pki-kra on CentOS 7.
What is pki-kra
The Key Recovery Authority (KRA) is an optional PKI subsystem that can act as a key archival facility. When configured in conjunction with the Certificate Authority (CA), the KRA stores private encryption keys as part of the certificate enrollment process. The key archival mechanism is triggered when a user enrolls in the PKI and creates the certificate request. Using the Certificate Request Message Format (CRMF) request format, a request is generated for the user’s private encryption key. This key is then stored in the KRA which is configured to store keys in an encrypted format that can only be decrypted by several agents requesting the key at one time, providing for protection of the public encryption keys for the users in the PKI deployment. Note that the KRA archives encryption keys; it does NOT archive signing keys, since such archival would undermine non-repudiation properties of signing keys. This package is one of the top-level java-based Tomcat PKI subsystems provided by the PKI Core used by the Certificate System. ================================== || ABOUT “CERTIFICATE SYSTEM” || ================================== Certificate System (CS) is an enterprise software system designed to manage enterprise Public Key Infrastructure (PKI) deployments. PKI Core contains ALL top-level java-based Tomcat PKI components * pki-symkey * pki-base * pki-base-python2 (alias for pki-base) * pki-base-python3 * pki-base-java * pki-tools * pki-server * pki-ca * pki-kra * pki-ocsp * pki-tks * pki-tps * pki-javadoc which comprise the following corresponding PKI subsystems * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) Python clients need only install the pki-base package. This package contains the python REST client packages and the client upgrade framework. Java clients should install the pki-base-java package. This package contains the legacy and REST Java client packages. These clients should also consider installing the pki-tools package, which contain native and Java-based PKI tools and utilities. Certificate Server instances require the fundamental classes and modules in pki-base and pki-base-java, as well as the utilities in pki-tools. The main server classes are in pki-server, with subsystem specific Java classes and resources in pki-ca, pki-kra, pki-ocsp etc. Finally, if Certificate System is being deployed as an individual or set of standalone rather than embedded server(s)/service(s), it is strongly recommended (though not explicitly required) to include at least one PKI Theme package * dogtag-pki-theme (Dogtag Certificate System deployments) * dogtag-pki-server-theme * redhat-pki-server-theme (Red Hat Certificate System deployments) * redhat-pki-server-theme * customized pki theme (Customized Certificate System deployments) *
-pki-server-theme NOTE meta packages may be provided which bind a particular theme to these certificate server packages.
We can use yum or dnf to install pki-kra on CentOS 7. In this tutorial we discuss both methods but you only need to choose one of method to install pki-kra.
Install pki-kra on CentOS 7 Using yum
Update yum database with yum using the following command.
sudo yum makecache
After updating yum database, We can install pki-kra using yum by running the following command:
sudo yum -y install pki-kra
Install pki-kra on CentOS 7 Using dnf
If you don’t have dnf installed you can install DNF on CentOS 7 first.
Update yum database with dnf using the following command.
sudo dnf makecache
After updating yum database, We can install pki-kra using dnf by running the following command:
sudo dnf -y install pki-kra
How To Uninstall pki-kra on CentOS 7
To uninstall only the pki-kra package we can use the following command:
sudo dnf remove pki-kra
References
Summary
In this tutorial we learn how to install pki-kra on CentOS 7 using yum and dnf.
