Importing Certificates to OpenXPKI

1. As OpenXPKI needs to be able to build the full chain for any certificate, you need to import the Root CA(s) first.

# openxpkiadm certificate import --file RootCA.pem 

Import root CA

2. Register datasafe token for the democa realm with DataVault certificate.

# openxpkiadm alias --realm democa --token datasafe --file 

OpenXPKI_DataVault.crt  

Register DataVault token

3. Verify that the key_usable for DataVault token is 1.

# openxpkicli  get_token_info --arg alias=vault-1 

DataVault token info

4. Register the certsign token with the Subordinate CA certificate.

# openxpkiadm alias --realm democa --token certsign --file  SubCA.pem 

Register certsign token

5. If the import went smoothly, you should see something like this.

# openxpkiadm alias --realm democa 

democa realm functional token list

6. Create a CRL.

# openxpkicmd  --realm democa crl_issuance 

CRL creation