Migrating the certificates
This section describes the commands you must run to migrate certificates to the FIPS-compliant format, KDB.
Note that PEM format cannot be directly converted to KDB format; you must first convert PEM to PKCS12 and then to KDB.
The following list describes the command you must run to convert from one format to another:
- JKS format to KDB format
-
gsk7cmd -keydb -convert -db TWSClientKeyFile.jks -pw default -old_format jks -new_format cms
gsk7cmd -keydb -convert -db TWSClientTrustFile.kdb -pw default -old_format cms -new_format jks
- PKCS12 format to KDB format
- gsk7capicmd -cert -export -target TWSClientKeyFile_new.kdb -db TWSClientKeyFileP12.P12 -fips -target_type cms -type pkcs12
- PKCS12 format to PEM format
- openssl pkcs12 -in TWSClientKeyFileP12.P12 -out TWSClientKeyFile.pem
- PEM format to PKCS12 format
- openssl pkcs12 -export -in TWSClientKeyFile.pem -out cred.p12
- KDB format to PKCS12 format
- gsk7capicmd -cert -export -db TWSClientKeyFile.kdb -target TWSClientKeyFileP12.P12 -fips -target_type pkcs12 -type cms