Configure the Initial OCLM CMP Client Certificate

4.6 Configure the Initial OCLM CMP Client Certificate

OCLM uses an initial CMP client certificate and matching private key to establish the first trusted CMP identity between the OCLM node and Operator CA. Operator CA must recognize this certificate as an authorized CMP client before OCLM can request or renew certificates.

initialIssuedCert.pem is the initial OCLM CMP client certificate. It identifies the OCLM node to Operator CA and is used for signature-protected CMP requests.

initialIssuedKey.pem is the private key that matches initialIssuedCert.pem. OCLM uses this private key to sign CMP requests. Keep this file private and readable only by the OCLM service account and authorized administrators.

Together, these files are used for initial, signature-based trust establishment between OCLM and Operator CA. They are different from the Operator CA trust certificates under /opt/oclm-service; the Operator CA trust certificates are used to verify issued certificates and, when enabled, the CMP TLS endpoint.

Default file names:


/opt/oclm-service/certs/initialIssuedCert.pem
/opt/oclm-service/certs/initialIssuedKey.pem

Create the staging directory:


STAGE_DIR=/home/admusr/oclm-staging/cmp-identity
mkdir -p "$STAGE_DIR"
chmod 700 "$STAGE_DIR"

Copy initialIssuedCert.pem and initialIssuedKey.pem into $STAGE_DIR using the customer-approved secure transfer method. Then install the files from the staging directory:


sudo install -m 0644 "$STAGE_DIR/initialIssuedCert.pem" /opt/oclm-service/certs/initialIssuedCert.pem
sudo install -m 0600 "$STAGE_DIR/initialIssuedKey.pem" /opt/oclm-service/certs/initialIssuedKey.pem
sudo chown admusr:admusr /opt/oclm-service/certs/initialIssuedCert.pem /opt/oclm-service/certs/initialIssuedKey.pem

Remove the staged copies after the files are installed:


rm -f "$STAGE_DIR/initialIssuedCert.pem" "$STAGE_DIR/initialIssuedKey.pem"
rmdir "$STAGE_DIR" 2>/dev/null || true

Validate the certificate and key:


openssl x509 -in /opt/oclm-service/certs/initialIssuedCert.pem -noout -subject -issuer -dates
openssl pkey -in /opt/oclm-service/certs/initialIssuedKey.pem -noout -check

Note:

Creation and renewal of the initial trust certificates must be managed manually by the operator. The OCLM node does not create or renew these certificates automatically.