Attached is a preliminary patch to provide a mechanism to import all
existing CA system certificates into a new CA instance. It's not ready
to be checked in yet. It's posted for evaluation only.
Here's the doc:
http://pki.fedoraproject.org/wiki/Installing_CA_with_Existing_System_Cert...
The patch has only been tested with PKCS #12 installation. It has not
been tested with HSM. Also currently it breaks the external CA case.
Nevertheless, I think it's pretty close to complete, but it will need
more thorough testing.
--
Endi S. Dewata