>From e488bbd81b3bff2bb35444b4e653efa9e6a29aad Mon Sep 17 00:00:00 2001
From: Ade Lee <alee@redhat.com>
Date: Mon, 19 Mar 2012 22:01:12 -0400
Subject: [PATCH] Allow clones to specify master and replica ports and
 security options

Removed -clone_start_tls option and subsumed it into -replicationSecurity.
Refactored DatabasePanel parameter verification code to allow it to be
used in both update() and validate().  Added new parameters to pkisilent
and databasepanel.vm.   Fixed pkisilent deprecation errors.
---
 .../src/com/netscape/certsrv/util/HttpInput.java   |   42 ++---
 .../cms/servlet/csadmin/ConfigHSMLoginPanel.java   |    5 +-
 .../cms/servlet/csadmin/DatabasePanel.java         |  236 ++++++++++++--------
 .../src/com/netscape/pkisilent/ConfigureCA.java    |  122 ++++++-----
 .../src/com/netscape/pkisilent/ConfigureDRM.java   |  135 ++++++-----
 .../src/com/netscape/pkisilent/ConfigureOCSP.java  |  118 ++++------
 .../src/com/netscape/pkisilent/ConfigureRA.java    |   63 +++---
 .../src/com/netscape/pkisilent/ConfigureSubCA.java |  113 +++++-----
 .../src/com/netscape/pkisilent/ConfigureTKS.java   |  108 ++++-----
 .../src/com/netscape/pkisilent/ConfigureTPS.java   |   99 ++++-----
 .../shared/admin/console/config/databasepanel.vm   |   39 +++-
 11 files changed, 555 insertions(+), 525 deletions(-)

diff --git a/pki/base/common/src/com/netscape/certsrv/util/HttpInput.java b/pki/base/common/src/com/netscape/certsrv/util/HttpInput.java
index fba601b6c61c580c10556de345ce520d8b51f48a..ba5bfdb08e4e051051a8d4de2a06b711633b1845 100644
--- a/pki/base/common/src/com/netscape/certsrv/util/HttpInput.java
+++ b/pki/base/common/src/com/netscape/certsrv/util/HttpInput.java
@@ -86,8 +86,7 @@ public class HttpInput {
         return v;
     }
 
-    public static String getString(HttpServletRequest request, String name)
-            throws IOException {
+    public static String getString(HttpServletRequest request, String name) {
         String val = request.getParameter(name);
         return val;
     }
@@ -102,8 +101,7 @@ public class HttpInput {
         return val;
     }
 
-    public static String getLdapDatabase(HttpServletRequest request, String name)
-            throws IOException {
+    public static String getLdapDatabase(HttpServletRequest request, String name) {
         return getString(request, name);
     }
 
@@ -118,13 +116,11 @@ public class HttpInput {
         return v;
     }
 
-    public static String getUID(HttpServletRequest request, String name)
-            throws IOException {
+    public static String getUID(HttpServletRequest request, String name) {
         return getString(request, name);
     }
 
-    public static String getPassword(HttpServletRequest request, String name)
-            throws IOException {
+    public static String getPassword(HttpServletRequest request, String name) {
         return getString(request, name);
     }
 
@@ -199,48 +195,39 @@ public class HttpInput {
         return v;
     }
 
-    public static String getID(HttpServletRequest request, String name)
-            throws IOException {
+    public static String getID(HttpServletRequest request, String name) {
         return getString(request, name);
     }
 
-    public static String getName(HttpServletRequest request, String name)
-            throws IOException {
+    public static String getName(HttpServletRequest request, String name) {
         return getString(request, name);
     }
 
-    public static String getCertRequest(HttpServletRequest request, String name)
-            throws IOException {
+    public static String getCertRequest(HttpServletRequest request, String name) {
         return getString(request, name);
     }
 
-    public static String getCertChain(HttpServletRequest request, String name)
-            throws IOException {
+    public static String getCertChain(HttpServletRequest request, String name) {
         return getString(request, name);
     }
 
-    public static String getCert(HttpServletRequest request, String name)
-            throws IOException {
+    public static String getCert(HttpServletRequest request, String name) {
         return getString(request, name);
     }
 
-    public static String getNickname(HttpServletRequest request, String name)
-            throws IOException {
+    public static String getNickname(HttpServletRequest request, String name) {
         return getString(request, name);
     }
 
-    public static String getHostname(HttpServletRequest request, String name)
-            throws IOException {
+    public static String getHostname(HttpServletRequest request, String name) {
         return getString(request, name);
     }
 
-    public static String getTokenName(HttpServletRequest request, String name)
-            throws IOException {
+    public static String getTokenName(HttpServletRequest request, String name) {
         return getString(request, name);
     }
 
-    public static String getReplicationAgreementName(HttpServletRequest request, String name)
-            throws IOException {
+    public static String getReplicationAgreementName(HttpServletRequest request, String name) {
         return getString(request, name);
     }
 
@@ -253,8 +240,7 @@ public class HttpInput {
         return v;
     }
 
-    public static String getDomainName(HttpServletRequest request, String name)
-            throws IOException {
+    public static String getDomainName(HttpServletRequest request, String name) {
         return getString(request, name);
     }
 
diff --git a/pki/base/common/src/com/netscape/cms/servlet/csadmin/ConfigHSMLoginPanel.java b/pki/base/common/src/com/netscape/cms/servlet/csadmin/ConfigHSMLoginPanel.java
index 92e2ee392f717748123d5bd610f5f2d67d07fb6b..7197a05117bdf30cf59454bf9452ecfe3c932b5c 100644
--- a/pki/base/common/src/com/netscape/cms/servlet/csadmin/ConfigHSMLoginPanel.java
+++ b/pki/base/common/src/com/netscape/cms/servlet/csadmin/ConfigHSMLoginPanel.java
@@ -97,10 +97,7 @@ public class ConfigHSMLoginPanel extends WizardPanelBase {
 
         // get token selected to be logged in
         String tokName = null;
-        try {
-            tokName = HttpInput.getTokenName(request, "SecToken");
-        } catch (IOException e) {
-        }
+        tokName = HttpInput.getTokenName(request, "SecToken"); 
 
         if (tokName != null) {
             CMS.debug("ConfigHSMLoginPanel: selected token name= " + tokName);
diff --git a/pki/base/common/src/com/netscape/cms/servlet/csadmin/DatabasePanel.java b/pki/base/common/src/com/netscape/cms/servlet/csadmin/DatabasePanel.java
index d3b0e380ec14f49bf0b0ceb4daee54b776e8fe69..0880e951486cb8d5b267ea8c04dc3e891c3b9902 100644
--- a/pki/base/common/src/com/netscape/cms/servlet/csadmin/DatabasePanel.java
+++ b/pki/base/common/src/com/netscape/cms/servlet/csadmin/DatabasePanel.java
@@ -25,6 +25,7 @@ import java.io.IOException;
 import java.io.PrintStream;
 import java.util.ArrayList;
 import java.util.Enumeration;
+import java.util.HashMap;
 import java.util.Random;
 import java.util.StringTokenizer;
 
@@ -67,11 +68,7 @@ public class DatabasePanel extends WizardPanelBase {
     private static final String HOST = "localhost";
     private static final String CLONE_HOST = "Enter FQDN here";
     private static final String PORT = "389";
-    private static final String BASEDN = "o=netscapeCertificateServer";
     private static final String BINDDN = "cn=Directory Manager";
-    private static final String DATABASE = "csRoot";
-    private static final String MASTER_AGREEMENT = "masteragreement-";
-    private static final String CLONE_AGREEMENT = "cloneagreement-";
 
     private WizardServlet mServlet = null;
 
@@ -170,7 +167,10 @@ public class DatabasePanel extends WizardPanelBase {
         String database = null;
         String errorString = "";
         String secure = "false";
-        String cloneStartTLS = "false";
+        String masterReplicationPort = "";
+        String cloneReplicationPort = "";
+        String replicationSecurity = "";
+        
         try {
             @SuppressWarnings("unused")
             String s = cs.getString("preop.database.removeData"); // check whether it's first time
@@ -192,7 +192,9 @@ public class DatabasePanel extends WizardPanelBase {
                 binddn = cs.getString("internaldb.ldapauth.bindDN", "");
                 database = cs.getString("internaldb.database", "");
                 secure = cs.getString("internaldb.ldapconn.secureConn", "");
-                cloneStartTLS = cs.getString("internaldb.ldapconn.cloneStartTLS", "");
+                replicationSecurity = cs.getString("internaldb.ldapconn.replicationSecurity", "None");
+                masterReplicationPort = cs.getString("internaldb.ldapconn.masterReplicationPort", "");
+                cloneReplicationPort = cs.getString("internaldb.ldapconn.cloneReplicationPort", "");
                 errorString = cs.getString("preop.database.errorString", "");
             } catch (Exception e) {
                 CMS.debug("DatabasePanel display: " + e.toString());
@@ -247,7 +249,9 @@ public class DatabasePanel extends WizardPanelBase {
         context.put("bindpwd", bindpwd);
         context.put("database", database);
         context.put("secureConn", (secure.equals("true") ? "on" : "off"));
-        context.put("cloneStartTLS", (cloneStartTLS.equals("true") ? "on" : "off"));
+        context.put("masterReplicationPort", masterReplicationPort);
+        context.put("cloneReplicationPort", cloneReplicationPort);
+        context.put("replicationSecurity", replicationSecurity);        
         context.put("panel", "admin/console/config/databasepanel.vm");
         context.put("errorString", errorString);
     }
@@ -270,125 +274,127 @@ public class DatabasePanel extends WizardPanelBase {
     }
 
     /**
-     * Checks if the given parameters are valid.
+     * Parses and validates the parameters in the request.
      */
-    public void validate(HttpServletRequest request,
-            HttpServletResponse response,
-            Context context) throws IOException {
-
+    public void parseParameters(HttpServletRequest request,
+            HttpServletResponse response, Context context) throws IOException {
         IConfigStore cs = CMS.getConfigStore();
-        context.put("firsttime", "false");
+
+        String select = "";
         try {
-            @SuppressWarnings("unused")
-            String s = cs.getString("preop.database.removeData"); // check whether it's first time
+            select = cs.getString("preop.subsystem.select", "");
         } catch (Exception e) {
-            context.put("firsttime", "true");
         }
 
         String hostname = HttpInput.getHostname(request, "host");
+        if (hostname == null || hostname.length() == 0) {
+            throw new IOException("hostname is empty string");
+        }
         context.put("hostname", hostname);
 
+        // this validates that port is an integer
         String portStr = HttpInput.getPortNumber(request, "port");
         context.put("portStr", portStr);
 
         String basedn = HttpInput.getDN(request, "basedn");
+        if (basedn == null || basedn.length() == 0) {
+            throw new IOException("basedn is empty string");
+        }
         context.put("basedn", basedn);
 
         String binddn = HttpInput.getDN(request, "binddn");
+        if (binddn == null || binddn.length() == 0) {
+            throw new IOException("binddn is empty string");
+        }
         context.put("binddn", binddn);
 
         String database = HttpInput.getLdapDatabase(request, "database");
+        if (database == null || database.length() == 0) {
+            throw new IOException("Database is empty string");
+        }
         context.put("database", database);
 
         String bindpwd = HttpInput.getPassword(request, "__bindpwd");
+        if (bindpwd == null || bindpwd.length() == 0) {
+            throw new IOException("Bind password is empty string");
+        }
         context.put("bindpwd", bindpwd);
 
         String secure = HttpInput.getCheckbox(request, "secureConn");
         context.put("secureConn", secure);
 
-        String cloneStartTLS = HttpInput.getCheckbox(request, "cloneStartTLS");
-        context.put("cloneStartTLS", cloneStartTLS);
+        String masterReplicationPort = HttpInput.getString(request, "masterReplicationPort");
+        if (masterReplicationPort != null && masterReplicationPort.length() > 0) {
+            try {
+                Integer.parseInt(masterReplicationPort); // check for errors
+            } catch (NumberFormatException e) {
+                throw new IOException("Master replication port is invalid");
+            }
+        }
+        context.put("masterReplicationPort", masterReplicationPort);
 
-        String select = "";
-        try {
-            select = cs.getString("preop.subsystem.select", "");
-        } catch (Exception e) {
+        String cloneReplicationPort = HttpInput.getString(request, "cloneReplicationPort");
+        if (cloneReplicationPort != null && cloneReplicationPort.length() > 0) {
+            try {
+                Integer.parseInt(cloneReplicationPort); // check for errors
+            } catch (Exception e) {
+                throw new IOException("Clone replication port is invalid");
+            }
         }
+        context.put("cloneReplicationPort", cloneReplicationPort);
+
+        String replicationSecurity = HttpInput.getString(request, "replicationSecurity");
+        context.put("replicationSecurity", replicationSecurity);
 
         if (select.equals("clone")) {
             String masterhost = "";
             String masterport = "";
             String masterbasedn = "";
+            String realhostname = "";
             try {
                 masterhost = cs.getString("preop.internaldb.master.ldapconn.host", "");
                 masterport = cs.getString("preop.internaldb.master.ldapconn.port", "");
                 masterbasedn = cs.getString("preop.internaldb.master.basedn", "");
+                realhostname = cs.getString("machineName", "");
             } catch (Exception e) {
             }
 
-            //get the real host name
-            String realhostname = "";
-            if (hostname.equals("localhost")) {
-                try {
-                    realhostname = cs.getString("machineName", "");
-                } catch (Exception ee) {
-                }
-            }
             if (masterhost.equals(realhostname) && masterport.equals(portStr)) {
-                context.put("updateStatus", "validate-failure");
                 throw new IOException("Master and clone must not share the same internal database");
             }
 
             if (!masterbasedn.equals(basedn)) {
-                context.put("updateStatus", "validate-failure");
                 throw new IOException("Master and clone should have the same base DN");
             }
         }
 
-        if (hostname == null || hostname.length() == 0) {
-            cs.putString("preop.database.errorString", "Host is empty string");
-            context.put("updateStatus", "validate-failure");
-            throw new IOException("Host is empty string");
-        }
+        context.put("errorString", "");
+        cs.putString("preop.database.errorString", "");
+    }
+    
+    /**
+     * Checks if the given parameters are valid.
+     */
+    public void validate(HttpServletRequest request,
+            HttpServletResponse response,
+            Context context) throws IOException {
 
-        if (portStr != null && portStr.length() > 0) {
-            try {
-                Integer.parseInt(portStr); // check for errors
-            } catch (Exception e) {
-                cs.putString("preop.database.errorString", "Port is invalid");
-                context.put("updateStatus", "validate-failure");
-                throw new IOException("Port is invalid");
-            }
-        } else {
-            cs.putString("preop.database.errorString", "Port is empty string");
-            context.put("updateStatus", "validate-failure");
-            throw new IOException("Port is empty string");
+        IConfigStore cs = CMS.getConfigStore();
+        context.put("firsttime", "false");
+        try {
+            @SuppressWarnings("unused")
+            String s = cs.getString("preop.database.removeData"); // check whether it's first time
+        } catch (Exception e) {
+            context.put("firsttime", "true");
         }
-
-        if (basedn == null || basedn.length() == 0) {
-            cs.putString("preop.database.errorString", "Base DN is empty string");
-            context.put("updateStatus", "validate-failure");
-            throw new IOException("Base DN is empty string");
-        }
-
-        if (binddn == null || binddn.length() == 0) {
-            cs.putString("preop.database.errorString", "Bind DN is empty string");
-            context.put("updateStatus", "validate-failure");
-            throw new IOException("Bind DN is empty string");
-        }
-
-        if (database == null || database.length() == 0) {
-            cs.putString("preop.database.errorString",
-                    "Database is empty string");
-            context.put("updateStatus", "validate-failure");
-            throw new IOException("Database is empty string");
-        }
-
-        if (bindpwd == null || bindpwd.length() == 0) {
-            cs.putString("preop.database.errorString",
-                    "Bind password is empty string");
+        
+        try {
+            parseParameters(request, response, context);            
+        } catch (IOException e) {
+            context.put("errorString", e.getMessage());
+            cs.putString("preop.database.errorString", e.getMessage());
             context.put("updateStatus", "validate-failure");
-            throw new IOException("Bind password is empty string");
+            throw e;
         }
 
         context.put("errorString", "");
@@ -737,8 +743,6 @@ public class DatabasePanel extends WizardPanelBase {
         } else {
             // data will be replicated from the master to the clone
             // so clone does not need the data
-            //
-
             importLDIFS("preop.internaldb.schema.ldif", conn);
             importLDIFS("preop.internaldb.ldif", conn);
             importLDIFS("preop.internaldb.data_ldif", conn);
@@ -884,6 +888,7 @@ public class DatabasePanel extends WizardPanelBase {
             }
         }
     }
+    
 
     /**
      * Commit parameter changes
@@ -913,22 +918,54 @@ public class DatabasePanel extends WizardPanelBase {
         } catch (Exception e) {
         }
 
-        String hostname2 = HttpInput.getHostname(request, "host");
-        String portStr2 = HttpInput.getPortNumber(request, "port");
-        String database2 = HttpInput.getLdapDatabase(request, "database");
-        String basedn2 = HttpInput.getDN(request, "basedn");
-
+        try {
+            parseParameters(request, response, context);            
+        } catch (IOException e) {
+            context.put("errorString", e.getMessage());
+            cs.putString("preop.database.errorString", e.getMessage());
+            context.put("updateStatus", "validate-failure");
+            throw e;
+        }
+                
+        String hostname2 = (String) context.get("hostname");        
+        String portStr2 = (String) context.get("portStr");
+        String database2 = (String) context.get("database");
+        String basedn2 = (String) context.get("basedn");
+        String binddn = (String) context.get("binddn");
+        String secure = (String) context.get("secureConn");
+        String masterReplicationPortStr = (String) context.get("masterReplicationPort");
+        String cloneReplicationPortStr = (String) context.get("cloneReplicationPort");
+        
         cs.putString("internaldb.ldapconn.host", hostname2);
         cs.putString("internaldb.ldapconn.port", portStr2);
+        cs.putString("internaldb.database", database2);
         cs.putString("internaldb.basedn", basedn2);
-        String binddn = HttpInput.getDN(request, "binddn");
         cs.putString("internaldb.ldapauth.bindDN", binddn);
-        cs.putString("internaldb.database", database2);
-        String secure = HttpInput.getCheckbox(request, "secureConn");
         cs.putString("internaldb.ldapconn.secureConn", (secure.equals("on") ? "true" : "false"));
-        String cloneStartTLS = HttpInput.getCheckbox(request, "cloneStartTLS");
-        cs.putString("internaldb.ldapconn.cloneStartTLS", (cloneStartTLS.equals("on") ? "true" : "false"));
-
+        
+        int masterReplicationPort = 0;
+        if ((masterReplicationPortStr != null) && (masterReplicationPortStr.length()>0)) {
+            masterReplicationPort = Integer.parseInt(masterReplicationPortStr);
+            cs.putString("internaldb.ldapconn.masterReplicationPort", masterReplicationPortStr);
+        }
+        
+        int cloneReplicationPort = 0;
+        int port = Integer.parseInt(portStr2);
+        if ((cloneReplicationPortStr != null) && (cloneReplicationPortStr.length()> 0)) {
+            cloneReplicationPort = Integer.parseInt(cloneReplicationPortStr); 
+        } else {
+            cloneReplicationPort = port;  
+        }
+        cs.putString("internaldb.ldapconn.cloneReplicationPort", cloneReplicationPortStr);
+        
+        String replicationSecurity = HttpInput.getString(request, "replicationSecurity");
+        if ((cloneReplicationPort == port) && (secure.equals("true"))) {
+            replicationSecurity = "SSL";
+        } else if (replicationSecurity == null) {
+            replicationSecurity = "None";
+        }
+        cs.putString("internaldb.ldapconn.replicationSecurity", replicationSecurity);
+        
         String remove = HttpInput.getID(request, "removeData");
         if (isPanelDone() && (remove == null || remove.equals(""))) {
             /* if user submits the same data, they just want to skip 
@@ -1054,8 +1091,8 @@ public class DatabasePanel extends WizardPanelBase {
         // setup replication after indexes have been created
         if (select.equals("clone")) {
             CMS.debug("Start setting up replication.");
-            setupReplication(request, context, (secure.equals("on") ? "true" : "false"), (cloneStartTLS.equals("on")
-                    ? "true" : "false"));
+            setupReplication(request, context, (secure.equals("on") ? "true" : "false"), 
+                    replicationSecurity, masterReplicationPort, cloneReplicationPort);
             CMS.debug("Finish setting up replication.");
 
             try {
@@ -1084,7 +1121,9 @@ public class DatabasePanel extends WizardPanelBase {
     }
 
     private void setupReplication(HttpServletRequest request,
-                  Context context, String secure, String cloneStartTLS) throws IOException {
+                  Context context, String secure, String replicationSecurity, 
+                  int masterReplicationPort, int cloneReplicationPort)
+            throws IOException {
         IConfigStore cs = CMS.getConfigStore();
 
         String cstype = "";
@@ -1188,11 +1227,11 @@ public class DatabasePanel extends WizardPanelBase {
 
             createReplicationAgreement(replicadn, masterConn, masterAgreementName,
                     replica_hostname, replica_port, replica_replicationpwd, basedn, cloneBindUser, secure,
-                    cloneStartTLS);
+                    replicationSecurity, cloneReplicationPort);
 
             createReplicationAgreement(replicadn, replicaConn, cloneAgreementName,
                     master_hostname, master_port, master_replicationpwd, basedn, masterBindUser, secure,
-                    cloneStartTLS);
+                    replicationSecurity, masterReplicationPort);
 
             // initialize consumer
             initializeConsumer(replicadn, masterConn, masterAgreementName);
@@ -1353,7 +1392,8 @@ public class DatabasePanel extends WizardPanelBase {
 
     private void createReplicationAgreement(String replicadn,
             LDAPConnection conn, String name, String replicahost, int replicaport,
-            String replicapwd, String basedn, String bindUser, String secure, String cloneStartTLS)
+            String replicapwd, String basedn, String bindUser, String secure, String replicationSecurity,
+            int replicationPort)
             throws LDAPException {
         String dn = "cn=" + name + "," + replicadn;
         CMS.debug("DatabasePanel createReplicationAgreement: dn: " + dn);
@@ -1367,15 +1407,21 @@ public class DatabasePanel extends WizardPanelBase {
             attrs.add(new LDAPAttribute("cn", name));
             attrs.add(new LDAPAttribute("nsDS5ReplicaRoot", basedn));
             attrs.add(new LDAPAttribute("nsDS5ReplicaHost", replicahost));
-            attrs.add(new LDAPAttribute("nsDS5ReplicaPort", "" + replicaport));
+            
+            if (replicationPort > 0) {
+                attrs.add(new LDAPAttribute("nsDS5ReplicaPort", "" + replicationPort));
+            } else {
+                attrs.add(new LDAPAttribute("nsDS5ReplicaPort", "" + replicaport));
+            }
+            
             attrs.add(new LDAPAttribute("nsDS5ReplicaBindDN",
                     "cn=" + bindUser + ",ou=csusers,cn=config"));
             attrs.add(new LDAPAttribute("nsDS5ReplicaBindMethod", "Simple"));
             attrs.add(new LDAPAttribute("nsds5replicacredentials", replicapwd));
 
-            if (secure.equals("true")) {
+            if (replicationSecurity.equals("SSL")) {
                 attrs.add(new LDAPAttribute("nsDS5ReplicaTransportInfo", "SSL"));
-            } else if (cloneStartTLS.equals("true")) {
+            } else if (replicationSecurity.equals("TLS")) {
                 attrs.add(new LDAPAttribute("nsDS5ReplicaTransportInfo", "TLS"));
             }
 
diff --git a/pki/base/silent/src/com/netscape/pkisilent/ConfigureCA.java b/pki/base/silent/src/com/netscape/pkisilent/ConfigureCA.java
index 4dc77b8943845a5218bcb778c7ffe27318669837..df6b531ff7361f74733174d0cd84ca31e8261012 100644
--- a/pki/base/silent/src/com/netscape/pkisilent/ConfigureCA.java
+++ b/pki/base/silent/src/com/netscape/pkisilent/ConfigureCA.java
@@ -93,7 +93,6 @@ public class ConfigureCA {
     public static String base_dn = null;
     public static String db_name = null;
     public static String secure_conn = null;
-    public static String clone_start_tls = null;
     public static String remove_data = null;
 
     public static String key_type = null;
@@ -179,6 +178,9 @@ public class ConfigureCA {
     public static String clone_uri = null;
     public static String clone_p12_passwd = null;
     public static String clone_p12_file = null;
+    public static String clone_master_port = null;
+    public static String clone_replica_port = null;
+    public static String clone_replication_security = null;
 
     //for correct selection of CA to be cloned
     public static String urls;
@@ -267,7 +269,7 @@ public class ConfigureCA {
             // Software Token
             if (token_name.equalsIgnoreCase("internal")) {
                 query_string = "p=1" + "&op=next" + "&xml=true" + "&choice="
-                        + URLEncoder.encode("Internal Key Storage Token") + "";
+                        + URLEncoder.encode("Internal Key Storage Token", "UTF-8") + "";
                 hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
                 if (!checkStatus(hr, "updateStatus", SUCCESS, "TokenChoicePanel()")) {
                     return false;
@@ -276,8 +278,8 @@ public class ConfigureCA {
             else {
                 // login to hsm first
                 query_string = "p=2" + "&op=next" + "&xml=true" + "&uTokName="
-                        + URLEncoder.encode(token_name) + "&__uPasswd="
-                        + URLEncoder.encode(token_pwd) + "";
+                        + URLEncoder.encode(token_name, "UTF-8") + "&__uPasswd="
+                        + URLEncoder.encode(token_pwd, "UTF-8") + "";
                 hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
                 if (!checkStatus(hr, "updateStatus", SUCCESS, "TokenChoicePanel()")) {
                     return false;
@@ -285,7 +287,7 @@ public class ConfigureCA {
 
                 // choice with token name now
                 query_string = "p=1" + "&op=next" + "&xml=true" + "&choice="
-                        + URLEncoder.encode(token_name) + "";
+                        + URLEncoder.encode(token_name, "UTF-8") + "";
                 hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
                 if (!checkStatus(hr, "updateStatus", SUCCESS, "TokenChoicePanel()")) {
                     return false;
@@ -306,12 +308,12 @@ public class ConfigureCA {
             String query_string = null;
 
             if (!clone) {
-                query_string = "sdomainURL=" + URLEncoder.encode(domain_url)
-                        + "&sdomainName=" + URLEncoder.encode(domain_name)
+                query_string = "sdomainURL=" + URLEncoder.encode(domain_url, "UTF-8")
+                        + "&sdomainName=" + URLEncoder.encode(domain_name, "UTF-8")
                         + "&choice=newdomain" + "&p=3" + "&op=next" + "&xml=true";
             } else {
                 domain_url = "https://" + sd_hostname + ":" + sd_admin_port;
-                query_string = "sdomainURL=" + URLEncoder.encode(domain_url)
+                query_string = "sdomainURL=" + URLEncoder.encode(domain_url, "UTF-8")
                         + "&sdomainName="
                         + "&choice=existingdomain" + "&p=3" + "&op=next" + "&xml=true";
             }
@@ -348,12 +350,12 @@ public class ConfigureCA {
             String subca_url = "https://" + cs_hostname + ":" + cs_port +
                     "/ca/admin/console/config/wizard" + "?p=5&subsystem=CA";
 
-            String query_string = "url=" + URLEncoder.encode(subca_url);
+            String query_string = "url=" + URLEncoder.encode(subca_url, "UTF-8");
 
             hr = hc.sslConnect(sd_hostname, sd_admin_port, sd_login_uri, query_string);
 
-            String query_string_1 = "uid=" + sd_admin_name + "&pwd=" + URLEncoder.encode(sd_admin_password) +
-                                    "&url=" + URLEncoder.encode(subca_url);
+            String query_string_1 = "uid=" + sd_admin_name + "&pwd=" + URLEncoder.encode(sd_admin_password, "UTF-8") +
+                                    "&url=" + URLEncoder.encode(subca_url, "UTF-8");
 
             hr = hc.sslConnect(sd_hostname, sd_admin_port, sd_get_cookie_uri,
                                                 query_string_1);
@@ -397,11 +399,11 @@ public class ConfigureCA {
             if (!clone) {
                 query_string = "p=5" + "&op=next" + "&xml=true"
                         + "&choice=newsubsystem" + "&subsystemName="
-                        + URLEncoder.encode(subsystem_name);
+                        + URLEncoder.encode(subsystem_name, "UTF-8");
             } else {
                 query_string = "p=5" + "&op=next" + "&xml=true"
                         + "&choice=clonesubsystem" + "&subsystemName="
-                        + URLEncoder.encode(subsystem_name)
+                        + URLEncoder.encode(subsystem_name, "UTF-8")
                         + "&urls=" + urls + "";
             }
 
@@ -433,8 +435,8 @@ public class ConfigureCA {
             HTTPResponse hr = null;
 
             String query_string = "p=7" + "&op=next" + "&xml=true"
-                    + "&__password=" + URLEncoder.encode(clone_p12_passwd)
-                    + "&path=" + URLEncoder.encode(clone_p12_file) + "";
+                    + "&__password=" + URLEncoder.encode(clone_p12_passwd, "UTF-8")
+                    + "&path=" + URLEncoder.encode(clone_p12_file, "UTF-8") + "";
 
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
             if (!checkStatus(hr, "updateStatus", SUCCESS, "RestoreKeyCertPanel()")) {
@@ -477,15 +479,17 @@ public class ConfigureCA {
             HTTPResponse hr = null;
 
             String query_string = "p=9" + "&op=next" + "&xml=true" + "&host="
-                    + URLEncoder.encode(ldap_host) + "&port="
-                    + URLEncoder.encode(ldap_port) + "&binddn="
-                    + URLEncoder.encode(bind_dn) + "&__bindpwd="
-                    + URLEncoder.encode(bind_password) + "&basedn="
-                    + URLEncoder.encode(base_dn) + "&database="
-                    + URLEncoder.encode(db_name) + "&display="
-                    + URLEncoder.encode("$displayStr")
+                    + URLEncoder.encode(ldap_host,"UTF-8") + "&port="
+                    + URLEncoder.encode(ldap_port,"UTF-8") + "&binddn="
+                    + URLEncoder.encode(bind_dn, "UTF-8") + "&__bindpwd="
+                    + URLEncoder.encode(bind_password, "UTF-8") + "&basedn="
+                    + URLEncoder.encode(base_dn, "UTF-8") + "&database="
+                    + URLEncoder.encode(db_name, "UTF-8") + "&display="
+                    + URLEncoder.encode("$displayStr", "UTF-8")
                     + (secure_conn.equals("true") ? "&secureConn=on" : "")
-                    + (clone_start_tls.equals("true") ? "&cloneStartTLS=on" : "")
+                    + "&masterReplicationPort=" + URLEncoder.encode(clone_master_port, "UTF-8")
+                    + "&cloneReplicationPort=" + URLEncoder.encode(clone_replica_port, "UTF-8")
+                    + "&replicationSecurity=" + URLEncoder.encode(clone_replication_security, "UTF-8")
                     + (remove_data.equals("true") ? "&removeData=true" : "");
 
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -607,16 +611,16 @@ public class ConfigureCA {
 
             if (!clone) {
                 query_string = "p=11" + "&op=next" + "&xml=true" + "&subsystem="
-                        + URLEncoder.encode(ca_subsystem_cert_subject_name)
+                        + URLEncoder.encode(ca_subsystem_cert_subject_name, "UTF-8")
                         + "&ocsp_signing="
-                        + URLEncoder.encode(ca_ocsp_cert_subject_name) + "&signing="
-                        + URLEncoder.encode(ca_sign_cert_subject_name) + "&sslserver="
-                        + URLEncoder.encode(ca_server_cert_subject_name) + "&audit_signing="
-                        + URLEncoder.encode(ca_audit_signing_cert_subject_name) + "&urls=0"
+                        + URLEncoder.encode(ca_ocsp_cert_subject_name, "UTF-8") + "&signing="
+                        + URLEncoder.encode(ca_sign_cert_subject_name, "UTF-8") + "&sslserver="
+                        + URLEncoder.encode(ca_server_cert_subject_name, "UTF-8") + "&audit_signing="
+                        + URLEncoder.encode(ca_audit_signing_cert_subject_name, "UTF-8") + "&urls=0"
                         + "";
             } else {
                 query_string = "p=11" + "&op=next" + "&xml=true" + "&sslserver="
-                        + URLEncoder.encode(ca_server_cert_subject_name) + "&urls=0"
+                        + URLEncoder.encode(ca_server_cert_subject_name, "UTF-8") + "&urls=0"
                         + "";
             }
 
@@ -744,13 +748,13 @@ public class ConfigureCA {
             HTTPResponse hr = null;
 
             String query_string = "p=12" + "&op=next" + "&xml=true" + "&subsystem="
-                    + URLEncoder.encode(ca_subsystem_cert_cert) + "&subsystem_cc="
-                    + "&ocsp_signing=" + URLEncoder.encode(ocsp_cert_cert)
+                    + URLEncoder.encode(ca_subsystem_cert_cert, "UTF-8") + "&subsystem_cc="
+                    + "&ocsp_signing=" + URLEncoder.encode(ocsp_cert_cert, "UTF-8")
                     + "&ocsp_signing_cc=" + "&signing="
-                    + URLEncoder.encode(ca_cert_cert) + "&signing_cc="
-                    + "&audit_signing=" + URLEncoder.encode(ca_audit_signing_cert_cert)
+                    + URLEncoder.encode(ca_cert_cert, "UTF-8") + "&signing_cc="
+                    + "&audit_signing=" + URLEncoder.encode(ca_audit_signing_cert_cert, "UTF-8")
                     + "&audit_signing_cc="
-                    + "&sslserver=" + URLEncoder.encode(server_cert_cert)
+                    + "&sslserver=" + URLEncoder.encode(server_cert_cert, "UTF-8")
                     + "&sslserver_cc=" + "";
 
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -778,14 +782,14 @@ public class ConfigureCA {
             String genString = "...certificate be generated internally...";
 
             String query_string = "p=12" + "&op=apply" + "&xml=true" + "&subsystem="
-                    + URLEncoder.encode(genString) + "&subsystem_cc="
-                    + "&ocsp_signing=" + URLEncoder.encode(genString)
+                    + URLEncoder.encode(genString, "UTF-8") + "&subsystem_cc="
+                    + "&ocsp_signing=" + URLEncoder.encode(genString, "UTF-8")
                     + "&ocsp_signing_cc=" + "&signing="
-                    + URLEncoder.encode(ca_cert_cert) + "&signing_cc="
-                    + URLEncoder.encode(signing_cc)
-                    + "&audit_signing=" + URLEncoder.encode(genString)
+                    + URLEncoder.encode(ca_cert_cert, "UTF-8") + "&signing_cc="
+                    + URLEncoder.encode(signing_cc, "UTF-8")
+                    + "&audit_signing=" + URLEncoder.encode(genString, "UTF-8")
                     + "&audit_signing_cc="
-                    + "&sslserver=" + URLEncoder.encode(genString)
+                    + "&sslserver=" + URLEncoder.encode(genString, "UTF-8")
                     + "&sslserver_cc=" + "";
 
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -866,8 +870,8 @@ public class ConfigureCA {
 
             if (save_p12.equalsIgnoreCase("true")) {
                 String query_string = "p=13" + "&op=next" + "&xml=true"
-                        + "&choice=backupkey" + "&__pwd=" + URLEncoder.encode(backup_pwd)
-                        + "&__pwdagain=" + URLEncoder.encode(backup_pwd);
+                        + "&choice=backupkey" + "&__pwd=" + URLEncoder.encode(backup_pwd, "UTF-8")
+                        + "&__pwdagain=" + URLEncoder.encode(backup_pwd, "UTF-8");
 
                 hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
                 if (!checkStatus(hr, "updateStatus", SUCCESS, "BackupPanel()")) {
@@ -990,14 +994,14 @@ public class ConfigureCA {
 
             String query_string = "p=16" + "&op=next" + "&xml=true"
                     + "&cert_request_type=" + "crmf" + "&uid=" + admin_user
-                    + "&name=" + admin_user + "&__pwd=" + URLEncoder.encode(admin_password)
-                    + "&__admin_password_again=" + URLEncoder.encode(admin_password) + "&profileId="
-                    + "caAdminCert" + "&email=" + URLEncoder.encode(admin_email)
-                    + "&cert_request=" + URLEncoder.encode(admin_cert_request)
-                    + "&subject=" + URLEncoder.encode(agent_cert_subject)
+                    + "&name=" + admin_user + "&__pwd=" + URLEncoder.encode(admin_password, "UTF-8")
+                    + "&__admin_password_again=" + URLEncoder.encode(admin_password, "UTF-8") + "&profileId="
+                    + "caAdminCert" + "&email=" + URLEncoder.encode(admin_email, "UTF-8")
+                    + "&cert_request=" + URLEncoder.encode(admin_cert_request, "UTF-8")
+                    + "&subject=" + URLEncoder.encode(agent_cert_subject, "UTF-8")
                     + "&clone=new"
                     + "&import=true" + "&securitydomain="
-                    + URLEncoder.encode(domain_name) + "";
+                    + URLEncoder.encode(domain_name, "UTF-8") + "";
 
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
             if (!checkStatus(hr, "updateStatus", SUCCESS, "AdminCertReqPanel()")) {
@@ -1079,7 +1083,7 @@ public class ConfigureCA {
             ParseXML px = new ParseXML();
 
             String query_string = "p=17" + "&op=next" + "&xml=true" + "&caHost="
-                    + URLEncoder.encode("/") + "&caPort=" + URLEncoder.encode("/")
+                    + URLEncoder.encode("/", "UTF-8") + "&caPort=" + URLEncoder.encode("/", "UTF-8")
                     + "";
 
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -1335,7 +1339,6 @@ public class ConfigureCA {
         StringHolder x_base_dn = new StringHolder();
         StringHolder x_db_name = new StringHolder();
         StringHolder x_secure_conn = new StringHolder();
-        StringHolder x_clone_start_tls = new StringHolder();
         StringHolder x_remove_data = new StringHolder();
 
         // key properties (defaults)
@@ -1381,7 +1384,6 @@ public class ConfigureCA {
         StringHolder x_backup_fname = new StringHolder();
 
         // separate key size for agent cert
-
         StringHolder x_agent_key_size = new StringHolder();
         StringHolder x_agent_key_type = new StringHolder();
         StringHolder x_agent_cert_subject = new StringHolder();
@@ -1407,6 +1409,9 @@ public class ConfigureCA {
         StringHolder x_clone_uri = new StringHolder();
         StringHolder x_clone_p12_file = new StringHolder();
         StringHolder x_clone_p12_passwd = new StringHolder();
+        StringHolder x_clone_master_port = new StringHolder();
+        StringHolder x_clone_replica_port = new StringHolder();
+        StringHolder x_clone_replication_security = new StringHolder();
 
         //security domain
         StringHolder x_sd_hostname = new StringHolder();
@@ -1448,9 +1453,6 @@ public class ConfigureCA {
         parser.addOption("-secure_conn %s #use ldaps port (optional, default is false)", x_secure_conn);
         parser.addOption("-remove_data %s #remove existing data under base_dn (optional, default is false) ",
                 x_remove_data);
-        parser.addOption(
-                "-clone_start_tls %s #use startTLS for cloning replication agreement (optional, default is false)",
-                x_clone_start_tls);
 
         // key and algorithm options (default)
         parser.addOption("-key_type %s #Key type [RSA,ECC] (optional, default is RSA)", x_key_type);
@@ -1554,6 +1556,14 @@ public class ConfigureCA {
                 x_clone_p12_file);
         parser.addOption("-clone_p12_password %s #Password for pk12 file (optional, required if -clone=true)",
                 x_clone_p12_passwd);
+        
+        // replication agreement options
+        parser.addOption("-clone_master_port %s #Master Port to be used in replication agreement (optional)",
+                x_clone_master_port);
+        parser.addOption("-clone_replica_port %s #Replica Port to be used in replication agreement (optional)",
+                x_clone_replica_port);
+        parser.addOption("-clone_replication_security %s #Type of security in replication agreement (optional)",
+                x_clone_replication_security);
 
         parser.addOption("-sd_hostname %s #Security Domain Hostname (optional, required if -clone=true)", x_sd_hostname);
         parser.addOption("-sd_ssl_port %s #Security Domain SSL EE port (optional, required if -clone=true)",
@@ -1599,7 +1609,6 @@ public class ConfigureCA {
         db_name = x_db_name.value;
         secure_conn = set_default(x_secure_conn.value, "false");
         remove_data = set_default(x_remove_data.value, "false");
-        clone_start_tls = set_default(x_clone_start_tls.value, "false");
 
         key_type = set_default(x_key_type.value, DEFAULT_KEY_TYPE);
         signing_key_type = set_default(x_signing_key_type.value, key_type);
@@ -1663,6 +1672,9 @@ public class ConfigureCA {
         clone_uri = x_clone_uri.value;
         clone_p12_file = x_clone_p12_file.value;
         clone_p12_passwd = x_clone_p12_passwd.value;
+        clone_master_port = set_default(x_clone_master_port.value, "");
+        clone_replica_port = set_default(x_clone_replica_port.value, "");
+        clone_replication_security = set_default(x_clone_replication_security.value, "None");
 
         sd_hostname = x_sd_hostname.value;
         sd_ssl_port = x_sd_ssl_port.value;
diff --git a/pki/base/silent/src/com/netscape/pkisilent/ConfigureDRM.java b/pki/base/silent/src/com/netscape/pkisilent/ConfigureDRM.java
index 7d15861d19afdb6b8e0d8eb77e3a4b7718593803..e368a3ab86f1854f581b03aeb73ec49db23ba08e 100644
--- a/pki/base/silent/src/com/netscape/pkisilent/ConfigureDRM.java
+++ b/pki/base/silent/src/com/netscape/pkisilent/ConfigureDRM.java
@@ -24,6 +24,7 @@ import java.io.ByteArrayInputStream;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.InputStreamReader;
+import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
 import java.util.ArrayList;
 
@@ -95,7 +96,6 @@ public class ConfigureDRM {
     public static String base_dn = null;
     public static String db_name = null;
     public static String secure_conn = null;
-    public static String clone_start_tls = null;
     public static String remove_data = null;
 
     public static String key_type = null;
@@ -173,6 +173,9 @@ public class ConfigureDRM {
     public static String clone_uri = null;
     public static String clone_p12_passwd = null;
     public static String clone_p12_file = null;
+    public static String clone_master_port = null;
+    public static String clone_replica_port = null;
+    public static String clone_replication_security = null;
 
     //for correct selection of CA to be cloned
     public static String urls;
@@ -224,7 +227,7 @@ public class ConfigureDRM {
         return st;
     }
 
-    public boolean TokenChoicePanel() {
+    public boolean TokenChoicePanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -235,7 +238,7 @@ public class ConfigureDRM {
         if (token_name.equalsIgnoreCase("internal")) {
             query_string = "p=1" + "&op=next" + "&xml=true" +
                            "&choice=" +
-                           URLEncoder.encode("Internal Key Storage Token");
+                           URLEncoder.encode("Internal Key Storage Token", "UTF-8");
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
 
             // parse xml
@@ -246,9 +249,9 @@ public class ConfigureDRM {
             // login to hsm first
             query_string = "p=2" + "&op=next" + "&xml=true" +
                             "&uTokName=" +
-                            URLEncoder.encode(token_name) +
+                            URLEncoder.encode(token_name, "UTF-8") +
                             "&__uPasswd=" +
-                            URLEncoder.encode(token_pwd);
+                            URLEncoder.encode(token_pwd, "UTF-8");
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
 
             // parse xml
@@ -259,7 +262,7 @@ public class ConfigureDRM {
             // choice with token name now
             query_string = "p=1" + "&op=next" + "&xml=true" +
                            "&choice=" +
-                           URLEncoder.encode(token_name);
+                           URLEncoder.encode(token_name, "UTF-8");
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
 
             // parse xml
@@ -271,7 +274,7 @@ public class ConfigureDRM {
         return true;
     }
 
-    public boolean DomainPanel() {
+    public boolean DomainPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -279,7 +282,7 @@ public class ConfigureDRM {
         String domain_url = "https://" + sd_hostname + ":" + sd_admin_port;
 
         String query_string = "sdomainURL=" +
-                            URLEncoder.encode(domain_url) +
+                            URLEncoder.encode(domain_url, "UTF-8") +
                             "&choice=existingdomain" +
                             "&p=3" +
                             "&op=next" +
@@ -312,13 +315,13 @@ public class ConfigureDRM {
                             "/kra/admin/console/config/wizard" +
                             "?p=5&subsystem=KRA";
 
-            String query_string = "url=" + URLEncoder.encode(kra_url);
+            String query_string = "url=" + URLEncoder.encode(kra_url, "UTF-8");
 
             hr = hc.sslConnect(sd_hostname, sd_admin_port, sd_login_uri, query_string);
 
             String query_string_1 = "uid=" + sd_admin_name +
-                                "&pwd=" + URLEncoder.encode(sd_admin_password) +
-                                "&url=" + URLEncoder.encode(kra_url);
+                                "&pwd=" + URLEncoder.encode(sd_admin_password, "UTF-8") +
+                                "&url=" + URLEncoder.encode(kra_url, "UTF-8");
 
             hr = hc.sslConnect(sd_hostname, sd_admin_port, sd_get_cookie_uri,
                         query_string_1);
@@ -362,7 +365,7 @@ public class ConfigureDRM {
         }
     }
 
-    public boolean SubsystemPanel() {
+    public boolean SubsystemPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -370,11 +373,11 @@ public class ConfigureDRM {
         if (!clone) {
             query_string = "p=5" + "&op=next" + "&xml=true"
                     + "&choice=newsubsystem" + "&subsystemName="
-                    + URLEncoder.encode(subsystem_name);
+                    + URLEncoder.encode(subsystem_name, "UTF-8");
         } else {
             query_string = "p=5" + "&op=next" + "&xml=true"
                     + "&choice=clonesubsystem" + "&subsystemName="
-                    + URLEncoder.encode(subsystem_name)
+                    + URLEncoder.encode(subsystem_name, "UTF-8")
                     + "&urls=" + urls;
         }
 
@@ -394,8 +397,8 @@ public class ConfigureDRM {
             ParseXML px = new ParseXML();
 
             String query_string = "p=6" + "&op=next" + "&xml=true"
-                    + "&__password=" + URLEncoder.encode(clone_p12_passwd)
-                    + "&path=" + URLEncoder.encode(clone_p12_file) + "";
+                    + "&__password=" + URLEncoder.encode(clone_p12_passwd, "UTF-8")
+                    + "&path=" + URLEncoder.encode(clone_p12_file, "UTF-8") + "";
 
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
 
@@ -411,21 +414,23 @@ public class ConfigureDRM {
         }
     }
 
-    public boolean LdapConnectionPanel() {
+    public boolean LdapConnectionPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=7" + "&op=next" + "&xml=true" +
-                              "&host=" + URLEncoder.encode(ldap_host) +
-                              "&port=" + URLEncoder.encode(ldap_port) +
-                              "&binddn=" + URLEncoder.encode(bind_dn) +
-                              "&__bindpwd=" + URLEncoder.encode(bind_password) +
-                              "&basedn=" + URLEncoder.encode(base_dn) +
-                              "&database=" + URLEncoder.encode(db_name) +
-                              "&display=" + URLEncoder.encode("$displayStr") +
+                              "&host=" + URLEncoder.encode(ldap_host, "UTF-8") +
+                              "&port=" + URLEncoder.encode(ldap_port, "UTF-8") +
+                              "&binddn=" + URLEncoder.encode(bind_dn, "UTF-8") +
+                              "&__bindpwd=" + URLEncoder.encode(bind_password, "UTF-8") +
+                              "&basedn=" + URLEncoder.encode(base_dn, "UTF-8") +
+                              "&database=" + URLEncoder.encode(db_name, "UTF-8") +
+                              "&display=" + URLEncoder.encode("$displayStr", "UTF-8") +
                               (secure_conn.equals("true") ? "&secureConn=on" : "") +
-                              (clone_start_tls.equals("true") ? "&cloneStartTLS=on" : "") +
+                              "&masterReplicationPort=" + URLEncoder.encode(clone_master_port, "UTF-8") +
+                              "&cloneReplicationPort=" + URLEncoder.encode(clone_replica_port, "UTF-8") +
+                              "&replicationSecurity=" + URLEncoder.encode(clone_replication_security, "UTF-8") +
                               (remove_data.equals("true") ? "&removeData=true" : "");
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -525,7 +530,7 @@ public class ConfigureDRM {
         return true;
     }
 
-    public boolean CertSubjectPanel() {
+    public boolean CertSubjectPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -539,23 +544,23 @@ public class ConfigureDRM {
         if (!clone) {
             query_string = "p=9" + "&op=next" + "&xml=true" +
                     "&subsystem=" +
-                    URLEncoder.encode(drm_subsystem_cert_subject_name) +
+                    URLEncoder.encode(drm_subsystem_cert_subject_name, "UTF-8") +
                     "&transport=" +
-                    URLEncoder.encode(drm_transport_cert_subject_name) +
+                    URLEncoder.encode(drm_transport_cert_subject_name, "UTF-8") +
                     "&storage=" +
-                    URLEncoder.encode(drm_storage_cert_subject_name) +
+                    URLEncoder.encode(drm_storage_cert_subject_name, "UTF-8") +
                     "&sslserver=" +
-                    URLEncoder.encode(drm_server_cert_subject_name) +
+                    URLEncoder.encode(drm_server_cert_subject_name, "UTF-8") +
                     "&audit_signing=" +
-                    URLEncoder.encode(drm_audit_signing_cert_subject_name) +
+                    URLEncoder.encode(drm_audit_signing_cert_subject_name, "UTF-8") +
                     "&urls=" +
-                    URLEncoder.encode(domain_url);
+                    URLEncoder.encode(domain_url, "UTF-8");
         } else {
             query_string = "p=9" + "&op=next" + "&xml=true" +
                     "&sslserver=" +
-                    URLEncoder.encode(drm_server_cert_subject_name) +
+                    URLEncoder.encode(drm_server_cert_subject_name, "UTF-8") +
                     "&urls=" +
-                    URLEncoder.encode(domain_url);
+                    URLEncoder.encode(domain_url, "UTF-8");
         }
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -595,26 +600,26 @@ public class ConfigureDRM {
         return true;
     }
 
-    public boolean CertificatePanel() {
+    public boolean CertificatePanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=10" + "&op=next" + "&xml=true" +
                             "&subsystem=" +
-                            URLEncoder.encode(drm_subsystem_cert_cert) +
+                            URLEncoder.encode(drm_subsystem_cert_cert, "UTF-8") +
                             "&subsystem_cc=" +
                             "&transport=" +
-                            URLEncoder.encode(drm_transport_cert_cert) +
+                            URLEncoder.encode(drm_transport_cert_cert, "UTF-8") +
                             "&transport_cc=" +
                             "&storage=" +
-                            URLEncoder.encode(drm_storage_cert_cert) +
+                            URLEncoder.encode(drm_storage_cert_cert, "UTF-8") +
                             "&storage_cc=" +
                             "&sslserver=" +
-                            URLEncoder.encode(server_cert_cert) +
+                            URLEncoder.encode(server_cert_cert, "UTF-8") +
                             "&sslserver_cc=" +
                             "&audit_signing=" +
-                            URLEncoder.encode(drm_audit_signing_cert_cert) +
+                            URLEncoder.encode(drm_audit_signing_cert_cert, "UTF-8") +
                             "&audit_signing_cc=";
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -627,15 +632,15 @@ public class ConfigureDRM {
         return true;
     }
 
-    public boolean BackupPanel() {
+    public boolean BackupPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=11" + "&op=next" + "&xml=true" +
                             "&choice=backupkey" +
-                            "&__pwd=" + URLEncoder.encode(backup_pwd) +
-                            "&__pwdagain=" + URLEncoder.encode(backup_pwd);
+                            "&__pwd=" + URLEncoder.encode(backup_pwd, "UTF-8") +
+                            "&__pwdagain=" + URLEncoder.encode(backup_pwd, "UTF-8");
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
 
@@ -706,7 +711,7 @@ public class ConfigureDRM {
         return true;
     }
 
-    public boolean AdminCertReqPanel() {
+    public boolean AdminCertReqPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -736,19 +741,19 @@ public class ConfigureDRM {
                             "&cert_request_type=" + "crmf" +
                             "&uid=" + admin_user +
                             "&name=" + admin_user +
-                            "&__pwd=" + URLEncoder.encode(admin_password) +
-                            "&__admin_password_again=" + URLEncoder.encode(admin_password) +
+                            "&__pwd=" + URLEncoder.encode(admin_password, "UTF-8") +
+                            "&__admin_password_again=" + URLEncoder.encode(admin_password, "UTF-8") +
                             "&profileId=" + "caAdminCert" +
                             "&email=" +
-                            URLEncoder.encode(admin_email) +
+                            URLEncoder.encode(admin_email, "UTF-8") +
                             "&cert_request=" +
-                            URLEncoder.encode(admin_cert_request) +
+                            URLEncoder.encode(admin_cert_request, "UTF-8") +
                             "&subject=" +
-                            URLEncoder.encode(agent_cert_subject) +
+                            URLEncoder.encode(agent_cert_subject, "UTF-8") +
                             "&clone=new" +
                             "&import=true" +
                             "&securitydomain=" +
-                            URLEncoder.encode(domain_name);
+                            URLEncoder.encode(domain_name, "UTF-8");
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
 
@@ -800,14 +805,14 @@ public class ConfigureDRM {
         return true;
     }
 
-    public boolean UpdateDomainPanel() {
+    public boolean UpdateDomainPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=14" + "&op=next" + "&xml=true" +
-                            "&caHost=" + URLEncoder.encode(sd_hostname) +
-                            "&caPort=" + URLEncoder.encode(sd_agent_port);
+                            "&caHost=" + URLEncoder.encode(sd_hostname, "UTF-8") +
+                            "&caPort=" + URLEncoder.encode(sd_agent_port, "UTF-8");
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
 
@@ -819,7 +824,7 @@ public class ConfigureDRM {
         return true;
     }
 
-    public boolean ConfigureDRMInstance() {
+    public boolean ConfigureDRMInstance() throws UnsupportedEncodingException {
         // 0. login to cert db
         ComCrypto cCrypt = new ComCrypto(client_certdb_dir,
                                         client_certdb_pwd,
@@ -980,7 +985,7 @@ public class ConfigureDRM {
         }
     }
 
-    public static void main(String args[]) {
+    public static void main(String args[]) throws UnsupportedEncodingException {
         ConfigureDRM ca = new ConfigureDRM();
 
         // set variables
@@ -1016,7 +1021,6 @@ public class ConfigureDRM {
         StringHolder x_base_dn = new StringHolder();
         StringHolder x_db_name = new StringHolder();
         StringHolder x_secure_conn = new StringHolder();
-        StringHolder x_clone_start_tls = new StringHolder();
         StringHolder x_remove_data = new StringHolder();
 
         // key properties (defaults)
@@ -1077,6 +1081,9 @@ public class ConfigureDRM {
         StringHolder x_clone_uri = new StringHolder();
         StringHolder x_clone_p12_file = new StringHolder();
         StringHolder x_clone_p12_passwd = new StringHolder();
+        StringHolder x_clone_master_port = new StringHolder();
+        StringHolder x_clone_replica_port = new StringHolder();
+        StringHolder x_clone_replication_security = new StringHolder();
 
         // parse the args
         ArgParser parser = new ArgParser("ConfigureDRM");
@@ -1138,9 +1145,6 @@ public class ConfigureDRM {
         parser.addOption("-secure_conn %s #use ldaps port (optional, default is false)", x_secure_conn);
         parser.addOption("-remove_data %s #remove existing data under base_dn (optional, default is false) ",
                 x_remove_data);
-        parser.addOption(
-                "-clone_start_tls %s #use startTLS for cloning replication agreement (optional, default is false)",
-                x_clone_start_tls);
 
         // key and algorithm options (default)
         parser.addOption("-key_type %s #Key type [RSA,ECC] (optional, default is RSA)", x_key_type);
@@ -1240,6 +1244,15 @@ public class ConfigureDRM {
                 x_clone_p12_file);
         parser.addOption("-clone_p12_password %s #Password for pk12 file (optional, required if -clone=true)",
                 x_clone_p12_passwd);
+        
+        // replication agreement options
+        parser.addOption("-clone_master_port %s #Master Port to be used in replication agreement (optional)",
+                x_clone_master_port);
+        parser.addOption("-clone_replica_port %s #Replica Port to be used in replication agreement (optional)",
+                x_clone_replica_port);
+        parser.addOption("-clone_replication_security %s #Type of security in replication agreement (optional)",
+                x_clone_replication_security);
+        
 
         // and then match the arguments
         String[] unmatched = null;
@@ -1285,7 +1298,6 @@ public class ConfigureDRM {
         db_name = x_db_name.value;
         secure_conn = set_default(x_secure_conn.value, "false");
         remove_data = set_default(x_remove_data.value, "false");
-        clone_start_tls = set_default(x_clone_start_tls.value, "false");
 
         key_type = set_default(x_key_type.value, DEFAULT_KEY_TYPE);
         transport_key_type = set_default(x_transport_key_type.value, key_type);
@@ -1344,6 +1356,9 @@ public class ConfigureDRM {
         clone_uri = x_clone_uri.value;
         clone_p12_file = x_clone_p12_file.value;
         clone_p12_passwd = x_clone_p12_passwd.value;
+        clone_master_port = set_default(x_clone_master_port.value, "");
+        clone_replica_port = set_default(x_clone_replica_port.value, "");
+        clone_replication_security = set_default(x_clone_replication_security.value, "None");
 
         boolean st = ca.ConfigureDRMInstance();
 
diff --git a/pki/base/silent/src/com/netscape/pkisilent/ConfigureOCSP.java b/pki/base/silent/src/com/netscape/pkisilent/ConfigureOCSP.java
index 149c79dff2586b9aa1045a1d2735bac5914684b2..8411e24d7b8d4f3c8c8f75080c5c3d70a1751628 100644
--- a/pki/base/silent/src/com/netscape/pkisilent/ConfigureOCSP.java
+++ b/pki/base/silent/src/com/netscape/pkisilent/ConfigureOCSP.java
@@ -24,6 +24,7 @@ import java.io.ByteArrayInputStream;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.InputStreamReader;
+import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
 import java.util.ArrayList;
 
@@ -93,7 +94,6 @@ public class ConfigureOCSP {
     public static String base_dn = null;
     public static String db_name = null;
     public static String secure_conn = null;
-    public static String clone_start_tls = null;
     public static String remove_data = null;
 
     public static String key_type = null;
@@ -153,7 +153,7 @@ public class ConfigureOCSP {
     public static String ocsp_subsystem_cert_subject_name = null;
     public static String ocsp_server_cert_subject_name = null;
     public static String ocsp_audit_signing_cert_subject_name = null;
-
+    
     public static String subsystem_name = null;
 
     public ConfigureOCSP() {
@@ -206,7 +206,7 @@ public class ConfigureOCSP {
         return st;
     }
 
-    public boolean TokenChoicePanel() {
+    public boolean TokenChoicePanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -216,9 +216,7 @@ public class ConfigureOCSP {
         // Software Token
         if (token_name.equalsIgnoreCase("internal")) {
             query_string = "p=1" + "&op=next" + "&xml=true" +
-                            "&choice=" +
-                    URLEncoder.encode("Internal Key Storage Token") +
-                                "";
+                            "&choice=" + URLEncoder.encode("Internal Key Storage Token", "UTF-8");
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
             // parse xml
             bais = new ByteArrayInputStream(hr.getHTML().getBytes());
@@ -230,10 +228,9 @@ public class ConfigureOCSP {
             // login to hsm first
             query_string = "p=2" + "&op=next" + "&xml=true" +
                             "&uTokName=" +
-                            URLEncoder.encode(token_name) +
+                            URLEncoder.encode(token_name, "UTF-8") +
                             "&__uPasswd=" +
-                            URLEncoder.encode(token_pwd) +
-                            "";
+                            URLEncoder.encode(token_pwd, "UTF-8");
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
             // parse xml
             bais = new ByteArrayInputStream(hr.getHTML().getBytes());
@@ -243,8 +240,7 @@ public class ConfigureOCSP {
             // choice with token name now
             query_string = "p=1" + "&op=next" + "&xml=true" +
                             "&choice=" +
-                            URLEncoder.encode(token_name) +
-                            "";
+                            URLEncoder.encode(token_name, "UTF-8");
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
             // parse xml
             bais = new ByteArrayInputStream(hr.getHTML().getBytes());
@@ -255,7 +251,7 @@ public class ConfigureOCSP {
         return true;
     }
 
-    public boolean DomainPanel() {
+    public boolean DomainPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -263,7 +259,7 @@ public class ConfigureOCSP {
         String domain_url = "https://" + sd_hostname + ":" + sd_admin_port;
 
         String query_string = "sdomainURL=" +
-                            URLEncoder.encode(domain_url) +
+                            URLEncoder.encode(domain_url, "UTF-8") +
                             "&choice=existingdomain" +
                             "&p=3" +
                             "&op=next" +
@@ -294,20 +290,20 @@ public class ConfigureOCSP {
 
     }
 
-    public boolean SecurityDomainLoginPanel() {
+    public boolean SecurityDomainLoginPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
 
         String ocsp_url = "https://" + cs_hostname + ":" + cs_port +
                             "/ocsp/admin/console/config/wizard" +
                             "?p=5&subsystem=OCSP";
 
-        String query_string = "url=" + URLEncoder.encode(ocsp_url);
+        String query_string = "url=" + URLEncoder.encode(ocsp_url, "UTF-8");
 
         hr = hc.sslConnect(sd_hostname, sd_admin_port, sd_login_uri, query_string);
 
         String query_string_1 = "uid=" + sd_admin_name +
-                                "&pwd=" + URLEncoder.encode(sd_admin_password) +
-                                "&url=" + URLEncoder.encode(ocsp_url);
+                                "&pwd=" + URLEncoder.encode(sd_admin_password, "UTF-8") +
+                                "&url=" + URLEncoder.encode(ocsp_url, "UTF-8");
 
         hr = hc.sslConnect(sd_hostname, sd_admin_port, sd_get_cookie_uri,
                         query_string_1);
@@ -330,23 +326,18 @@ public class ConfigureOCSP {
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri,
                         query_string_2);
 
-        // parse xml
-        // bais = new ByteArrayInputStream(hr.getHTML().getBytes());
-        // px.parse(bais);
-        // px.prettyprintxml();
-
         return true;
 
     }
 
-    public boolean SubsystemPanel() {
+    public boolean SubsystemPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=5" + "&op=next" + "&xml=true" +
                         "&subsystemName=" +
-                        URLEncoder.encode(subsystem_name) +
+                        URLEncoder.encode(subsystem_name, "UTF-8") +
                         "&choice=newsubsystem";
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -358,21 +349,20 @@ public class ConfigureOCSP {
         return true;
     }
 
-    public boolean LdapConnectionPanel() {
+    public boolean LdapConnectionPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=7" + "&op=next" + "&xml=true" +
-                                "&host=" + URLEncoder.encode(ldap_host) +
-                                "&port=" + URLEncoder.encode(ldap_port) +
-                                "&binddn=" + URLEncoder.encode(bind_dn) +
-                                "&__bindpwd=" + URLEncoder.encode(bind_password) +
-                                "&basedn=" + URLEncoder.encode(base_dn) +
-                                "&database=" + URLEncoder.encode(db_name) +
-                                "&display=" + URLEncoder.encode("$displayStr") +
+                                "&host=" + URLEncoder.encode(ldap_host, "UTF-8") +
+                                "&port=" + URLEncoder.encode(ldap_port, "UTF-8") +
+                                "&binddn=" + URLEncoder.encode(bind_dn, "UTF-8") +
+                                "&__bindpwd=" + URLEncoder.encode(bind_password, "UTF-8") +
+                                "&basedn=" + URLEncoder.encode(base_dn, "UTF-8") +
+                                "&database=" + URLEncoder.encode(db_name, "UTF-8") +
+                                "&display=" + URLEncoder.encode("$displayStr", "UTF-8") +
                                 (secure_conn.equals("true") ? "&secureConn=on" : "") +
-                                (clone_start_tls.equals("true") ? "&cloneStartTLS=on" : "") +
                                 (remove_data.equals("true") ? "&removeData=true" : "");
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -447,7 +437,7 @@ public class ConfigureOCSP {
         return true;
     }
 
-    public boolean CertSubjectPanel() {
+    public boolean CertSubjectPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -459,15 +449,15 @@ public class ConfigureOCSP {
 
         String query_string = "p=9" + "&op=next" + "&xml=true" +
                 "&subsystem=" +
-                URLEncoder.encode(ocsp_subsystem_cert_subject_name) +
+                URLEncoder.encode(ocsp_subsystem_cert_subject_name, "UTF-8") +
                 "&signing=" +
-                URLEncoder.encode(ocsp_sign_cert_subject_name) +
+                URLEncoder.encode(ocsp_sign_cert_subject_name, "UTF-8") +
                 "&sslserver=" +
-                URLEncoder.encode(ocsp_server_cert_subject_name) +
+                URLEncoder.encode(ocsp_server_cert_subject_name, "UTF-8") +
                 "&audit_signing=" +
-                URLEncoder.encode(ocsp_audit_signing_cert_subject_name) +
+                URLEncoder.encode(ocsp_audit_signing_cert_subject_name, "UTF-8") +
                 "&urls=" +
-                URLEncoder.encode(domain_url) +
+                URLEncoder.encode(domain_url, "UTF-8") +
                 "";
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -504,25 +494,24 @@ public class ConfigureOCSP {
         return true;
     }
 
-    public boolean CertificatePanel() {
+    public boolean CertificatePanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=10" + "&op=next" + "&xml=true" +
                             "&subsystem=" +
-                            URLEncoder.encode(ocsp_subsystem_cert_cert) +
+                            URLEncoder.encode(ocsp_subsystem_cert_cert, "UTF-8") +
                             "&subsystem_cc=" +
                             "&signing=" +
-                            URLEncoder.encode(ocsp_signing_cert_cert) +
+                            URLEncoder.encode(ocsp_signing_cert_cert, "UTF-8") +
                             "&signing_cc=" +
                             "&sslserver=" +
-                            URLEncoder.encode(server_cert_cert) +
+                            URLEncoder.encode(server_cert_cert, "UTF-8") +
                             "&sslserver_cc=" +
                             "&audit_signing=" +
-                            URLEncoder.encode(ocsp_audit_signing_cert_cert) +
-                            "&audit_signing_cc=" +
-                            "";
+                            URLEncoder.encode(ocsp_audit_signing_cert_cert, "UTF-8") +
+                            "&audit_signing_cc=";
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
 
@@ -537,15 +526,15 @@ public class ConfigureOCSP {
         return true;
     }
 
-    public boolean BackupPanel() {
+    public boolean BackupPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=11" + "&op=next" + "&xml=true" +
                             "&choice=backupkey" +
-                            "&__pwd=" + URLEncoder.encode(backup_pwd) +
-                            "&__pwdagain=" + URLEncoder.encode(backup_pwd);
+                            "&__pwd=" + URLEncoder.encode(backup_pwd, "UTF-8") +
+                            "&__pwdagain=" + URLEncoder.encode(backup_pwd, "UTF-8");
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
 
@@ -605,7 +594,7 @@ public class ConfigureOCSP {
         return true;
     }
 
-    public boolean AdminCertReqPanel() {
+    public boolean AdminCertReqPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -635,20 +624,19 @@ public class ConfigureOCSP {
                             "&cert_request_type=" + "crmf" +
                             "&uid=" + admin_user +
                             "&name=" + admin_user +
-                            "&__pwd=" + URLEncoder.encode(admin_password) +
-                            "&__admin_password_again=" + URLEncoder.encode(admin_password) +
+                            "&__pwd=" + URLEncoder.encode(admin_password, "UTF-8") +
+                            "&__admin_password_again=" + URLEncoder.encode(admin_password, "UTF-8") +
                             "&profileId=" + "caAdminCert" +
                             "&email=" +
-                            URLEncoder.encode(admin_email) +
+                            URLEncoder.encode(admin_email, "UTF-8") +
                             "&cert_request=" +
-                            URLEncoder.encode(admin_cert_request) +
+                            URLEncoder.encode(admin_cert_request, "UTF-8") +
                             "&subject=" +
-                            URLEncoder.encode(agent_cert_subject) +
+                            URLEncoder.encode(agent_cert_subject, "UTF-8") +
                             "&clone=new" +
                             "&import=true" +
                             "&securitydomain=" +
-                            URLEncoder.encode(domain_name) +
-                            "";
+                            URLEncoder.encode(domain_name, "UTF-8");
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
 
@@ -701,15 +689,14 @@ public class ConfigureOCSP {
         return true;
     }
 
-    public boolean UpdateDomainPanel() {
+    public boolean UpdateDomainPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=14" + "&op=next" + "&xml=true" +
-                            "&caHost=" + URLEncoder.encode(sd_hostname) +
-                            "&caPort=" + URLEncoder.encode(sd_agent_port) +
-                            "";
+                            "&caHost=" + URLEncoder.encode(sd_hostname, "UTF-8") +
+                            "&caPort=" + URLEncoder.encode(sd_agent_port, "UTF-8");
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
 
@@ -721,7 +708,7 @@ public class ConfigureOCSP {
         return true;
     }
 
-    public boolean ConfigureOCSPInstance() {
+    public boolean ConfigureOCSPInstance() throws UnsupportedEncodingException {
         // 0. login to cert db
         ComCrypto cCrypt = new ComCrypto(client_certdb_dir,
                                         client_certdb_pwd,
@@ -867,7 +854,7 @@ public class ConfigureOCSP {
         }
     }
 
-    public static void main(String args[]) {
+    public static void main(String args[]) throws UnsupportedEncodingException {
         ConfigureOCSP ca = new ConfigureOCSP();
 
         // set variables
@@ -903,7 +890,6 @@ public class ConfigureOCSP {
         StringHolder x_base_dn = new StringHolder();
         StringHolder x_db_name = new StringHolder();
         StringHolder x_secure_conn = new StringHolder();
-        StringHolder x_clone_start_tls = new StringHolder();
         StringHolder x_remove_data = new StringHolder();
 
         // key properties (defaults)
@@ -1013,9 +999,6 @@ public class ConfigureOCSP {
         parser.addOption("-secure_conn %s #use ldaps port (optional, default is false)", x_secure_conn);
         parser.addOption("-remove_data %s #remove existing data under base_dn (optional, default is false) ",
                 x_remove_data);
-        parser.addOption(
-                "-clone_start_tls %s #use startTLS for cloning replication agreement (optional, default is false)",
-                x_clone_start_tls);
 
         // key and algorithm options (default)
         parser.addOption("-key_type %s #Key type [RSA,ECC] (optional, default is RSA)", x_key_type);
@@ -1139,7 +1122,6 @@ public class ConfigureOCSP {
         db_name = x_db_name.value;
         secure_conn = set_default(x_secure_conn.value, "false");
         remove_data = set_default(x_remove_data.value, "false");
-        clone_start_tls = set_default(x_clone_start_tls.value, "false");
 
         key_type = set_default(x_key_type.value, DEFAULT_KEY_TYPE);
         signing_key_type = set_default(x_signing_key_type.value, key_type);
diff --git a/pki/base/silent/src/com/netscape/pkisilent/ConfigureRA.java b/pki/base/silent/src/com/netscape/pkisilent/ConfigureRA.java
index 2d109595a12eeb98c355b0c32622e8301848e35f..3de70a0670f9f37f632b34684511cddb7b9181f7 100644
--- a/pki/base/silent/src/com/netscape/pkisilent/ConfigureRA.java
+++ b/pki/base/silent/src/com/netscape/pkisilent/ConfigureRA.java
@@ -19,6 +19,7 @@ package com.netscape.pkisilent;
 // --- END COPYRIGHT BLOCK ---
 
 import java.io.ByteArrayInputStream;
+import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
 
 import com.netscape.pkisilent.argparser.ArgParser;
@@ -158,7 +159,7 @@ public class ConfigureRA {
         return st;
     }
 
-    public boolean DomainPanel() {
+    public boolean DomainPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -168,7 +169,7 @@ public class ConfigureRA {
         String query_string = "p=1" +
                             "&choice=existingdomain" +
                             "&sdomainURL=" +
-                            URLEncoder.encode(domain_url) +
+                            URLEncoder.encode(domain_url, "UTF-8") +
                             "&op=next" +
                             "&xml=true";
 
@@ -191,20 +192,20 @@ public class ConfigureRA {
 
     }
 
-    public boolean SecurityDomainLoginPanel() {
+    public boolean SecurityDomainLoginPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
 
         String ra_url = "https://" + cs_hostname + ":" + cs_port +
                             "/ra/admin/console/config/wizard" +
                             "?p=3&subsystem=RA";
 
-        String query_string = "url=" + URLEncoder.encode(ra_url) + "";
+        String query_string = "url=" + URLEncoder.encode(ra_url, "UTF-8") + "";
 
         hr = hc.sslConnect(sd_hostname, sd_admin_port, sd_login_uri, query_string);
 
         String query_string_1 = "uid=" + sd_admin_name +
-                                "&pwd=" + URLEncoder.encode(sd_admin_password) +
-                                "&url=" + URLEncoder.encode(ra_url) +
+                                "&pwd=" + URLEncoder.encode(sd_admin_password, "UTF-8") +
+                                "&url=" + URLEncoder.encode(ra_url, "UTF-8") +
                                 "";
 
         hr = hc.sslConnect(sd_hostname, sd_admin_port, sd_get_cookie_uri,
@@ -235,7 +236,7 @@ public class ConfigureRA {
 
     }
 
-    public boolean SubsystemPanel() {
+    public boolean SubsystemPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -244,7 +245,7 @@ public class ConfigureRA {
         String query_string = "p=3" +
                         "&choice=newsubsystem" +
                         "&subsystemName=" +
-                        URLEncoder.encode(subsystem_name) +
+                        URLEncoder.encode(subsystem_name, "UTF-8") +
                         "&op=next" +
                         "&xml=true";
 
@@ -290,7 +291,7 @@ public class ConfigureRA {
         return true;
     }
 
-    public boolean TokenChoicePanel() {
+    public boolean TokenChoicePanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -302,7 +303,7 @@ public class ConfigureRA {
         if (token_name.equalsIgnoreCase("internal")) {
             query_string = "p=6" +
                             "&choice=" +
-                            URLEncoder.encode("NSS Certificate DB") +
+                            URLEncoder.encode("NSS Certificate DB", "UTF-8") +
                             "&op=next" +
                             "&xml=true";
 
@@ -317,9 +318,9 @@ public class ConfigureRA {
             // login to hsm first
             query_string = "p=7" +
                             "&uTokName=" +
-                            URLEncoder.encode(token_name) +
+                            URLEncoder.encode(token_name, "UTF-8") +
                             "&__uPasswd=" +
-                            URLEncoder.encode(token_pwd) +
+                            URLEncoder.encode(token_pwd, "UTF-8") +
                             "&op=next" +
                             "&xml=true";
 
@@ -332,7 +333,7 @@ public class ConfigureRA {
             // choice with token name now
             query_string = "p=6" +
                             "&choice=" +
-                            URLEncoder.encode(token_name) +
+                            URLEncoder.encode(token_name, "UTF-8") +
                             "&op=next" +
                             "&xml=true";
 
@@ -375,20 +376,20 @@ public class ConfigureRA {
         return true;
     }
 
-    public boolean CertSubjectPanel() {
+    public boolean CertSubjectPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=9" +
                     "&sslserver=" +
-                    URLEncoder.encode(ra_server_cert_subject_name) +
+                    URLEncoder.encode(ra_server_cert_subject_name, "UTF-8") +
                     "&sslserver_nick=" +
-                    URLEncoder.encode(ra_server_cert_nickname) +
+                    URLEncoder.encode(ra_server_cert_nickname, "UTF-8") +
                     "&subsystem=" +
-                    URLEncoder.encode(ra_subsystem_cert_subject_name) +
+                    URLEncoder.encode(ra_subsystem_cert_subject_name, "UTF-8") +
                     "&subsystem_nick=" +
-                    URLEncoder.encode(ra_subsystem_cert_nickname) +
+                    URLEncoder.encode(ra_subsystem_cert_nickname, "UTF-8") +
                     "&urls=0" +
                     "&op=next" +
                     "&xml=true";
@@ -426,7 +427,7 @@ public class ConfigureRA {
         return true;
     }
 
-    public boolean AdminCertReqPanel() {
+    public boolean AdminCertReqPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -457,13 +458,13 @@ public class ConfigureRA {
         String query_string = "p=11" +
                             "&uid=" + admin_user +
                             "&name=" +
-                            URLEncoder.encode("RA Administrator") +
+                            URLEncoder.encode("RA Administrator", "UTF-8") +
                             "&email=" +
-                            URLEncoder.encode(admin_email) +
-                            "&__pwd=" + URLEncoder.encode(admin_password) +
-                            "&__admin_password_again=" + URLEncoder.encode(admin_password) +
+                            URLEncoder.encode(admin_email, "UTF-8") +
+                            "&__pwd=" + URLEncoder.encode(admin_password, "UTF-8") +
+                            "&__admin_password_again=" + URLEncoder.encode(admin_password, "UTF-8") +
                             "&cert_request=" +
-                            URLEncoder.encode(admin_cert_request) +
+                            URLEncoder.encode(admin_cert_request, "UTF-8") +
                             "&display=0" +
                             "&profileId=" + "caAdminCert" +
                             "&cert_request_type=" + "crmf" +
@@ -471,11 +472,11 @@ public class ConfigureRA {
                             "&uid=" + admin_user +
                             "&clone=0" +
                             "&securitydomain=" +
-                            URLEncoder.encode(domain_name) +
+                            URLEncoder.encode(domain_name, "UTF-8") +
                             "&subject=" +
-                            URLEncoder.encode(agent_cert_subject) +
+                            URLEncoder.encode(agent_cert_subject, "UTF-8") +
                             "&requestor_name=" +
-                            URLEncoder.encode(requestor_name) +
+                            URLEncoder.encode(requestor_name, "UTF-8") +
                             "&sessionID=" + ra_session_id +
                             "&auth_hostname=" + ca_hostname +
                             "&auth_port=" + ca_ssl_port +
@@ -494,7 +495,7 @@ public class ConfigureRA {
         return true;
     }
 
-    public boolean AdminCertImportPanel() {
+    public boolean AdminCertImportPanel() throws UnsupportedEncodingException {
         boolean st = false;
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
@@ -547,7 +548,7 @@ public class ConfigureRA {
         String query_string_1 = "p=12" +
                                 "&serialNumber=" + admin_serial_number +
                                 "&caHost=" +
-                                URLEncoder.encode(ca_hostname) +
+                                URLEncoder.encode(ca_hostname, "UTF-8") +
                                 "&caPort=" + ca_admin_port +
                                 "&op=next" +
                                 "&xml=true";
@@ -562,7 +563,7 @@ public class ConfigureRA {
         return true;
     }
 
-    public boolean ConfigureRAInstance() {
+    public boolean ConfigureRAInstance() throws UnsupportedEncodingException {
         // 0. login to cert db
         ComCrypto cCrypt = new ComCrypto(client_certdb_dir,
                                         client_certdb_pwd,
@@ -676,7 +677,7 @@ public class ConfigureRA {
         return true;
     }
 
-    public static void main(String args[]) {
+    public static void main(String args[]) throws UnsupportedEncodingException {
         ConfigureRA ca = new ConfigureRA();
 
         // set variables
diff --git a/pki/base/silent/src/com/netscape/pkisilent/ConfigureSubCA.java b/pki/base/silent/src/com/netscape/pkisilent/ConfigureSubCA.java
index 6dacc9e08f1bc537306b74910ffdcc18b91acc40..cbfa59d6aaf31da56af28dec2fe88851a4f9a0f7 100644
--- a/pki/base/silent/src/com/netscape/pkisilent/ConfigureSubCA.java
+++ b/pki/base/silent/src/com/netscape/pkisilent/ConfigureSubCA.java
@@ -19,6 +19,7 @@ package com.netscape.pkisilent;
 // --- END COPYRIGHT BLOCK ---
 
 import java.io.ByteArrayInputStream;
+import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
 import java.util.ArrayList;
 
@@ -210,8 +211,7 @@ public class ConfigureSubCA {
         return st;
     }
 
-    public boolean TokenChoicePanel() {
-        boolean st = false;
+    public boolean TokenChoicePanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -223,7 +223,7 @@ public class ConfigureSubCA {
         if (token_name.equalsIgnoreCase("internal")) {
             query_string = "p=1" + "&op=next" + "&xml=true" +
                             "&choice=" +
-                    URLEncoder.encode("Internal Key Storage Token") +
+                    URLEncoder.encode("Internal Key Storage Token", "UTF-8") +
                                 "";
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
             // parse xml
@@ -236,9 +236,9 @@ public class ConfigureSubCA {
             // login to hsm first
             query_string = "p=2" + "&op=next" + "&xml=true" +
                             "&uTokName=" +
-                            URLEncoder.encode(token_name) +
+                            URLEncoder.encode(token_name, "UTF-8") +
                             "&__uPasswd=" +
-                            URLEncoder.encode(token_pwd) +
+                            URLEncoder.encode(token_pwd, "UTF-8") +
                             "";
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
             // parse xml
@@ -249,7 +249,7 @@ public class ConfigureSubCA {
             // choice with token name now
             query_string = "p=1" + "&op=next" + "&xml=true" +
                             "&choice=" +
-                            URLEncoder.encode(token_name) +
+                            URLEncoder.encode(token_name, "UTF-8") +
                             "";
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
             // parse xml
@@ -262,8 +262,7 @@ public class ConfigureSubCA {
         return true;
     }
 
-    public boolean DomainPanel() {
-        boolean st = false;
+    public boolean DomainPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -271,9 +270,9 @@ public class ConfigureSubCA {
         String domain_url = "https://" + sd_hostname + ":" + sd_admin_port;
 
         String query_string = "sdomainURL=" +
-                            URLEncoder.encode(domain_url) +
+                            URLEncoder.encode(domain_url, "UTF-8") +
                             "&sdomainName=" +
-                            URLEncoder.encode(domain_name) +
+                            URLEncoder.encode(domain_name, "UTF-8") +
                             "&choice=existingdomain" +
                             "&p=3" +
                             "&op=next" +
@@ -296,18 +295,18 @@ public class ConfigureSubCA {
 
     }
 
-    public boolean SecurityDomainLoginPanel() {
+    public boolean SecurityDomainLoginPanel() throws UnsupportedEncodingException {
         String subca_url = "https://" + cs_hostname + ":" + cs_port +
                             "/ca/admin/console/config/wizard" +
                             "?p=5&subsystem=CA";
 
-        String query_string = "url=" + URLEncoder.encode(subca_url);
+        String query_string = "url=" + URLEncoder.encode(subca_url, "UTF-8");
 
         HTTPResponse hr = hc.sslConnect(sd_hostname, sd_admin_port, sd_login_uri, query_string);
 
         String query_string_1 = "uid=" + sd_admin_name +
-                                "&pwd=" + URLEncoder.encode(sd_admin_password) +
-                                "&url=" + URLEncoder.encode(subca_url);
+                                "&pwd=" + URLEncoder.encode(sd_admin_password, "UTF-8") +
+                                "&url=" + URLEncoder.encode(subca_url, "UTF-8");
 
         hr = hc.sslConnect(sd_hostname, sd_admin_port, sd_get_cookie_uri,
                         query_string_1);
@@ -334,13 +333,13 @@ public class ConfigureSubCA {
 
     }
 
-    public boolean DisplayChainPanel() {
+    public boolean DisplayChainPanel() throws UnsupportedEncodingException {
         String query_string = "p=5" + "&op=next" + "&xml=true" +
                         "&choice=newsubsystem" +
                         "&subsystemName=" +
-                        URLEncoder.encode(subsystem_name) +
+                        URLEncoder.encode(subsystem_name, "UTF-8") +
                         "&subsystemName=" +
-                        URLEncoder.encode(subsystem_name) +
+                        URLEncoder.encode(subsystem_name, "UTF-8") +
                         "&urls=0";
         hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
         // parse xml
@@ -352,7 +351,6 @@ public class ConfigureSubCA {
     }
 
     public boolean HierarchyPanel() {
-        boolean st = false;
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -371,20 +369,19 @@ public class ConfigureSubCA {
 
     }
 
-    public boolean LdapConnectionPanel() {
-        boolean st = false;
+    public boolean LdapConnectionPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=9" + "&op=next" + "&xml=true" +
-                                "&host=" + URLEncoder.encode(ldap_host) +
-                                "&port=" + URLEncoder.encode(ldap_port) +
-                                "&basedn=" + URLEncoder.encode(base_dn) +
-                                "&database=" + URLEncoder.encode(db_name) +
-                                "&binddn=" + URLEncoder.encode(bind_dn) +
-                                "&__bindpwd=" + URLEncoder.encode(bind_password) +
-                                "&display=" + URLEncoder.encode("$displayStr") +
+                                "&host=" + URLEncoder.encode(ldap_host, "UTF-8") +
+                                "&port=" + URLEncoder.encode(ldap_port, "UTF-8") +
+                                "&basedn=" + URLEncoder.encode(base_dn, "UTF-8") +
+                                "&database=" + URLEncoder.encode(db_name, "UTF-8") +
+                                "&binddn=" + URLEncoder.encode(bind_dn, "UTF-8") +
+                                "&__bindpwd=" + URLEncoder.encode(bind_password, "UTF-8") +
+                                "&display=" + URLEncoder.encode("$displayStr", "UTF-8") +
                                 (secure_conn.equals("true") ? "&secureConn=on" : "") +
                                 (clone_start_tls.equals("true") ? "&cloneStartTLS=on" : "") +
                                 (remove_data.equals("true") ? "&removeData=true" : "");
@@ -400,7 +397,6 @@ public class ConfigureSubCA {
     }
 
     public boolean KeyPanel() {
-        boolean st = false;
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -473,8 +469,7 @@ public class ConfigureSubCA {
         return true;
     }
 
-    public boolean CertSubjectPanel() {
-        boolean st = false;
+    public boolean CertSubjectPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -484,15 +479,15 @@ public class ConfigureSubCA {
 
         String query_string = "p=11" + "&op=next" + "&xml=true" +
                 "&signing=" +
-                URLEncoder.encode(subca_sign_cert_subject_name) +
+                URLEncoder.encode(subca_sign_cert_subject_name, "UTF-8") +
                 "&ocsp_signing=" +
-                URLEncoder.encode(subca_ocsp_cert_subject_name) +
+                URLEncoder.encode(subca_ocsp_cert_subject_name, "UTF-8") +
                 "&sslserver=" +
-                URLEncoder.encode(subca_server_cert_subject_name) +
+                URLEncoder.encode(subca_server_cert_subject_name, "UTF-8") +
                 "&subsystem=" +
-                URLEncoder.encode(subca_subsystem_cert_subject_name) +
+                URLEncoder.encode(subca_subsystem_cert_subject_name, "UTF-8") +
                 "&audit_signing=" +
-                URLEncoder.encode(subca_audit_signing_cert_subject_name) +
+                URLEncoder.encode(subca_audit_signing_cert_subject_name, "UTF-8") +
                 "&urls=0" +
                 "";
 
@@ -560,26 +555,26 @@ public class ConfigureSubCA {
         return true;
     }
 
-    public boolean CertificatePanel() {
+    public boolean CertificatePanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=12" + "&op=next" + "&xml=true" +
                             "&signing=" +
-                            URLEncoder.encode(ca_cert_cert) +
+                            URLEncoder.encode(ca_cert_cert, "UTF-8") +
                             "&signing_cc=" +
                             "&ocsp_signing=" +
-                            URLEncoder.encode(ocsp_cert_cert) +
+                            URLEncoder.encode(ocsp_cert_cert, "UTF-8") +
                             "&ocsp_signing_cc=" +
                             "&sslserver=" +
-                            URLEncoder.encode(server_cert_cert) +
+                            URLEncoder.encode(server_cert_cert, "UTF-8") +
                             "&sslserver_cc=" +
                             "&subsystem=" +
-                            URLEncoder.encode(ca_subsystem_cert_cert) +
+                            URLEncoder.encode(ca_subsystem_cert_cert, "UTF-8") +
                             "&subsystem_cc=" +
                             "&audit_signing=" +
-                            URLEncoder.encode(ca_audit_signing_cert_cert) +
+                            URLEncoder.encode(ca_audit_signing_cert_cert, "UTF-8") +
                             "&audit_signing_cc=" +
                             "";
 
@@ -593,16 +588,15 @@ public class ConfigureSubCA {
         return true;
     }
 
-    public boolean BackupPanel() {
-        boolean st = false;
+    public boolean BackupPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=13" + "&op=next" + "&xml=true" +
                             "&choice=backupkey" +
-                            "&__pwd=" + URLEncoder.encode(backup_pwd) +
-                            "&__pwdagain=" + URLEncoder.encode(backup_pwd);
+                            "&__pwd=" + URLEncoder.encode(backup_pwd, "UTF-8") +
+                            "&__pwdagain=" + URLEncoder.encode(backup_pwd, "UTF-8");
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
 
@@ -635,7 +629,7 @@ public class ConfigureSubCA {
         }
     }
 
-    public boolean AdminCertReqPanel() {
+    public boolean AdminCertReqPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -663,22 +657,22 @@ public class ConfigureSubCA {
 
         String query_string = "p=16" + "&op=next" + "&xml=true" +
                             "&uid=" + admin_user +
-                            "&name=" + URLEncoder.encode(agent_name) +
+                            "&name=" + URLEncoder.encode(agent_name, "UTF-8") +
                             "&email=" +
-                            URLEncoder.encode(admin_email) +
-                            "&__pwd=" + URLEncoder.encode(admin_password) +
-                            "&__admin_password_again=" + URLEncoder.encode(admin_password) +
+                            URLEncoder.encode(admin_email, "UTF-8") +
+                            "&__pwd=" + URLEncoder.encode(admin_password, "UTF-8") +
+                            "&__admin_password_again=" + URLEncoder.encode(admin_password, "UTF-8") +
                             "&cert_request=" +
-                            URLEncoder.encode(admin_cert_request) +
-                            "&display=" + URLEncoder.encode("$displayStr") +
+                            URLEncoder.encode(admin_cert_request, "UTF-8") +
+                            "&display=" + URLEncoder.encode("$displayStr", "UTF-8") +
                             "&profileId=" + "caAdminCert" +
                             "&cert_request_type=" + "crmf" +
                             "&import=true" +
                             "&uid=" + admin_user +
                             "&securitydomain=" +
-                            URLEncoder.encode(domain_name) +
+                            URLEncoder.encode(domain_name, "UTF-8") +
                             "&subject=" +
-                            URLEncoder.encode(agent_cert_subject) +
+                            URLEncoder.encode(agent_cert_subject, "UTF-8") +
                             "";
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -732,16 +726,15 @@ public class ConfigureSubCA {
         return true;
     }
 
-    public boolean UpdateDomainPanel() {
-        boolean st = false;
+    public boolean UpdateDomainPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=17" +
                             "&serialNumber=" + admin_serial_number +
-                            "&caHost=" + URLEncoder.encode(sd_hostname) +
-                            "&caPort=" + URLEncoder.encode(sd_admin_port) +
+                            "&caHost=" + URLEncoder.encode(sd_hostname, "UTF-8") +
+                            "&caPort=" + URLEncoder.encode(sd_admin_port, "UTF-8") +
                             "&importCert=" + "true" +
                             "&op=next" + "&xml=true" +
                             "";
@@ -764,7 +757,7 @@ public class ConfigureSubCA {
         return true;
     }
 
-    public boolean ConfigureSubCAInstance() {
+    public boolean ConfigureSubCAInstance() throws UnsupportedEncodingException {
         // 0. login to cert db
         ComCrypto cCrypt = new ComCrypto(client_certdb_dir,
                                         client_certdb_pwd,
@@ -909,7 +902,7 @@ public class ConfigureSubCA {
         }
     }
 
-    public static void main(String args[]) {
+    public static void main(String args[]) throws UnsupportedEncodingException {
         ConfigureSubCA ca = new ConfigureSubCA();
 
         // set variables
diff --git a/pki/base/silent/src/com/netscape/pkisilent/ConfigureTKS.java b/pki/base/silent/src/com/netscape/pkisilent/ConfigureTKS.java
index 092658b5085547f0851aa7960277d188c8e3fad3..76069088871d112208f4e56448d921f1831b191f 100644
--- a/pki/base/silent/src/com/netscape/pkisilent/ConfigureTKS.java
+++ b/pki/base/silent/src/com/netscape/pkisilent/ConfigureTKS.java
@@ -24,6 +24,7 @@ import java.io.ByteArrayInputStream;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.InputStreamReader;
+import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
 import java.util.ArrayList;
 
@@ -92,7 +93,6 @@ public class ConfigureTKS {
     public static String base_dn = null;
     public static String db_name = null;
     public static String secure_conn = null;
-    public static String clone_start_tls = null;
     public static String remove_data = null;
 
     public static String key_type = null;
@@ -191,8 +191,7 @@ public class ConfigureTKS {
         return st;
     }
 
-    public boolean TokenChoicePanel() {
-        boolean st = false;
+    public boolean TokenChoicePanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -203,7 +202,7 @@ public class ConfigureTKS {
         if (token_name.equalsIgnoreCase("internal")) {
             query_string = "p=1" + "&op=next" + "&xml=true" +
                             "&choice=" +
-                    URLEncoder.encode("Internal Key Storage Token") +
+                    URLEncoder.encode("Internal Key Storage Token", "UTF-8") +
                                 "";
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
             // parse xml
@@ -216,9 +215,9 @@ public class ConfigureTKS {
             // login to hsm first
             query_string = "p=2" + "&op=next" + "&xml=true" +
                             "&uTokName=" +
-                            URLEncoder.encode(token_name) +
+                            URLEncoder.encode(token_name, "UTF-8") +
                             "&__uPasswd=" +
-                            URLEncoder.encode(token_pwd) +
+                            URLEncoder.encode(token_pwd, "UTF-8") +
                             "";
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
             // parse xml
@@ -229,7 +228,7 @@ public class ConfigureTKS {
             // choice with token name now
             query_string = "p=1" + "&op=next" + "&xml=true" +
                             "&choice=" +
-                            URLEncoder.encode(token_name) +
+                            URLEncoder.encode(token_name, "UTF-8") +
                             "";
             hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
             // parse xml
@@ -241,8 +240,7 @@ public class ConfigureTKS {
         return true;
     }
 
-    public boolean DomainPanel() {
-        boolean st = false;
+    public boolean DomainPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -250,7 +248,7 @@ public class ConfigureTKS {
         String domain_url = "https://" + sd_hostname + ":" + sd_admin_port;
 
         String query_string = "sdomainURL=" +
-                            URLEncoder.encode(domain_url) +
+                            URLEncoder.encode(domain_url, "UTF-8") +
                             "&choice=existingdomain" +
                             "&p=3" +
                             "&op=next" +
@@ -279,18 +277,18 @@ public class ConfigureTKS {
 
     }
 
-    public boolean SecurityDomainLoginPanel() {
+    public boolean SecurityDomainLoginPanel() throws UnsupportedEncodingException {
         String tks_url = "https://" + cs_hostname + ":" + cs_port +
                             "/tks/admin/console/config/wizard" +
                             "?p=5&subsystem=TKS";
 
-        String query_string = "url=" + URLEncoder.encode(tks_url);
+        String query_string = "url=" + URLEncoder.encode(tks_url, "UTF-8");
 
         HTTPResponse hr = hc.sslConnect(sd_hostname, sd_admin_port, sd_login_uri, query_string);
 
         String query_string_1 = "uid=" + sd_admin_name +
-                                "&pwd=" + URLEncoder.encode(sd_admin_password) +
-                                "&url=" + URLEncoder.encode(tks_url);
+                                "&pwd=" + URLEncoder.encode(sd_admin_password, "UTF-8") +
+                                "&url=" + URLEncoder.encode(tks_url, "UTF-8");
 
         hr = hc.sslConnect(sd_hostname, sd_admin_port, sd_get_cookie_uri,
                         query_string_1);
@@ -322,15 +320,14 @@ public class ConfigureTKS {
 
     }
 
-    public boolean SubsystemPanel() {
-        boolean st = false;
+    public boolean SubsystemPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=5" + "&op=next" + "&xml=true" +
                         "&subsystemName=" +
-                        URLEncoder.encode(subsystem_name) +
+                        URLEncoder.encode(subsystem_name, "UTF-8") +
                         "&choice=newsubsystem";
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -342,22 +339,20 @@ public class ConfigureTKS {
         return true;
     }
 
-    public boolean LdapConnectionPanel() {
-        boolean st = false;
+    public boolean LdapConnectionPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=7" + "&op=next" + "&xml=true" +
-                                "&host=" + URLEncoder.encode(ldap_host) +
-                                "&port=" + URLEncoder.encode(ldap_port) +
-                                "&binddn=" + URLEncoder.encode(bind_dn) +
-                            "&__bindpwd=" + URLEncoder.encode(bind_password) +
-                                "&basedn=" + URLEncoder.encode(base_dn) +
-                                "&database=" + URLEncoder.encode(db_name) +
-                                "&display=" + URLEncoder.encode("$displayStr") +
+                                "&host=" + URLEncoder.encode(ldap_host, "UTF-8") +
+                                "&port=" + URLEncoder.encode(ldap_port, "UTF-8") +
+                                "&binddn=" + URLEncoder.encode(bind_dn, "UTF-8") +
+                                "&__bindpwd=" + URLEncoder.encode(bind_password, "UTF-8") +
+                                "&basedn=" + URLEncoder.encode(base_dn, "UTF-8") +
+                                "&database=" + URLEncoder.encode(db_name, "UTF-8") +
+                                "&display=" + URLEncoder.encode("$displayStr", "UTF-8") +
                                 (secure_conn.equals("true") ? "&secureConn=on" : "") +
-                                (clone_start_tls.equals("true") ? "&cloneStartTLS=on" : "") +
                                 (remove_data.equals("true") ? "&removeData=true" : "");
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -371,7 +366,6 @@ public class ConfigureTKS {
     }
 
     public boolean KeyPanel() {
-        boolean st = false;
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -425,8 +419,7 @@ public class ConfigureTKS {
         return true;
     }
 
-    public boolean CertSubjectPanel() {
-        boolean st = false;
+    public boolean CertSubjectPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -438,13 +431,13 @@ public class ConfigureTKS {
 
         String query_string = "p=9" + "&op=next" + "&xml=true" +
                     "&subsystem=" +
-                    URLEncoder.encode(tks_subsystem_cert_subject_name) +
+                    URLEncoder.encode(tks_subsystem_cert_subject_name, "UTF-8") +
                     "&sslserver=" +
-                    URLEncoder.encode(tks_server_cert_subject_name) +
+                    URLEncoder.encode(tks_server_cert_subject_name, "UTF-8") +
                     "&audit_signing=" +
-                    URLEncoder.encode(tks_audit_signing_cert_subject_name) +
+                    URLEncoder.encode(tks_audit_signing_cert_subject_name, "UTF-8") +
                     "&urls=" +
-                    URLEncoder.encode(domain_url) +
+                    URLEncoder.encode(domain_url, "UTF-8") +
                     "";
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -478,20 +471,20 @@ public class ConfigureTKS {
         return true;
     }
 
-    public boolean CertificatePanel() {
+    public boolean CertificatePanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=10" + "&op=next" + "&xml=true" +
                             "&subsystem=" +
-                            URLEncoder.encode(tks_subsystem_cert_cert) +
+                            URLEncoder.encode(tks_subsystem_cert_cert, "UTF-8") +
                             "&subsystem_cc=" +
                             "&sslserver=" +
-                            URLEncoder.encode(server_cert_cert) +
+                            URLEncoder.encode(server_cert_cert, "UTF-8") +
                             "&sslserver_cc=" +
                             "&audit_signing=" +
-                             URLEncoder.encode(tks_audit_signing_cert_cert) +
+                             URLEncoder.encode(tks_audit_signing_cert_cert, "UTF-8") +
                             "&audit_signing_cc=" +
                             "";
 
@@ -506,16 +499,15 @@ public class ConfigureTKS {
         return true;
     }
 
-    public boolean BackupPanel() {
-        boolean st = false;
+    public boolean BackupPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=11" + "&op=next" + "&xml=true" +
                             "&choice=backupkey" +
-                            "&__pwd=" + URLEncoder.encode(backup_pwd) +
-                            "&__pwdagain=" + URLEncoder.encode(backup_pwd);
+                            "&__pwd=" + URLEncoder.encode(backup_pwd, "UTF-8") +
+                            "&__pwdagain=" + URLEncoder.encode(backup_pwd, "UTF-8");
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
 
@@ -547,7 +539,7 @@ public class ConfigureTKS {
             String line = null;
             while ((line = br.readLine()) != null)
                 System.out.println("Error: " + line);
-            int exitVal = proc.waitFor();
+            proc.waitFor();
 
             // verify p12 file
 
@@ -573,7 +565,7 @@ public class ConfigureTKS {
         return true;
     }
 
-    public boolean AdminCertReqPanel() {
+    public boolean AdminCertReqPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -603,19 +595,19 @@ public class ConfigureTKS {
                             "&cert_request_type=" + "crmf" +
                             "&uid=" + admin_user +
                             "&name=" + admin_user +
-                            "&__pwd=" + URLEncoder.encode(admin_password) +
-                            "&__admin_password_again=" + URLEncoder.encode(admin_password) +
+                            "&__pwd=" + URLEncoder.encode(admin_password, "UTF-8") +
+                            "&__admin_password_again=" + URLEncoder.encode(admin_password, "UTF-8") +
                             "&profileId=" + "caAdminCert" +
                             "&email=" +
-                            URLEncoder.encode(admin_email) +
+                            URLEncoder.encode(admin_email, "UTF-8") +
                             "&cert_request=" +
-                            URLEncoder.encode(admin_cert_request) +
+                            URLEncoder.encode(admin_cert_request, "UTF-8") +
                             "&subject=" +
-                            URLEncoder.encode(agent_cert_subject) +
+                            URLEncoder.encode(agent_cert_subject, "UTF-8") +
                             "&clone=new" +
                             "&import=true" +
                             "&securitydomain=" +
-                            URLEncoder.encode(domain_name) +
+                            URLEncoder.encode(domain_name, "UTF-8") +
                             "";
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -668,15 +660,14 @@ public class ConfigureTKS {
         return true;
     }
 
-    public boolean UpdateDomainPanel() {
-        boolean st = false;
+    public boolean UpdateDomainPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=14" + "&op=next" + "&xml=true" +
-                            "&caHost=" + URLEncoder.encode(sd_hostname) +
-                            "&caPort=" + URLEncoder.encode(sd_agent_port) +
+                            "&caHost=" + URLEncoder.encode(sd_hostname, "UTF-8") +
+                            "&caPort=" + URLEncoder.encode(sd_agent_port, "UTF-8") +
                             "";
 
         hr = hc.sslConnect(cs_hostname, cs_port, wizard_uri, query_string);
@@ -689,7 +680,7 @@ public class ConfigureTKS {
         return true;
     }
 
-    public boolean ConfigureTKSInstance() {
+    public boolean ConfigureTKSInstance() throws UnsupportedEncodingException {
         // 0. login to cert db
         ComCrypto cCrypt = new ComCrypto(client_certdb_dir,
                                         client_certdb_pwd,
@@ -836,7 +827,7 @@ public class ConfigureTKS {
         }
     }
 
-    public static void main(String args[]) {
+    public static void main(String args[]) throws UnsupportedEncodingException {
         ConfigureTKS ca = new ConfigureTKS();
 
         // set variables
@@ -872,7 +863,6 @@ public class ConfigureTKS {
         StringHolder x_base_dn = new StringHolder();
         StringHolder x_db_name = new StringHolder();
         StringHolder x_secure_conn = new StringHolder();
-        StringHolder x_clone_start_tls = new StringHolder();
         StringHolder x_remove_data = new StringHolder();
 
         // key properties (defaults)
@@ -974,9 +964,6 @@ public class ConfigureTKS {
         parser.addOption("-secure_conn %s #use ldaps port (optional, default is false)", x_secure_conn);
         parser.addOption("-remove_data %s #remove existing data under base_dn (optional, default is false) ",
                 x_remove_data);
-        parser.addOption(
-                "-clone_start_tls %s #use startTLS for cloning replication agreement (optional, default is false)",
-                x_clone_start_tls);
 
         // key and algorithm options (default)
         parser.addOption("-key_type %s #Key type [RSA,ECC] (optional, default is RSA)", x_key_type);
@@ -1085,7 +1072,6 @@ public class ConfigureTKS {
         db_name = x_db_name.value;
         secure_conn = set_default(x_secure_conn.value, "false");
         remove_data = set_default(x_remove_data.value, "false");
-        clone_start_tls = set_default(x_clone_start_tls.value, "false");
 
         key_type = set_default(x_key_type.value, DEFAULT_KEY_TYPE);
         audit_signing_key_type = set_default(x_audit_signing_key_type.value, key_type);
diff --git a/pki/base/silent/src/com/netscape/pkisilent/ConfigureTPS.java b/pki/base/silent/src/com/netscape/pkisilent/ConfigureTPS.java
index d4df34a39158661fd1b1f3a8794878e6ed286263..366fb57b69639c3d66fc1a91d01573266a9802f7 100644
--- a/pki/base/silent/src/com/netscape/pkisilent/ConfigureTPS.java
+++ b/pki/base/silent/src/com/netscape/pkisilent/ConfigureTPS.java
@@ -19,6 +19,7 @@ package com.netscape.pkisilent;
 // --- END COPYRIGHT BLOCK ---
 
 import java.io.ByteArrayInputStream;
+import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
 
 import com.netscape.pkisilent.argparser.ArgParser;
@@ -193,8 +194,7 @@ public class ConfigureTPS {
         return st;
     }
 
-    public boolean DomainPanel() {
-        boolean st = false;
+    public boolean DomainPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -204,7 +204,7 @@ public class ConfigureTPS {
         String query_string = "p=3" +
                             "&choice=existingdomain" +
                             "&sdomainURL=" +
-                            URLEncoder.encode(domain_url) +
+                            URLEncoder.encode(domain_url, "UTF-8") +
                             "&op=next" +
                             "&xml=true";
 
@@ -227,18 +227,18 @@ public class ConfigureTPS {
 
     }
 
-    public boolean SecurityDomainLoginPanel() {
+    public boolean SecurityDomainLoginPanel() throws UnsupportedEncodingException {
         String tps_url = "https://" + cs_hostname + ":" + cs_port +
                             "/tps/admin/console/config/wizard" +
                             "?p=3&subsystem=TPS";
 
-        String query_string = "url=" + URLEncoder.encode(tps_url) + "";
+        String query_string = "url=" + URLEncoder.encode(tps_url, "UTF-8") + "";
 
         HTTPResponse hr = hc.sslConnect(sd_hostname, sd_admin_port, sd_login_uri, query_string);
 
         String query_string_1 = "uid=" + sd_admin_name +
-                                "&pwd=" + URLEncoder.encode(sd_admin_password) +
-                                "&url=" + URLEncoder.encode(tps_url) +
+                                "&pwd=" + URLEncoder.encode(sd_admin_password, "UTF-8") +
+                                "&url=" + URLEncoder.encode(tps_url, "UTF-8") +
                                 "";
 
         hr = hc.sslConnect(sd_hostname, sd_admin_port, sd_get_cookie_uri,
@@ -269,8 +269,7 @@ public class ConfigureTPS {
 
     }
 
-    public boolean SubsystemPanel() {
-        boolean st = false;
+    public boolean SubsystemPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -279,7 +278,7 @@ public class ConfigureTPS {
         String query_string = "p=5" +
                         "&choice=newsubsystem" +
                         "&subsystemName=" +
-                        URLEncoder.encode(subsystem_name) +
+                        URLEncoder.encode(subsystem_name, "UTF-8") +
                         "&op=next" +
                         "&xml=true";
 
@@ -304,8 +303,6 @@ public class ConfigureTPS {
         px.prettyprintxml();
 
         sleep_time();
-        // TKS choice panel
-        String tks_url = "https://" + tks_hostname + ":" + tks_ssl_port;
         query_string = "p=7" +
                         "&urls=0" +
                         "&op=next" +
@@ -339,20 +336,18 @@ public class ConfigureTPS {
         return true;
     }
 
-    public boolean LdapAuthConnectionPanel() {
-        // auth db 
-        boolean st = false;
+    public boolean LdapAuthConnectionPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=9" +
                         "&host=" +
-                        URLEncoder.encode(ldap_auth_host) +
+                        URLEncoder.encode(ldap_auth_host, "UTF-8") +
                         "&port=" +
-                        URLEncoder.encode(ldap_auth_port) +
+                        URLEncoder.encode(ldap_auth_port, "UTF-8") +
                         "&basedn=" +
-                        URLEncoder.encode(ldap_auth_base_dn) +
+                        URLEncoder.encode(ldap_auth_base_dn, "UTF-8") +
                         "&op=next" +
                         "&xml=true";
 
@@ -366,27 +361,25 @@ public class ConfigureTPS {
         return true;
     }
 
-    public boolean LdapConnectionPanel() {
-        boolean st = false;
+    public boolean LdapConnectionPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=10" +
                         "&host=" +
-                        URLEncoder.encode(ldap_host) +
+                        URLEncoder.encode(ldap_host, "UTF-8") +
                         "&port=" +
-                        URLEncoder.encode(ldap_port) +
+                        URLEncoder.encode(ldap_port, "UTF-8") +
                         "&binddn=" +
-                        URLEncoder.encode(bind_dn) +
+                        URLEncoder.encode(bind_dn, "UTF-8") +
                         "&__bindpwd=" +
-                        URLEncoder.encode(bind_password) +
+                        URLEncoder.encode(bind_password, "UTF-8") +
                         "&basedn=" +
-                        URLEncoder.encode(base_dn) +
+                        URLEncoder.encode(base_dn, "UTF-8") +
                         "&database=" +
-                        URLEncoder.encode(db_name) +
+                        URLEncoder.encode(db_name, "UTF-8") +
                         "&display=" +
-                        URLEncoder.encode("") +
                         "&op=next" +
                         "&xml=true";
 
@@ -400,8 +393,7 @@ public class ConfigureTPS {
         return true;
     }
 
-    public boolean TokenChoicePanel() {
-        boolean st = false;
+    public boolean TokenChoicePanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -413,7 +405,7 @@ public class ConfigureTPS {
         if (token_name.equalsIgnoreCase("internal")) {
             query_string = "p=1" +
                             "&choice=" +
-                            URLEncoder.encode("NSS Certificate DB") +
+                            URLEncoder.encode("NSS Certificate DB", "UTF-8") +
                             "&op=next" +
                             "&xml=true";
 
@@ -428,9 +420,9 @@ public class ConfigureTPS {
             // login to hsm first
             query_string = "p=2" +
                             "&uTokName=" +
-                            URLEncoder.encode(token_name) +
+                            URLEncoder.encode(token_name, "UTF-8") +
                             "&__uPasswd=" +
-                            URLEncoder.encode(token_pwd) +
+                            URLEncoder.encode(token_pwd, "UTF-8") +
                             "&op=next" +
                             "&xml=true";
 
@@ -443,7 +435,7 @@ public class ConfigureTPS {
             // choice with token name now
             query_string = "p=1" +
                             "&choice=" +
-                            URLEncoder.encode(token_name) +
+                            URLEncoder.encode(token_name, "UTF-8") +
                             "&op=next" +
                             "&xml=true";
 
@@ -489,24 +481,24 @@ public class ConfigureTPS {
         return true;
     }
 
-    public boolean CertSubjectPanel() {
+    public boolean CertSubjectPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
 
         String query_string = "p=12" +
                     "&sslserver=" +
-                    URLEncoder.encode(tps_server_cert_subject_name) +
+                    URLEncoder.encode(tps_server_cert_subject_name, "UTF-8") +
                     "&sslserver_nick=" +
-                    URLEncoder.encode(tps_server_cert_nickname) +
+                    URLEncoder.encode(tps_server_cert_nickname, "UTF-8") +
                     "&subsystem=" +
-                    URLEncoder.encode(tps_subsystem_cert_subject_name) +
+                    URLEncoder.encode(tps_subsystem_cert_subject_name, "UTF-8") +
                     "&subsystem_nick=" +
-                    URLEncoder.encode(tps_subsystem_cert_nickname) +
+                    URLEncoder.encode(tps_subsystem_cert_nickname, "UTF-8") +
                     "&audit_signing=" +
-                    URLEncoder.encode(tps_audit_signing_cert_subject_name) +
+                    URLEncoder.encode(tps_audit_signing_cert_subject_name, "UTF-8") +
                     "&audit_signing_nick=" +
-                    URLEncoder.encode(tps_audit_signing_cert_nickname) +
+                    URLEncoder.encode(tps_audit_signing_cert_nickname, "UTF-8") +
                     "&urls=0" +
                     "&op=next" +
                     "&xml=true";
@@ -548,8 +540,7 @@ public class ConfigureTPS {
         return true;
     }
 
-    public boolean AdminCertReqPanel() {
-        boolean st = false;
+    public boolean AdminCertReqPanel() throws UnsupportedEncodingException {
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
         ParseXML px = new ParseXML();
@@ -580,13 +571,13 @@ public class ConfigureTPS {
         String query_string = "p=14" +
                             "&uid=" + admin_user +
                             "&name=" +
-                            URLEncoder.encode("TPS Administrator") +
+                            URLEncoder.encode("TPS Administrator", "UTF-8") +
                             "&email=" +
-                            URLEncoder.encode(admin_email) +
-                            "&__pwd=" + URLEncoder.encode(admin_password) +
-                            "&__admin_password_again=" + URLEncoder.encode(admin_password) +
+                            URLEncoder.encode(admin_email, "UTF-8") +
+                            "&__pwd=" + URLEncoder.encode(admin_password, "UTF-8") +
+                            "&__admin_password_again=" + URLEncoder.encode(admin_password, "UTF-8") +
                             "&cert_request=" +
-                            URLEncoder.encode(admin_cert_request) +
+                            URLEncoder.encode(admin_cert_request, "UTF-8") +
                             "&display=0" +
                             "&profileId=" + "caAdminCert" +
                             "&cert_request_type=" + "crmf" +
@@ -594,11 +585,11 @@ public class ConfigureTPS {
                             "&uid=" + admin_user +
                             "&clone=0" +
                             "&securitydomain=" +
-                            URLEncoder.encode(domain_name) +
+                            URLEncoder.encode(domain_name, "UTF-8") +
                             "&subject=" +
-                            URLEncoder.encode(agent_cert_subject) +
+                            URLEncoder.encode(agent_cert_subject, "UTF-8") +
                             "&requestor_name=" +
-                            URLEncoder.encode(requestor_name) +
+                            URLEncoder.encode(requestor_name, "UTF-8") +
                             "&sessionID=" + tps_session_id +
                             "&auth_hostname=" + ca_hostname +
                             "&auth_port=" + ca_ssl_port +
@@ -617,7 +608,7 @@ public class ConfigureTPS {
         return true;
     }
 
-    public boolean AdminCertImportPanel() {
+    public boolean AdminCertImportPanel() throws UnsupportedEncodingException {
         boolean st = false;
         HTTPResponse hr = null;
         ByteArrayInputStream bais = null;
@@ -670,7 +661,7 @@ public class ConfigureTPS {
         String query_string_1 = "p=15" +
                             "&serialNumber=" + admin_serial_number +
                             "&caHost=" +
-                            URLEncoder.encode(ca_hostname) +
+                            URLEncoder.encode(ca_hostname, "UTF-8") +
                             "&caPort=" + ca_admin_port +
                             "&op=next" +
                             "&xml=true";
@@ -685,7 +676,7 @@ public class ConfigureTPS {
         return true;
     }
 
-    public boolean ConfigureTPSInstance() {
+    public boolean ConfigureTPSInstance() throws UnsupportedEncodingException {
         // 0. login to cert db
         ComCrypto cCrypt = new ComCrypto(client_certdb_dir,
                                         client_certdb_pwd,
@@ -807,7 +798,7 @@ public class ConfigureTPS {
         return true;
     }
 
-    public static void main(String args[]) {
+    public static void main(String args[]) throws UnsupportedEncodingException {
         ConfigureTPS ca = new ConfigureTPS();
 
         // set variables
diff --git a/pki/dogtag/common-ui/shared/admin/console/config/databasepanel.vm b/pki/dogtag/common-ui/shared/admin/console/config/databasepanel.vm
index 36439b4e640ff3a01cfd1496f1e90b7298e1fe7c..ce04e4fbcf177a76e0be076150a27593953b93cc 100644
--- a/pki/dogtag/common-ui/shared/admin/console/config/databasepanel.vm
+++ b/pki/dogtag/common-ui/shared/admin/console/config/databasepanel.vm
@@ -43,7 +43,8 @@ function toggle_details()
 Each instance needs access to a Fedora Directory Server instance to store requests and records. Each PKI instance may create its own associated internal database, or may share an existing internal database. To share an existing internal database instance, a PKI instance would only need to establish a unique distinguished name (DN) using the field entitled <b>Base DN</b> and a unique database name using the field entitled <b>Database</b>. 
 #if ($clone == "clone")
 <p>
-If the replication between the masters and clones occurs on the non-SSL port, it is still possible to require the replication to be SSL encrypted by selecting <b> Use StartTLS with replication agreements</b> below.  In order for this operation to be successful, the database instances must be SSL enabled before continuing beyond this panel.
+<p>
+Replication agreements between the master and clone database instances may be customized.  If no master and replication ports are provided, then replication will occur on the same ports used by the Certificate Sever instances to communicate with the directory server.  If these ports are LDAPS ports, then the replication traffic will be SSL encrypted.  It is still possible to require the replication traffic to be SSL encrypted on the non-SSL port by selecting TLS for Replication Security.  In order for this operation to be successful though, the database instances must be SSL enabled before continuing beyond this panel.
 #end
 </div>
 <p>
@@ -64,8 +65,8 @@ If the replication between the masters and clones occurs on the non-SSL port, it
         <th>Port:</th>
                                 
         <td><input type="text" size="40" name="port" value="$portStr" />  
-<input type="CHECKBOX" NAME="secureConn">SSL
-</td>
+            <input type="CHECKBOX" NAME="secureConn">SSL
+        </td>
       </tr>       
       <tr>
         <th>Base DN:</th>
@@ -90,12 +91,32 @@ If the replication between the masters and clones occurs on the non-SSL port, it
         <td><input type="password" size="40" name="__bindpwd" value="$bindpwd" autocomplete="off" /></td>
       </tr>
     </table>
-        <input type="hidden" name="display" value=$displayStr />
- 
-#if ($clone == "clone") 
-      <input type="CHECKBOX" NAME="cloneStartTLS"/>Use StartTLS with replication agreements.<p>
-#end 
-<input type="CHECKBOX" NAME="removeData">Remove the existing data from the <b>Base DN</b> shown above.<p>
+    <input type="hidden" name="display" value=$displayStr />
+    <input type="CHECKBOX" NAME="removeData">Remove the existing data from the <b>Base DN</b> shown above.<p>
+    
+#if ($clone == "clone")
+    <table class="details" >
+      <tr><th>Replication Details</th></tr>
+      <tr>
+        <th>Master Replication Port:</th>
+        <td><input type="text" size="40" name="masterReplicationPort" value="$masterReplicationPort" /></td>
+      </tr>
+
+      <tr>
+        <th>Clone Replication Port:</th>
+        <td><input type="text" size="40" name="cloneReplicationPort" value="$cloneReplicationPort" /></td>
+      </tr>
+
+      <tr>
+        <th>Replication Security:</th>
+        <td>
+            <input type="radio" name="replicationSecurity" value="None" CHECKED />None</input>
+            <input type="radio" name="replicationSecurity" value="TLS"          />TLS</input>
+            <input type="radio" name="replicationSecurity" value="SSL"          />SSL</input>
+        </td>
+      </tr>
+      <p>
+#end
 
     <div align="right">
       <hr />
-- 
1.7.6.4

