Bootstrapping of productive systems involves use of various certificate authorities to generate keys and issue certificates used by IDM.
...
If IDM has already been used with test certificates, these insecure certificates may have been used. If object history entries and/or secrets were created with the demo keys, then after the bootstrapping you must resign the object history (using the batch_re-sign_history tool) and/or re-encrypt the secrets (using the batch_secretfieldstore_change_encryption_key tool) as described in Change Encryption key of secret field store). The batch_re-sign_history tool is not described anywhere. Need some clarification here!
Bootstrapping procedure
Identify requirements
...
required: Is this descriptor required in your installation? Most descriptors are required. However, a few are only required if you use the feature they support. See use-case
placeholder: Will you use a placeholder? If a descriptor is required but you don’t need its use case, use a placeholder with some dummy certificate. See use-case
HSM: Where will you store the keys/certificates? Most keys/certificates can be stored in an HSM. An HSM is much more secure than a file. See storage
Key type / size: RSA or ECC? What keysize? See key requirements
Key usage: in most cases this is not required but recommended. See certificate requirements
Validity.: See certificate requirements
Trusted by: who needs to trust the certificate. You may need to install the certificate or the issuer’s certificate to a machine. See general requirements and certificate requirements
Issuer: Who will issue this certificate? This will depend on who needs to trust it. You can use more than one CA. Choices are:
any CA, e.g. your own SmartID Certificate Manager or a public CA
a trusted S/MIME CA. This is needed in case you want IDM to sign emails, otherwise clients may fail to validate the emails
for placeholders or certificates that don’t require trust you can create your own keypairs and certificates with any suitable tool you like. See certificate requirements
...
Generate keypairs and Certification Signing Requests (CSRs) and request the certificates or create your own. If you want to use store the keys in a Hardware Security Module (HSM), which is highly recommended, use it for generating keypairs wherever possible. The storage entry of each descriptor details where the keypair can be stored. Note that getting certificates from a CA may take some time.
Configure certificates in IDM
...