This is a text-only version of the following page on https://raymii.org:

This is a text-only version of the following page on https://raymii.org:
---
Title : Dogtag / Red Hat Certificate System reset admin pkiconsole password
Author : Remy van Elst
Date : 19-06-2013
URL : https://raymii.org/s/tutorials/Dogtag_Red_Hat_Certificate_System_Reset_Admin_pkiconsole_Password.html
Format : Markdown/HTML
---

This tutorial shows you how to reset the password of the pkiconsole admin user
within the Red Hat Certificate System or Dogtag.

 Recently I removed all Google Ads from this site due to their invasive tracking, as well as Google Analytics. Please, if you found this content useful, consider a small donation using any of the options below: <a href="https://leafnode.nl">I'm developing an open source monitoring app called Leaf Node Monitoring, for windows, linux & android. Go check it out!</a> <a href="https://github.com/sponsors/RaymiiOrg/">Consider sponsoring me on Github. It means the world to me if you show your appreciation and you'll help pay the server costs.</a> <a href="https://www.digitalocean.com/?refcode=7435ae6b8212">You can also sponsor me by getting a Digital Ocean VPS. With this referral link you'll get $100 credit for 60 days. </a> 

What is [Red Hat Certificate System:][2]

Red Hat Certificate System provides a powerful security framework to manage user identities and ensure privacy of communications. Handling all the major functions of the identity life cycle, Red Hat Certificate System simplifies enterprise-wide deployment and adoption of a Public Key Infrastructure (PKI).

[Dogtag][3] is the open source fork maintained by the Fedora project.

![The PKICONSOLE interface][4]

PKI Console is used as an administrative backend into the RHCS/Dogtag system. It
allows configuration of all kind of CA aspects, CRL's, Certificates, OCSP's and
much more. You login to the pkiconsole with an administrative user, most of the
time named admin. Dogtag/RHCS uses an LDAP database in the backend to store all
the information. In the case of dogtag 1.3 this is `fedora-ds`, all the latter
versions and RHCS use `389-ds`. The pkiconsole authenticates against this LDAP
database, so if you have the `Directory Manager` password you can reset the
`admin` password.

First locate the `/etc/pki-<instance-name>/password.conf` file. It looks like
this:

hardware-pki-<instance-name>=0000
internal=0000123400001234
internaldb=00001234
replicationdb=83729562

The `internaldb` value is the LDAP password for the `Directory Manager`. The
hardware part is used when you use a HSM.

Now we have the password for the `Directory Manager` we can login to the LDAP
and reset the admin password.

Use the following command to login to the LDAP of your CA instance, changing the
values for your setup:

ldapmodify -H ldap://localhost:99389 -D "cn=Directory Manager" -Wx -e preread=userPassword

You will be asked for the Directory Manager password, after entering that you
don't see anything. You are now on an LDAP prompt, where you can enter `LDIF`
commands. The commands for changing the admin password are these:

dn: uid=admin,ou=People,dc=pki-<instance-name>
changetype:modify
replace:userpassword
userpassword: 1234

Press `return` twice after the last line. When successful it will show the
following:

modifying entry "uid=admin,ou=People,dc=pki-<instance-name>"

Press `CTRL+C` twice afterwards, and you are done. You can now login to the
PKIConsole with your new password.

[1]: https://www.digitalocean.com/?refcode=7435ae6b8212
[2]: https://www.redhat.com/certificate_system/
[3]: http://pki.fedoraproject.org/
[4]: https://raymii.org/s/inc/img/pkiconsole.png

---

License:
All the text on this website is free as in freedom unless stated otherwise.
This means you can use it in any way you want, you can copy it, change it
the way you like and republish it, as long as you release the (modified)
content under the same license to give others the same freedoms you've got
and place my name and a link to this site with the article as source.

This site uses Google Analytics for statistics and Google Adwords for
advertisements. You are tracked and Google knows everything about you.
Use an adblocker like ublock-origin if you don't want it.

All the code on this website is licensed under the GNU GPL v3 license
unless already licensed under a license which does not allows this form
of licensing or if another license is stated on that page / in that software:

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.

Just to be clear, the information on this website is for meant for educational
purposes and you use it at your own risk. I do not take responsibility if you
screw something up. Use common sense, do not 'rm -rf /' as root for example.
If you have any questions then do not hesitate to contact me.

See https://raymii.org/s/static/About.html for details.