= Overview =

This page describes the process to install a KRA subsystem with random serial numbers in PKI 11.2 or later.

= Installation Procedure =

To install KRA with random serial numbers, follow the normal link:Installing_KRA.md[KRA installation] procedure, then specify the following parameter:

To use random key IDs, add the following parameters in the `[KRA]` section:

----
pki_key_id_generator=random
----

The key ID length (in bits) can be specified in `pki_key_id_length` parameter. The default is `128` bits.

To use random key request IDs, add the following parameters in the `[KRA]` section:

----
pki_request_id_generator=random
----

The key request ID length (in bits) can be specified in `pki_request_id_length` parameter. The default is `128` bits.

= Verification =

Perform a link:https://github.com/dogtagpki/pki/wiki/Key-Archival[Key Archival] or a link:https://github.com/dogtagpki/pki/wiki/Certificate-Enrollment-with-Key-Archival[Certificate Enrollment with Key Archival].
The keys will have random IDs, for example:

----
$ pki -n admin kra-key-find
----------------
1 key(s) matched
----------------
  Key ID: 0x8f3874e9b3204a6090b7216730469844
  ...
----------------------------
Number of entries returned 1
----------------------------
----

The key requests will also have random IDs, for example:

----
$ pki -n admin kra-key-request-find
 -----------------
1 entries matched
-----------------
  Request ID: 0x7566316995b8b8f60f855a371a73873b
  ...
----------------------------
Number of entries returned 1
----------------------------
----
