See below to restore the state of a PKI Hub installation comprising one or more nodes.

Restoring the state of a single-node PKI Hub installation

See below to restore the PKI Hub status when installed on a single node.

To restore a single-node PKI Hub installation

1. Reproduce the PKI Hub installation used for Backing up the PKI Hub state. Specifically:
   • Install the same PKI Hub version.
   • Set the node's hostname and IP address to the values from the original installation.

2. If the deployed solutions use an HSM (Hardware Security Module) to protect private keys, restore the device using the HSM vendor's tools. 

   If you previously ran the clusterctl backup restore command, you do not need to restore HSM-protected keys. The backup file imported by the command includes these keys.

3. If the solutions of the restored installation use databases, follow the instructions of the DBMS vendor to restore the database contents.
4. Copy the file generated with the clusterctl backup create command when Backing up the PKI Hub state.
5. Run the clusterctl backup restore command to restore the backup file. 
6. Log in to the Management Console and click Deploy for the CA Gateway solution (if it's deployed in the restored solution).

Restoring the state of a multi-node PKI Hub installation

See below to restore the PKI Hub status across multiple nodes.

To restore a multi-node PKI Hub installation

1. Reproduce the PKI Hub installation used for Backing up the PKI Hub state. Specifically:
   • Install the same PKI Hub version.
   • Add the same number of nodes as in the original installation.
   • Set the node hostname and IP address as in the original installation.

2. If the deployed solutions use an HSM (Hardware Security Module) to protect private keys, restore the device using the HSM vendor's tools. 

   If you previously ran the clusterctl backup restore command, you do not need to restore HSM-protected keys. The backup file imported by the command includes these keys.

3. If the solutions for the restored installation use databases, follow the DBMS vendor's instructions to restore the database contents.
4. Import the license as explained in Setting the license.
5. Run clusterctl certificate to install the TLS certificate and key backup.
6. Run clusterctl volume capacity to restore the previous volume capacity policies.
7. Run clusterctl retention config logs to restore the previous log retention period.
8. Run clusterctl retention config metrics to restore the previous metric retention period.
9. Run clusterctl proxy set to restore the previous proxy settings.
10. Follow the steps described in Restoring the configuration of a solution to restore and deploy the CA Gateway, Certificate Enrollment Gateway, and Certificate Manager solutions (if present in the restored installation).

11. In any installation node:

    1. Copy the file generated with the clusterctl backup create command when Backing up the PKI Hub state.

    2. Run the clusterctl backup restore command to restore the backup file. 
12. Log in to the Management Console and click Deploy for the following solutions (if they are deployed on the restored platform).
    • Certificate Authority
    • Validation Authority
    • Timestamping Authority