Merge CA changes into KRA,OCSP & TKS

git-svn-id: svn+ssh://svn.fedorahosted.org/svn/pki/trunk@1575 c9f7a03b-bd48-0410-a16d-cbbf54688b0b

66 files changed, 2500 insertions, 11817 deletions

diff --git a/pki/base/ca/setup/registry_instance b/pki/base/ca/setup/registry_instance
index 6acf066f8..7f0e592a1 100644
--- a/pki/base/ca/setup/registry_instance
+++ b/pki/base/ca/setup/registry_instance
@@ -38,12 +38,6 @@ export TOMCAT_USER
 TOMCAT_GROUP=$PKI_GROUP
 export TOMCAT_GROUP
 
-
-# Since the daemon function will sandbox $tomcat
-# no environment stuff should be defined here anymore.
-# Please use the ${PKI_INSTANCE_PATH}/conf/tomcat5.conf
-# file instead ; it will be read by the $tomcat script
-
 PKI_LOCKDIR="/var/lock/${PKI_FLAVOR}/${PKI_SUBSYSTEM_TYPE}"
 export PKI_LOCKDIR
 
diff --git a/pki/base/ca/shared/conf/catalina.policy b/pki/base/ca/shared/conf/catalina.policy
index b519e602a..cf8302cd0 100644
--- a/pki/base/ca/shared/conf/catalina.policy
+++ b/pki/base/ca/shared/conf/catalina.policy
@@ -1,3 +1,9 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// Copyright (C) 2006-2010 Red Hat, Inc.
+// All rights reserved.
+// Modifications: configuration parameters
+// --- END COPYRIGHT BLOCK ---
+
 // Licensed to the Apache Software Foundation (ASF) under one or more
 // contributor license agreements.  See the NOTICE file distributed with
 // this work for additional information regarding copyright ownership.
diff --git a/pki/base/ca/shared/conf/catalina.properties b/pki/base/ca/shared/conf/catalina.properties
index d6f117cd2..70cb7c05e 100644
--- a/pki/base/ca/shared/conf/catalina.properties
+++ b/pki/base/ca/shared/conf/catalina.properties
@@ -1,3 +1,9 @@
+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2006-2010 Red Hat, Inc.
+# All rights reserved.
+# Modifications: configuration parameters
+# --- END COPYRIGHT BLOCK ---
+
 # Licensed to the Apache Software Foundation (ASF) under one or more
 # contributor license agreements.  See the NOTICE file distributed with
 # this work for additional information regarding copyright ownership.
diff --git a/pki/base/ca/shared/conf/context.xml b/pki/base/ca/shared/conf/context.xml
index 217458d9a..8b6fe4905 100644
--- a/pki/base/ca/shared/conf/context.xml
+++ b/pki/base/ca/shared/conf/context.xml
@@ -1,4 +1,9 @@
 <?xml version='1.0' encoding='utf-8'?>
+<!-- BEGIN COPYRIGHT BLOCK
+     Copyright (C) 2006-2010 Red Hat, Inc.
+     All rights reserved.
+     Modifications: configuration parameters
+     END COPYRIGHT BLOCK -->
 <!--
   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
diff --git a/pki/base/ca/shared/conf/logging.properties b/pki/base/ca/shared/conf/logging.properties
index 68be2d7f4..796cfc071 100644
--- a/pki/base/ca/shared/conf/logging.properties
+++ b/pki/base/ca/shared/conf/logging.properties
@@ -1,3 +1,9 @@
+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2006-2010 Red Hat, Inc.
+# All rights reserved.
+# Modifications: configuration parameters
+# --- END COPYRIGHT BLOCK ---
+
 # Licensed to the Apache Software Foundation (ASF) under one or more
 # contributor license agreements.  See the NOTICE file distributed with
 # this work for additional information regarding copyright ownership.
diff --git a/pki/base/ca/shared/conf/server.xml b/pki/base/ca/shared/conf/server.xml
index d9b10d2e3..6642a58fc 100644
--- a/pki/base/ca/shared/conf/server.xml
+++ b/pki/base/ca/shared/conf/server.xml
@@ -1,4 +1,9 @@
 <?xml version='1.0' encoding='utf-8'?>
+<!-- BEGIN COPYRIGHT BLOCK
+     Copyright (C) 2006-2010 Red Hat, Inc.
+     All rights reserved.
+     Modifications: configuration parameters
+     END COPYRIGHT BLOCK -->
 <!--
   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
diff --git a/pki/base/ca/shared/conf/tomcat-users.xml b/pki/base/ca/shared/conf/tomcat-users.xml
index c0c9964be..daa9260cc 100644
--- a/pki/base/ca/shared/conf/tomcat-users.xml
+++ b/pki/base/ca/shared/conf/tomcat-users.xml
@@ -1,4 +1,9 @@
 <?xml version='1.0' encoding='utf-8'?>
+<!-- BEGIN COPYRIGHT BLOCK
+     Copyright (C) 2006-2010 Red Hat, Inc.
+     All rights reserved.
+     Modifications: configuration parameters
+     END COPYRIGHT BLOCK -->
 <!--
   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
diff --git a/pki/base/ca/shared/etc/init.d/pki-cad b/pki/base/ca/shared/etc/init.d/pki-cad
index 7c00655f0..cf1f1713e 100755
--- a/pki/base/ca/shared/etc/init.d/pki-cad
+++ b/pki/base/ca/shared/etc/init.d/pki-cad
@@ -14,9 +14,9 @@
 # with this program; if not, write to the Free Software Foundation, Inc.,
 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
-# Copyright (C) 2007 Red Hat, Inc.
+# Copyright (C) 2007-2010 Red Hat, Inc.
 # All rights reserved.
-# --- END COPYRIGHT BLOCK ### ---
+# --- END COPYRIGHT BLOCK ---
 #
 # pki-cad    Startup script for pki-ca with tomcat6
 #
@@ -47,11 +47,23 @@ pki_instance="$2"
 . /usr/share/pki/scripts/functions
 
 # See how we were called.
-case "${command}" in
-    start|stop|restart|status)
-        ${command}
-        exit $?
-        ;;
+case $command in
+    status)
+	registry_status
+	exit $?
+	;;
+    start)
+	start
+	exit $?
+	;;
+    restart)
+	restart
+	exit $?
+	;;
+    stop)
+	stop
+	exit $?
+	;;
     condrestart|force-restart|try-restart)
         [ ! -f ${lockfile} ] || restart
         exit $?
@@ -61,13 +73,11 @@ case "${command}" in
         exit ${default_error}
         ;;
     *)
-        # 3 unimplemented feature (for example, "reload")
-        #     [invalid command - should never be reached]
-        echo
+	echo "unknown action ($command)"
         usage
         echo "where valid instance names include:"
         list_instances
-        exit 3
+        exit ${default_error}
         ;;
 esac
 
diff --git a/pki/base/common/scripts/functions b/pki/base/common/scripts/functions
index 68a15c3dc..db4712d53 100644
--- a/pki/base/common/scripts/functions
+++ b/pki/base/common/scripts/functions
@@ -35,7 +35,7 @@ lockfile="/var/lock/subsys/${SERVICE_NAME}"
 
 default_error=0
 
-case "${command}" in
+case $command in
     start|stop|restart|condrestart|force-restart|try-restart)
         # 1 generic or unspecified error (current practice)
         default_error=1
@@ -53,6 +53,13 @@ case "${command}" in
         ;;
 esac
 
+# Enable nullglob, if set then shell pattern globs which do not match any
+# file returns the empty string rather than the unmodified glob pattern.
+shopt -s nullglob
+
+OS=`uname -s`
+ARCHITECTURE=`uname -i`
+
 # Check to insure that this script's original invocation directory
 # has not been deleted!
 CWD=`/bin/pwd > /dev/null 2>&1`
@@ -240,6 +247,145 @@ check_pki_configuration_status()
 
 get_pki_status_definitions()
 {
+    case $PKI_SUBSYSTEM_TYPE in
+	ca|kra|ocsp|tks)
+	    get_pki_status_definitions_tomcat
+	    return $?
+	    ;;
+	ra)
+	    get_pki_status_definitions_ra
+	    return $?
+	    ;;
+	tps)
+	    get_pki_status_definitions_tps
+	    return $?
+	    ;;
+	*)
+	    echo "Unknown subsystem type ($PKI_SUBSYSTEM_TYPE)"
+	    exit ${default_error}
+	    ;;
+    esac
+}
+
+get_pki_status_definitions_ra()
+{
+    # establish well-known strings
+    total_ports=0
+    UNSECURE_PORT=""
+    CLIENTAUTH_PORT=""
+    NON_CLIENTAUTH_PORT=""
+
+    # check to see that an instance-specific "httpd.conf" file exists
+    if [ ! -f ${PKI_HTTPD_CONF} ] ; then
+	echo "File '${PKI_HTTPD_CONF}' does not exist!"
+	exit ${default_error}
+    fi
+
+    # check to see that an instance-specific "nss.conf" file exists
+    if [ ! -f ${PKI_NSS_CONF} ] ; then
+	echo "File '${PKI_NSS_CONF}' does not exist!"
+	exit ${default_error}
+    fi
+
+    # Iterate over Listen statements
+    for port in `sed -n 's/^[ \t]*Listen[ \t][ \t]*\([^ \t][^ \t]*\)/\1/p' ${PKI_HTTPD_CONF}`; do
+	UNSECURE_PORT=$port
+	if [ $total_ports -eq 0 ]; then
+	    echo "    Unsecure Port              = http://${PKI_SERVER_NAME}:${UNSECURE_PORT}"
+        else
+            echo "ERROR: extra Unsecure Port = http://${PKI_SERVER_NAME}:${UNSECURE_PORT}"
+        fi
+	total_ports=`expr ${total_ports} + 1`
+
+    done
+
+    # Iterate over Listen statements
+    for port in `sed -n 's/^[ \t]*Listen[ \t][ \t]*\([^ \t][^ \t]*\)/\1/p' ${PKI_NSS_CONF}`; do
+	UNSECURE_PORT=$port
+	if [ $total_ports -eq 1 ]; then
+	    CLIENTAUTH_PORT=$port
+	    echo "    Secure Clientauth Port     = https://${PKI_SERVER_NAME}:${CLIENTAUTH_PORT}"
+        fi
+	if [ $total_ports -eq 2 ]; then
+	    NON_CLIENTAUTH_PORT=$port
+	    echo "    Secure Non-Clientauth Port = https://${PKI_SERVER_NAME}:${NON_CLIENTAUTH_PORT}"
+        fi
+	total_ports=`expr ${total_ports} + 1`
+
+    done
+
+    if [ ${total_ports} -eq $PKI_TOTAL_PORTS ] ; then
+        return 0
+    else
+        return ${default_error}
+    fi
+}
+
+get_pki_status_definitions_tps()
+{
+    # establish well-known strings
+    total_ports=0
+    UNSECURE_PORT=""
+    CLIENTAUTH_PORT=""
+    NON_CLIENTAUTH_PORT=""
+
+    # check to see that an instance-specific "httpd.conf" file exists
+    if [ ! -f ${PKI_HTTPD_CONF} ] ; then
+	echo "File '${PKI_HTTPD_CONF}' does not exist!"
+	exit ${default_error}
+    fi
+
+    # check to see that an instance-specific "nss.conf" file exists
+    if [ ! -f ${PKI_NSS_CONF} ] ; then
+	echo "File '${PKI_NSS_CONF}' does not exist!"
+	exit ${default_error}
+    fi
+
+    # Iterate over Listen statements
+    for port in `sed -n 's/^[ \t]*Listen[ \t][ \t]*\([^ \t][^ \t]*\)/\1/p' ${PKI_HTTPD_CONF}`; do
+	UNSECURE_PORT=$port
+	if [ $total_ports -eq 0 ]; then
+	    echo "    Unsecure Port              = http://${PKI_SERVER_NAME}:${UNSECURE_PORT}/cgi-bin/so/enroll.cgi"
+	    echo "                                 (ESC Security Officer Enrollment)"
+	    echo "    Unsecure Port              = http://${PKI_SERVER_NAME}:${UNSECURE_PORT}/cgi-bin/home/index.cgi"
+	    echo "                                 (ESC Phone Home)"
+        else
+            echo "ERROR: extra Unsecure Port = http://${PKI_SERVER_NAME}:${UNSECURE_PORT}"
+        fi
+	total_ports=`expr ${total_ports} + 1`
+
+    done
+
+    # Iterate over Listen statements
+    for port in `sed -n 's/^[ \t]*Listen[ \t][ \t]*\([^ \t][^ \t]*\)/\1/p' ${PKI_NSS_CONF}`; do
+	UNSECURE_PORT=$port
+	if [ $total_ports -eq 1 ]; then
+	    CLIENTAUTH_PORT=$port
+	    echo "    Secure Clientauth Port     = https://${PKI_SERVER_NAME}:${CLIENTAUTH_PORT}/cgi-bin/sow/welcome.cgi"
+	    echo "                                 (ESC Security Officer Workstation)"
+	    echo "    Secure Clientauth Port     = https://${PKI_SERVER_NAME}:${CLIENTAUTH_PORT}/tus"
+	    echo "                                 (TPS Roles - Operator/Administrator/Agent)"
+        fi
+	if [ $total_ports -eq 2 ]; then
+	    NON_CLIENTAUTH_PORT=$port
+	    echo "    Secure Non-Clientauth Port = https://${PKI_SERVER_NAME}:${NON_CLIENTAUTH_PORT}/cgi-bin/so/enroll.cgi"
+	    echo "                                 (ESC Security Officer Enrollment)"
+	    echo "    Secure Non-Clientauth Port = https://${PKI_SERVER_NAME}:${NON_CLIENTAUTH_PORT}/cgi-bin/home/index.cgi"
+	    echo "                                 (ESC Phone Home)"
+        fi
+	total_ports=`expr ${total_ports} + 1`
+
+    done
+
+    if [ ${total_ports} -eq $PKI_TOTAL_PORTS ] ; then
+        return 0
+    else
+        return ${default_error}
+    fi
+}
+
+get_pki_status_definitions_tomcat()
+{
     # establish well-known strings
     begin_pki_status_comment="<!-- DO NOT REMOVE - Begin PKI Status Definitions -->"
     end_pki_status_comment="<!-- DO NOT REMOVE - End PKI Status Definitions -->"
@@ -749,7 +895,7 @@ restart()
     return $?
 }
 
-status()
+registry_status()
 {
     error_rv=0
     rv=0
diff --git a/pki/base/common/scripts/pki_apache_initscript b/pki/base/common/scripts/pki_apache_initscript
new file mode 100755
index 000000000..3e886a6d6
--- /dev/null
+++ b/pki/base/common/scripts/pki_apache_initscript
@@ -0,0 +1,248 @@
+#!/bin/bash
+
+# FIXME: needed to add -r system_r to runcon, not sure why or if it's right
+
+command="$1"
+
+# Source function library.
+. /etc/init.d/functions
+
+PKI_REGISTRY_FILE=[PKI_REGISTRY_FILE]
+
+# Enable nullglob, if set then shell pattern globs which do not match any
+# file returns the empty string rather than the unmodified glob pattern.
+shopt -s nullglob
+
+OS=`uname -s`
+ARCHITECTURE=`uname -i`
+
+# Source values associated with this particular PKI instance
+if [ -f $PKI_REGISTRY_FILE ]; then
+    . ${PKI_REGISTRY_FILE}
+else
+    echo "No PKI registry file ($PKI_REGISTRY_FILE)"
+    case $command in
+        status)
+            exit 4
+            ;;
+        *)
+            exit 1
+            ;;
+    esac
+fi
+
+prog=$PKI_INSTANCE_ID
+lockfile=$PKI_LOCK_FILE
+pidfile=$PKI_PID_FILE
+
+
+STARTUP_WAIT=30
+SHUTDOWN_WAIT=30
+
+start()
+{
+    rv=0
+
+    echo -n $"Starting ${prog}: "
+
+    if [ -f ${lockfile} ] ; then
+	if [ -f ${pidfile} ]; then
+	    read kpid < ${pidfile}
+	    if checkpid $kpid 2>&1; then
+		echo
+		echo "${PKI_INSTANCE_ID} (pid ${kpid}) is already running ..."
+		echo
+                return 0
+	    else
+		echo
+		echo -n "lock file found but no process "
+		echo -n "running for pid $kpid, continuing"
+		echo
+		echo
+		rm -f ${lockfile}
+	    fi
+	fi
+    fi
+
+    touch ${pidfile}
+    chown ${PKI_USER}:${PKI_GROUP} ${pidfile}
+    chmod 00600 ${pidfile}
+    [ -x /sbin/restorecon ] && /sbin/restorecon  ${pidfile}
+
+    # restore context for ncipher hsm
+    [ -x /sbin/restorecon ] && [ -d /dev/nfast ] && /sbin/restorecon -R /dev/nfast
+    
+    /usr/sbin/selinuxenabled
+    rv=$?
+    if [ ${rv} = 0 ] ; then	
+	if [ ${ARCHITECTURE} = "i386" ] ; then
+	    LANG=${PKI_HTTPD_LANG} daemon runcon -r system_r -t ${PKI_SELINUX_TYPE} -- ${httpd} ${PKI_OPTIONS}
+            rv=$?
+	    # overwrite output from "daemon"
+	    echo -n $"Starting ${prog}: "
+	elif [ ${ARCHITECTURE} = "x86_64" ] ; then
+	    # NOTE:  "daemon" is incompatible with "httpd" on 64-bit architectures
+	    LANG=${PKI_HTTPD_LANG} runcon -r system_r -t ${PKI_SELINUX_TYPE} -- ${httpd} ${PKI_OPTIONS}
+            rv=$?
+	fi
+    else
+	LANG=${PKI_HTTPD_LANG} daemon ${httpd} ${PKI_OPTIONS}
+        rv=$?
+	# overwrite output from "daemon"
+	echo -n $"Starting ${prog}: "
+    fi
+
+    if [ ${rv} = 0 ] ; then
+	touch ${lockfile}
+	chown ${PKI_USER}:${PKI_GROUP} ${lockfile}
+	chmod 00600 ${lockfile}
+
+	count=0;
+
+	let swait=$STARTUP_WAIT
+	until	[ -s ${pidfile} ] ||
+	[ $count -gt $swait ]
+	do
+	    echo -n "."
+	    sleep 1
+	    let count=$count+1;
+	done
+
+	echo_success
+        echo
+
+	# Set permissions of log files
+	for file in ${pki_logs_directory}/*; do
+            if [ `basename $file` != "signedAudit" ]; then
+	        echo "chown ${PKI_USER}:${PKI_GROUP} ${file}"
+	        echo "chmod 00640 ${file}"
+            fi
+	done
+
+        if [ -d ${pki_logs_directory}/signedAudit ]; then
+	    for file in ${pki_logs_directory}/signedAudit/*; do
+		echo "chown ${PKI_USER} ${file}"
+		echo "chmod 00640 ${file}"
+            done
+        fi
+
+    else
+	echo_failure
+        echo
+    fi
+
+	
+    return ${rv}
+}
+
+stop()
+{
+    rv=0
+
+    echo -n "Stopping ${prog}: "
+
+    if [ -f ${lockfile} ] ; then
+	${httpd} ${PKI_OPTIONS} -k stop
+	rv=$?
+
+	if [ ${rv} = 0 ]; then
+	    count=0;
+            
+	    if [ -f ${pidfile} ]; then
+		read kpid < ${pidfile}
+		let kwait=$SHUTDOWN_WAIT
+                
+		until	[ `ps -p $kpid | grep -c $kpid` = '0' ] ||
+		[ $count -gt $kwait ]
+		do
+		    echo -n "."
+		    sleep 1
+		    let count=$count+1;
+		done
+                
+		if [ $count -gt $kwait ]; then
+		    kill -9 $kpid
+		fi
+	    fi
+            
+	    rm -f ${lockfile}
+	    rm -f ${pidfile}
+            
+	    echo_success
+            echo
+	else
+	    echo_failure
+            echo
+	    rv=${default_error}
+	fi
+    else
+	echo
+	echo "process already stopped"
+	rv=0
+    fi
+    
+    return ${rv}
+}
+
+reload()
+{
+    rv=0
+    
+    echo -n $"Reloading ${prog}: "
+    
+    if ! LANG=${PKI_HTTPD_LANG} ${httpd} ${PKI_OPTIONS} -t >&/dev/null; then
+	rv=$?
+	echo $"not reloading due to configuration syntax error"
+	failure $"not reloading ${httpd} due to configuration syntax error"
+    else
+	killproc -p ${pidfile} ${httpd} -HUP
+	rv=$?
+    fi
+    echo
+
+    return ${rv}
+}
+
+instance_status()
+{
+    status -p ${pidfile} ${prog}
+    rv=$?
+    return $rv
+}
+
+# See how we were called.
+case $command in
+    status)
+        instance_status
+        exit $?
+        ;;
+    start)
+	start
+	exit $?
+	;;
+    restart)
+	restart
+	exit $?
+	;;
+    stop)
+	stop
+	exit $?
+	;;
+    condrestart|force-restart|try-restart)
+        [ ! -f ${lockfile} ] || restart
+        exit $?
+        ;;
+    reload)
+        echo "The 'reload' action is an unimplemented feature."
+        exit 3
+        ;;
+    condrestart|force-restart|try-restart)
+	[ ! -f ${lockfile} ] || restart
+	exit $?
+	;;
+    *)
+	echo "unknown action ($command)"
+	exit 2
+	;;
+esac
+
diff --git a/pki/base/kra/build.xml b/pki/base/kra/build.xml
index abbdbe7ab..eecf414ee 100644
--- a/pki/base/kra/build.xml
+++ b/pki/base/kra/build.xml
@@ -191,6 +191,7 @@
                         filemode="644"
                         prefix="usr/share/${product.prefix}/${product}/setup">
                 <include name="config.desktop"/>
+                <include name="registry_instance"/>
             </zipfileset>
             <zipfileset dir="./shared/etc/init.d"
                         filemode="755"
@@ -198,15 +199,9 @@
                 <include name="pki-krad"/>
             </zipfileset>
             <zipfileset dir="./shared"
-                        filemode="755"
-                        prefix="usr/share/${product.prefix}/${product}">
-                <include name="conf/dtomcat5"/>
-            </zipfileset>
-            <zipfileset dir="./shared"
                         filemode="644"
                         prefix="usr/share/${product.prefix}/${product}">
                 <include name="**"/>
-                <exclude name="conf/dtomcat5"/>
                 <exclude name="etc/init.d/pki-krad"/>
             </zipfileset>
             <zipfileset dir="."
@@ -230,6 +225,7 @@
                         mode="644"
                         prefix="${dist.name}/usr/share/${product.prefix}/${product}/setup">
                 <include name="config.desktop"/>
+                <include name="registry_instance"/>
             </tarfileset>
             <tarfileset dir="./shared/etc/init.d"
                         mode="755"
@@ -237,15 +233,9 @@
                 <include name="pki-krad"/>                 
             </tarfileset>
             <tarfileset dir="./shared"
-                        mode="755"
-                        prefix="${dist.name}/usr/share/${product.prefix}/${product}">
-                <include name="conf/dtomcat5"/>
-            </tarfileset>
-            <tarfileset dir="./shared"
                         mode="644"
                         prefix="${dist.name}/usr/share/${product.prefix}/${product}">
                 <include name="**"/>
-                <exclude name="conf/dtomcat5"/>
                 <exclude name="etc/init.d/pki-krad"/>
             </tarfileset>
             <tarfileset dir="."
diff --git a/pki/base/kra/setup/registry_instance b/pki/base/kra/setup/registry_instance
new file mode 100644
index 000000000..7f0e592a1
--- /dev/null
+++ b/pki/base/kra/setup/registry_instance
@@ -0,0 +1,54 @@
+# Establish PKI Variable "Slot" Substitutions
+
+PKI_FLAVOR=[PKI_FLAVOR]
+export PKI_FLAVOR
+
+PKI_SUBSYSTEM_TYPE=[PKI_SUBSYSTEM_TYPE]
+export PKI_SUBSYSTEM_TYPE
+
+PKI_USER=[PKI_USER]
+export PKI_USER
+
+PKI_GROUP=[PKI_GROUP]
+export PKI_GROUP
+
+PKI_INSTANCE_ID=[PKI_INSTANCE_ID]
+export PKI_INSTANCE_ID
+
+PKI_INSTANCE_PATH=[PKI_INSTANCE_PATH]
+export PKI_INSTANCE_PATH
+
+PKI_INSTANCE_INITSCRIPT=[PKI_INSTANCE_INITSCRIPT]
+export PKI_INSTANCE_INITSCRIPT
+
+PKI_SERVER_XML_CONF=[PKI_SERVER_XML_CONF]
+export PKI_SERVER_XML_CONF
+
+# Use CATALINA_BASE
+
+CATALINA_BASE=$PKI_INSTANCE_PATH
+export CATALINA_BASE
+
+TOMCAT_PROG=$PKI_INSTANCE_ID
+export TOMCAT_PROG
+
+TOMCAT_USER=$PKI_USER
+export TOMCAT_USER
+
+TOMCAT_GROUP=$PKI_GROUP
+export TOMCAT_GROUP
+
+PKI_LOCKDIR="/var/lock/${PKI_FLAVOR}/${PKI_SUBSYSTEM_TYPE}"
+export PKI_LOCKDIR
+
+PKI_LOCKFILE="${PKI_LOCKDIR}/${PKI_INSTANCE_ID}.pid"
+export PKI_LOCKFILE
+
+TOMCAT_PIDFILE=[TOMCAT_PIDFILE]
+export TOMCAT_PIDFILE
+
+pki_instance_configuration_file=${PKI_INSTANCE_PATH}/conf/CS.cfg
+export pki_instance_configuration_file
+
+RESTART_SERVER=${PKI_INSTANCE_PATH}/conf/restart_server_after_configuration
+export RESTART_SERVER
diff --git a/pki/base/kra/shared/conf/catalina.policy b/pki/base/kra/shared/conf/catalina.policy
index 8f481e333..cf8302cd0 100644
--- a/pki/base/kra/shared/conf/catalina.policy
+++ b/pki/base/kra/shared/conf/catalina.policy
@@ -1,5 +1,26 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// Copyright (C) 2006-2010 Red Hat, Inc.
+// All rights reserved.
+// Modifications: configuration parameters
+// --- END COPYRIGHT BLOCK ---
+
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 // ============================================================================
-// catalina.corepolicy - Security Policy Permissions for Tomcat 5
+// catalina.corepolicy - Security Policy Permissions for Tomcat 6
 //
 // This file contains a default set of security policies to be enforced (by the
 // JVM) when Catalina is executed with the "-security" option.  In addition
@@ -40,35 +61,16 @@ grant codeBase "file:${java.home}/lib/ext/-" {
 // ========== CATALINA CODE PERMISSIONS =======================================
 
 
-// These permissions apply to the launcher code
-grant codeBase "file:${catalina.home}/bin/commons-launcher.jar" {
-        permission java.security.AllPermission;
-};
-
 // These permissions apply to the daemon code
 grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {
         permission java.security.AllPermission;
 };
 
-// These permissions apply to the commons-logging API
-grant codeBase "file:${catalina.home}/bin/commons-logging-api.jar" {
-        permission java.security.AllPermission;
-};
-
-// These permissions apply to the server startup code
-grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
-        permission java.security.AllPermission;
-};
-
-// These permissions apply to the JMX server
-grant codeBase "file:${catalina.home}/bin/jmx.jar" {
-        permission java.security.AllPermission;
-};
-
-// These permissions apply to JULI
+// These permissions apply to the logging API
 grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
         permission java.util.PropertyPermission "java.util.logging.config.class", "read";
         permission java.util.PropertyPermission "java.util.logging.config.file", "read";
+        permission java.io.FilePermission "${java.home}${file.separator}lib${file.separator}logging.properties", "read"; 
         permission java.lang.RuntimePermission "shutdownHooks";
         permission java.io.FilePermission "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read";
         permission java.util.PropertyPermission "catalina.base", "read";
@@ -82,24 +84,19 @@ grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
         // permission java.io.FilePermission "${catalina.base}${file.separator}webapps${file.separator}examples${file.separator}WEB-INF${file.separator}classes${file.separator}logging.properties", "read";
 };
 
-// These permissions apply to the servlet API classes
-// and those that are shared across all class loaders
-// located in the "common" directory
-grant codeBase "file:${catalina.home}/common/-" {
+// These permissions apply to the server startup code
+grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
         permission java.security.AllPermission;
 };
 
-// These permissions apply to the container's core code, plus any additional
-// libraries installed in the "server" directory
-grant codeBase "file:${catalina.home}/server/-" {
+// These permissions apply to the servlet API classes
+// and those that are shared across all class loaders
+// located in the "lib" directory
+grant codeBase "file:${catalina.home}/lib/-" {
         permission java.security.AllPermission;
 };
 
-// The permissions granted to the balancer WEB-INF/classes and WEB-INF/lib directory
-grant codeBase "file:${catalina.home}/webapps/balancer/-" {
-        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.util.digester";
-        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.util.digester.*";
-};
+
 // ========== WEB APPLICATION PERMISSIONS =====================================
 
 
@@ -147,6 +144,9 @@ grant {
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime";
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime.*";
     
+    // Precompiled JSPs need access to this system property.
+    permission java.util.PropertyPermission "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";
+
 };
 
 
@@ -182,58 +182,3 @@ grant {
 //      permission java.net.SocketPermission "*.noaa.gov:80", "connect";
 // };
 
-
-
-// These permissions apply to Tomcat5 java
-grant codeBase "file:/usr/share/java/tomcat5/-" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/jakarta-commons-modeler.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/jasper5-compiler.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/jasper5-runtime.jar" {
-        permission java.security.AllPermission;
-};
-
-
-
-// These permissions apply to PKI configuration
-grant codeBase "file:/usr/share/java/velocity.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/tomcat5-servlet-2.4-api.jar" {
-        permission java.security.AllPermission;
-};
-
-
-
-
-// These permissions apply to PKI support
-grant codeBase "file:/usr/share/java/ldapjdk.jar" {
-        permission java.security.AllPermission;
-};
-
-
-
-// These permissions apply to PKI
-grant codeBase "file:/usr/lib/java/jss4.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/tomcatjss.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/lib/java/osutil.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/lib/java/symkey.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/pki/-" {
-        permission java.security.AllPermission;
-};
-
-
-
diff --git a/pki/base/kra/shared/conf/catalina.properties b/pki/base/kra/shared/conf/catalina.properties
index 86334d29f..70cb7c05e 100644
--- a/pki/base/kra/shared/conf/catalina.properties
+++ b/pki/base/kra/shared/conf/catalina.properties
@@ -1,3 +1,24 @@
+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2006-2010 Red Hat, Inc.
+# All rights reserved.
+# Modifications: configuration parameters
+# --- END COPYRIGHT BLOCK ---
+
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 #
 # List of comma-separated packages that start with or equal this string
 # will cause a security exception to be thrown when
@@ -29,7 +50,7 @@ package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,org.apache
 #     "foo/*.jar": Add all the JARs of the specified folder as class 
 #                  repositories
 #     "foo/bar.jar": Add bar.jar as a class repository
-common.loader=${catalina.home}/common/classes,${catalina.home}/common/i18n/*.jar,${catalina.home}/common/endorsed/*.jar,${catalina.home}/common/lib/*.jar
+common.loader=${catalina.home}/lib,${catalina.home}/lib/*.jar,[TOMCAT_INSTANCE_COMMON_LIB]
 
 #
 # List of comma-separated paths defining the contents of the "server" 
@@ -42,7 +63,7 @@ common.loader=${catalina.home}/common/classes,${catalina.home}/common/i18n/*.jar
 #     "foo/*.jar": Add all the JARs of the specified folder as class 
 #                  repositories
 #     "foo/bar.jar": Add bar.jar as a class repository
-server.loader=${catalina.home}/server/classes,${catalina.home}/server/lib/*.jar
+server.loader=
 
 #
 # List of comma-separated paths defining the contents of the "shared" 
@@ -54,7 +75,9 @@ server.loader=${catalina.home}/server/classes,${catalina.home}/server/lib/*.jar
 #     "foo/*.jar": Add all the JARs of the specified folder as class 
 #                  repositories
 #     "foo/bar.jar": Add bar.jar as a class repository 
-shared.loader=${catalina.base}/shared/classes,${catalina.base}/shared/lib/*.jar
+# Please note that for single jars, e.g. bar.jar, you need the URL form
+# starting with file:.
+shared.loader=
 
 #
 # String cache configuration.
diff --git a/pki/base/kra/shared/conf/context.xml b/pki/base/kra/shared/conf/context.xml
index 4998ad27d..8b6fe4905 100644
--- a/pki/base/kra/shared/conf/context.xml
+++ b/pki/base/kra/shared/conf/context.xml
@@ -1,5 +1,27 @@
+<?xml version='1.0' encoding='utf-8'?>
+<!-- BEGIN COPYRIGHT BLOCK
+     Copyright (C) 2006-2010 Red Hat, Inc.
+     All rights reserved.
+     Modifications: configuration parameters
+     END COPYRIGHT BLOCK -->
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
 <!-- The contents of this file will be loaded for each web application -->
-<Context crossContext="true">
+<Context crossContext="true" allowLinking="true">
 
     <!-- Default set of monitored resources -->
     <WatchedResource>WEB-INF/web.xml</WatchedResource>
@@ -9,4 +31,10 @@
     <Manager pathname="" />
     -->
 
+    <!-- Uncomment this to enable Comet connection tacking (provides events
+         on session expiration as well as webapp lifecycle) -->
+    <!--
+    <Valve className="org.apache.catalina.valves.CometConnectionManagerValve" />
+    -->
+
 </Context>
diff --git a/pki/base/kra/shared/conf/dtomcat5 b/pki/base/kra/shared/conf/dtomcat5
deleted file mode 100755
index 2eeb889e6..000000000
--- a/pki/base/kra/shared/conf/dtomcat5
+++ /dev/null
@@ -1,476 +0,0 @@
-#!/bin/bash
-#
-# --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2006 Red Hat, Inc.
-# All rights reserved.
-# --- END COPYRIGHT BLOCK ---
-#
-# -----------------------------------------------------------------------------
-# Start/Stop Script for the CATALINA Server
-#
-# Environment Variable Prequisites
-#
-#   CATALINA_HOME   May point at your Catalina "build" directory.
-#
-#   CATALINA_BASE   (Optional) Base directory for resolving dynamic portions
-#                   of a Catalina installation.  If not present, resolves to
-#                   the same directory that CATALINA_HOME points to.
-#
-#   CATALINA_OPTS   (Optional) Java runtime options used when the "start",
-#                   "stop", or "run" command is executed.
-#
-#   CATALINA_TMPDIR (Optional) Directory path location of temporary directory
-#                   the JVM should use (java.io.tmpdir).  Defaults to
-#                   $CATALINA_BASE/temp.
-#
-#   JAVA_HOME       Must point at your Java Development Kit installation.
-#                   Required to run the with the "debug" or "javac" argument.
-#
-#   JRE_HOME        Must point at your Java Development Kit installation.
-#                   Defaults to JAVA_HOME if empty.
-#
-#   JAVA_OPTS       (Optional) Java runtime options used when the "start",
-#                   "stop", or "run" command is executed.
-#
-#   JPDA_TRANSPORT  (Optional) JPDA transport used when the "jpda start"
-#                   command is executed. The default is "dt_socket".
-#
-#   JPDA_ADDRESS    (Optional) Java runtime options used when the "jpda start"
-#                   command is executed. The default is 8000.
-#
-#   JSSE_HOME       (Optional) May point at your Java Secure Sockets Extension
-#                   (JSSE) installation, whose JAR files will be added to the
-#                   system class path used to start Tomcat.
-#
-#   CATALINA_PID    (Optional) Path of the file which should contains the pid
-#                   of catalina startup java process, when start (fork) is used
-#
-# $Id$
-# -----------------------------------------------------------------------------
-
-# Disallow 'others' the ability to 'write' to new files
-umask 00002
-
-# Check to insure that this script's original invocation directory
-# has not been deleted!
-CWD=`/bin/pwd > /dev/null 2>&1`
-if [ $? -ne 0 ] ; then
-	echo "Cannot invoke '$0' from non-existent directory!"
-	exit 255
-fi
-
-# Check to insure that this script's associated PKI
-# subsystem currently resides on this system.
-PKI_SUBSYSTEM_TYPE=[PKI_SUBSYSTEM_TYPE]
-if [ ! -d /usr/share/pki/${PKI_SUBSYSTEM_TYPE} ] ; then
-	echo "This machine is missing the '${PKI_SUBSYSTEM_TYPE}' subsystem!"
-	exit 255
-fi
-
-# OS specific support.  $var _must_ be set to either true or false.
-OS=`uname -s`
-cygwin=false
-os400=false
-case "${OS}" in
-CYGWIN*) cygwin=true;;
-OS400*) os400=true;;
-esac
-
-TOMCAT_CFG=[PKI_INSTANCE_PATH]/conf/tomcat5.conf
-JAVADIR="/usr/share/java"
-
-# resolve links - $0 may be a softlink
-PRG="$0"
-
-while [ -h "$PRG" ]; do
-  ls=`ls -ld "$PRG"`
-  link=`expr "$ls" : '.*-> \(.*\)$'`
-  if expr "$link" : '.*/.*' > /dev/null; then
-    PRG="$link"
-  else
-    PRG=`dirname "$PRG"`/"$link"
-  fi
-done
-
-# Get standard environment variables
-PRGDIR=`dirname "$PRG"`
-
-# Only set CATALINA_HOME if not already set
-[ -z "$CATALINA_HOME" ] && CATALINA_HOME=`cd "$PRGDIR/.." ; pwd`
-
-if [ -r "$CATALINA_HOME"/bin/setenv.sh ]; then
-  . "$CATALINA_HOME"/bin/setenv.sh
-fi
-
-# For Cygwin, ensure paths are in UNIX format before anything is touched
-if $cygwin; then
-  [ -n "$JAVA_HOME" ] && JAVA_HOME=`cygpath --unix "$JAVA_HOME"`
-  [ -n "$JRE_HOME" ] && JRE_HOME=`cygpath --unix "$JRE_HOME"`
-  [ -n "$CATALINA_HOME" ] && CATALINA_HOME=`cygpath --unix "$CATALINA_HOME"`
-  [ -n "$CATALINA_BASE" ] && CATALINA_BASE=`cygpath --unix "$CATALINA_BASE"`
-  [ -n "$CLASSPATH" ] && CLASSPATH=`cygpath --path --unix "$CLASSPATH"`
-  [ -n "$JSSE_HOME" ] && JSSE_HOME=`cygpath --absolute --unix "$JSSE_HOME"`
-fi
-
-# For OS400
-if $os400; then
-  # Set job priority to standard for interactive (interactive - 6) by using
-  # the interactive priority - 6, the helper threads that respond to requests
-  # will be running at the same priority as interactive jobs.
-  COMMAND='chgjob job('$JOBNAME') runpty(6)'
-  system $COMMAND
-
-  # Enable multi threading
-  export QIBM_MULTI_THREADED=Y
-fi
-
-[ -r "$TOMCAT_CFG" ] && . "${TOMCAT_CFG}"
-
-### Set up defaults if they were omitted in TOMCAT_CFG
-###  JVM lookup
-if [ -z "$JAVA_HOME" ]; then
-    # Search for java in PATH
-    JAVA=`which java`
-    if [ -z "$JAVA" ] ; then
-        JAVA_BINDIR=`dirname ${JAVA}`
-        JAVA_HOME="${JAVA_BINDIR}/.."
-    fi
-    # Default clean JAVA_HOME
-    [ -z "$JAVA_HOME" -a -d "/usr/lib/java" ] && JAVA_HOME="/usr/lib/java"
-    # Default IBM JAVA_HOME
-    [ -z "$JAVA_HOME" -a -d "/opt/IBMJava2-13" ] && \
-        JAVA_HOME="/opt/IBMJava2-13"
-    [ -z "$JAVA_HOME" -a -d "/opt/IBMJava2-131" ] && \
-        JAVA_HOME="/opt/IBMJava2-131"
-    [ -z "$JAVA_HOME" -a -d "/opt/IBMJava2-14" ] && \
-        JAVA_HOME="/opt/IBMJava2-14"
-    [ -z "$JAVA_HOME" -a -d "/opt/IBMJava2-141" ] && \
-        JAVA_HOME="/opt/IBMJava2-141"
-    # Another solution
-    [ -z "$JAVA_HOME" -a -d "/usr/java/jdk" ] && \
-        JAVA_HOME="/usr/java/jdk"
-    # madeinlinux JAVA_HOME
-    [ -z "$JAVA_HOME" -a -d "/usr/local/jdk1.2.2" ] && \
-        JAVA_HOME="/usr/local/jdk1.2.2"
-    # Kondara JAVA_HOME
-    [ -z "$JAVA_HOME"  -a -d "/usr/lib/java/jdk1.2.2" ] && \
-        JAVA_HOME="/usr/lib/java/jdk1.2.2"
-    # Other commonly found JAVA_HOMEs
-    [ -z "$JAVA_HOME"  -a -d "/usr/jdk1.2" ] && JAVA_HOME="/usr/jdk1.2"
-    # Default Caldera JAVA_HOME
-    [ -z "$JAVA_HOME"  -a -d "/opt/java-1.3" ] && \
-        JAVA_HOME="/opt/java-1.3"
-    # Add other locations here
-    if [ -z "$JAVA_HOME" ]; then
-        echo "No JAVA_HOME specified in ${TOMCAT_CFG} and no java found"
-        exit 1
-    else
-        echo "Found JAVA_HOME: ${JAVA_HOME}"
-        echo "Please complete your ${TOMCAT_CFG} so we won't have to look for it next time"
-    fi
-fi
-
-# Set juli LogManager if it is present
-if [ -r "$CATALINA_HOME"/bin/tomcat-juli.jar ]; then
-  JAVA_OPTS="$JAVA_OPTS "-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
-fi
-
-# Set standard commands for invoking Java.
-_RUNJAVA="$JAVA_HOME"/bin/java
-_RUNJAVAC="$JAVA_HOME"/bin/javac
-_RUNJDB="$JAVA_HOME"/bin/jdb
-
-# Set standard CLASSPATH
-# (always inherit any preset values from the PKI start script)
-if [ ${OS} = "Linux" ] ; then
-	# Checking for OpenJDK JVM
-	OPENJDK_JVM="`java -version 2>&1 | tail -1 | awk '{print $1};'`"
-	if	[ "${OPENJDK_JVM}" = "OpenJDK" ] ||
-		[ "${OPENJDK_JVM}" = "IcedTea" ]; then
-		# using OpenJDK
-		CLASSPATH="$CLASSPATH":"$JAVA_HOME"/lib/rt.jar
-
-		# add required classes to the CLASSPATH for OpenJDK
-		CLASSPATH="$CLASSPATH":"$JAVADIR"/commons-collections.jar
-	else
-		# NOT using OpenJDK
-		CLASSPATH="$CLASSPATH":"$JAVA_HOME"/lib/tools.jar
-	fi
-elif [ ${OS} = "SunOS" ] ; then
-	CLASSPATH="$CLASSPATH":"$JAVA_HOME"/lib/rt.jar
-fi
-
-# Add on extra jar files to CLASSPATH
-if [ -n "$JSSE_HOME" ]; then
-  CLASSPATH="$CLASSPATH":"$JSSE_HOME"/lib/jcert.jar:"$JSSE_HOME"/lib/jnet.jar:"$JSSE_HOME"/lib/jsse.jar
-fi
-
-# JPackage JSSE location check
-if [ -r "$JAVADIR/jsse/jcert.jar" ]; then
-  CLASSPATH="$CLASSPATH":"$JAVADIR"/jsse/jcert.jar:"$JAVADIR"/jsse/jnet.jar:"$JAVADIR"/jsse/jsse.jar
-fi
-
-if [ ${OS} = "Linux" ] ; then
-	CLASSPATH="$CLASSPATH":"$CATALINA_HOME"/bin/bootstrap.jar:"$CATALINA_HOME"/bin/commons-logging-api.jar:`/usr/bin/build-classpath mx4j/mx4j-impl`:`/usr/bin/build-classpath mx4j/mx4j-jmx`
-
-        # add jars in required components for velocity >= 1.6 (just in case)
-        VELOCITY=`rpm -q velocity|sed 's/velocity-\([0-9]*\)\.\([0-9]*\).*/\1\2/'`
-        if [ "$VELOCITY" -ge 16 ]; then 
-            CLASSPATH="$CLASSPATH":`/usr/bin/build-classpath bcel hsqldb commons-collections commons-lang commons-logging commons-logging-api jdom junit oro servletapi5 werken.xpath`
-        fi
-
-elif [ ${OS} = "SunOS" ] ; then
-	# The following definitions are provided for Solaris
-	# platforms since they are unable to execute the
-	# "/usr/bin/build-classpath" and
-	# "/usr/share/java-utils/java-functions" files . . .
-
-	CLASSPATH="$CLASSPATH":"$CATALINA_HOME"/bin/bootstrap.jar
-	CLASSPATH="$CLASSPATH":"$CATALINA_HOME"/bin/commons-logging-api.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-impl.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-jmx.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/base.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/certsrv.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cms.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cms72.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cms72_en.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cmsbundle.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cmscore.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cmsutil.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/mcc70.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/mcc70_en.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/nmclf70.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/nmclf70_en.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/nsutil.jar
-
-	if [ -f /usr/share/java/pkitools.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pkitools.jar
-	elif [ -f /usr/share/java/cstools.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/cstools.jar
-	elif [ -f /usr/share/java/pki/cstools.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/cstools.jar
-	fi
-
-	if [ -f /usr/share/java/ca.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/ca.jar
-	elif [ -f /usr/share/java/pki/ca/ca.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/ca/ca.jar
-	fi
-	if [ -f /usr/share/java/kra.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/kra.jar
-	elif [ -f /usr/share/java/pki/kra/kra.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/kra/kra.jar
-	fi
-	if [ -f /usr/share/java/ocsp.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/ocsp.jar
-	elif [ -f /usr/share/java/pki/ocsp/ocsp.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/ocsp/ocsp.jar
-	fi
-	if [ -f /usr/share/java/tks.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/tks.jar
-	elif [ -f /usr/share/java/pki/tks/tks.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/tks/tks.jar
-	fi
-
-        # add jars for velocity 1.6 (just in case) 
-        CLASSPATH="$CLASSPATH":/usr/share/java/bcel.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/hsqldb.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/commons-collections.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/commons-lang.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/commons-logging.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/commons-logging-api.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/jdom.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/junit.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/oro.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/servletapi5.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/werken.xpath.jar
-
-fi
-
-if [ -z "$CATALINA_BASE" ] ; then
-  CATALINA_BASE="$CATALINA_HOME"
-fi
-
-if [ -z "$CATALINA_TMPDIR" ] ; then
-  # Define the java.io.tmpdir to use for Catalina
-  CATALINA_TMPDIR="$CATALINA_BASE"/temp
-fi
-
-if [ -z "$CATALINA_PID" ] ; then
-    export CATALINA_PID=/var/run/tomcat5.pid
-fi
-
-# For Cygwin, switch paths to Windows format before running java
-if $cygwin; then
-  JAVA_HOME=`cygpath --absolute --windows "$JAVA_HOME"`
-  JRE_HOME=`cygpath --absolute --windows "$JRE_HOME"`
-  CATALINA_HOME=`cygpath --absolute --windows "$CATALINA_HOME"`
-  CATALINA_BASE=`cygpath --absolute --windows "$CATALINA_BASE"`
-  CATALINA_TMPDIR=`cygpath --absolute --windows "$CATALINA_TMPDIR"`
-  CLASSPATH=`cygpath --path --windows "$CLASSPATH"`
-  [ -n "$JSSE_HOME" ] && JSSE_HOME=`cygpath --absolute --windows "$JSSE_HOME"`
-  JAVA_ENDORSED_DIRS=`cygpath --path --windows "$JAVA_ENDORSED_DIRS"`
-fi
-
-# ----- Execute The Requested Command -----------------------------------------
-echo "Using CATALINA_PID $CATALINA_PID"
-echo "Using CATALINA_BASE:   $CATALINA_BASE"
-echo "Using CATALINA_HOME:   $CATALINA_HOME"
-echo "Using CATALINA_TMPDIR: $CATALINA_TMPDIR"
-if [ "$1" = "debug" -o "$1" = "javac" ] ; then
-  echo "Using JAVA_HOME:       $JAVA_HOME"
-else
-  echo "Using JRE_HOME:       $JRE_HOME"
-fi
-
-if [ "$1" = "jpda" ] ; then
-  if [ -z "$JPDA_TRANSPORT" ]; then
-    JPDA_TRANSPORT="dt_socket"
-  fi
-  if [ -z "$JPDA_ADDRESS" ]; then
-    JPDA_ADDRESS="8000"
-  fi
-  if [ -z "$JPDA_OPTS" ]; then
-    JPDA_OPTS="-Xdebug -Xrunjdwp:transport=$JPDA_TRANSPORT,address=$JPDA_ADDRESS,server=y,suspend=n"
-  fi
-  CATALINA_OPTS="$CATALINA_OPTS $JPDA_OPTS"
-  shift
-fi
-
-if [ "$1" = "debug" ] ; then
-  if $os400; then
-    echo "Debug command not available on OS400"
-    exit 1
-  else
-    shift
-    if [ "$1" = "-security" ] ; then
-      echo "Using Security Manager"
-      shift
-      exec "$_RUNJDB" $JAVA_OPTS $CATALINA_OPTS \
-        -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-        -sourcepath "$CATALINA_HOME"/../../jakarta-tomcat-catalina/catalina/src/share \
-        -Djava.security.manager \
-        -Djava.security.policy=="$CATALINA_BASE"/conf/catalina.policy \
-        -Dcatalina.base="$CATALINA_BASE" \
-        -Dcatalina.home="$CATALINA_HOME" \
-        -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-        org.apache.catalina.startup.Bootstrap "$@" start
-    else
-      exec "$_RUNJDB" $JAVA_OPTS $CATALINA_OPTS \
-        -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-        -sourcepath "$CATALINA_HOME"/../../jakarta-tomcat-catalina/catalina/src/share \
-        -Dcatalina.base="$CATALINA_BASE" \
-        -Dcatalina.home="$CATALINA_HOME" \
-        -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-        org.apache.catalina.startup.Bootstrap "$@" start
-    fi
-  fi
-
-elif [ "$1" = "run" ]; then
-
-  shift
-  if [ "$1" = "-security" ] ; then
-    echo "Using Security Manager"
-    shift
-    exec "$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \
-      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-      -Djava.security.manager \
-      -Djava.security.policy=="$CATALINA_BASE"/conf/catalina.policy \
-      -Dcatalina.base="$CATALINA_BASE" \
-      -Dcatalina.home="$CATALINA_HOME" \
-      -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-      org.apache.catalina.startup.Bootstrap "$@" start
-  else
-    exec "$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \
-      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-      -Dcatalina.base="$CATALINA_BASE" \
-      -Dcatalina.home="$CATALINA_HOME" \
-      -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-      org.apache.catalina.startup.Bootstrap "$@" start
-  fi
-
-elif [ "$1" = "start" ] ; then
-
-  shift
-  touch "$CATALINA_BASE"/logs/catalina.out
-  if [ "$1" = "-security" ] ; then
-    echo "Using Security Manager"
-    shift
-    "$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \
-      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-      -Djava.security.manager \
-      -Djava.security.policy=="$CATALINA_BASE"/conf/catalina.policy \
-      -Dcatalina.base="$CATALINA_BASE" \
-      -Dcatalina.home="$CATALINA_HOME" \
-      -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-      org.apache.catalina.startup.Bootstrap "$@" start \
-      >> "$CATALINA_BASE"/logs/catalina.out 2>&1 &
-
-      if [ ! -z "$CATALINA_PID" ]; then
-        echo $! > $CATALINA_PID
-      fi
-  else
-    "$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \
-      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-      -Dcatalina.base="$CATALINA_BASE" \
-      -Dcatalina.home="$CATALINA_HOME" \
-      -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-      org.apache.catalina.startup.Bootstrap "$@" start \
-      >> "$CATALINA_BASE"/logs/catalina.out 2>&1 &
-
-      if [ ! -z "$CATALINA_PID" ]; then
-        echo $! > $CATALINA_PID
-      fi
-  fi
-
-elif [ "$1" = "stop" ] ; then
-
-  shift
-  FORCE=0
-  if [ "$1" = "-force" ]; then
-    shift
-    FORCE=1
-  fi
-
-  "$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \
-    -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-    -Dcatalina.base="$CATALINA_BASE" \
-    -Dcatalina.home="$CATALINA_HOME" \
-    -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-    org.apache.catalina.startup.Bootstrap "$@" stop
-
-  if [ $FORCE -eq 1 ]; then
-    if [ ! -z "$CATALINA_PID" ]; then
-       echo "Killing: `cat $CATALINA_PID`"
-       kill -9 `cat $CATALINA_PID`
-    fi
-  fi
-
-elif [ "$1" = "version" ] ; then
-
-    "$_RUNJAVA"   \
-      -classpath "$CATALINA_HOME/server/lib/catalina.jar" \
-      org.apache.catalina.util.ServerInfo
-
-else
-
-  echo "Usage: dtomcat5 ( commands ... )"
-  echo "commands:"
-  if $os400; then
-    echo "  debug             Start Catalina in a debugger (not available on OS400)"
-    echo "  debug -security   Debug Catalina with a security manager (not available on OS400)"
-  else
-    echo "  debug             Start Catalina in a debugger"
-    echo "  debug -security   Debug Catalina with a security manager"
-  fi
-  echo "  jpda start        Start Catalina under JPDA debugger"
-  echo "  run               Start Catalina in the current window"
-  echo "  run -security     Start in the current window with security manager"
-  echo "  start             Start Catalina in a separate window"
-  echo "  start -security   Start in a separate window with security manager"
-  echo "  stop              Stop Catalina"
-  echo "  stop -force       Stop Catalina (followed by kill -KILL)"
-  echo "  version           What version of tomcat are you running?"
-  exit 1
-
-fi
diff --git a/pki/base/kra/shared/conf/logging.properties b/pki/base/kra/shared/conf/logging.properties
new file mode 100644
index 000000000..796cfc071
--- /dev/null
+++ b/pki/base/kra/shared/conf/logging.properties
@@ -0,0 +1,70 @@
+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2006-2010 Red Hat, Inc.
+# All rights reserved.
+# Modifications: configuration parameters
+# --- END COPYRIGHT BLOCK ---
+
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+handlers = 1catalina.org.apache.juli.FileHandler, 2localhost.org.apache.juli.FileHandler, 3manager.org.apache.juli.FileHandler, 4host-manager.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler
+
+.handlers = 1catalina.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler
+
+############################################################
+# Handler specific properties.
+# Describes specific configuration info for Handlers.
+############################################################
+
+1catalina.org.apache.juli.FileHandler.level = FINE
+1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
+1catalina.org.apache.juli.FileHandler.prefix = catalina.
+
+2localhost.org.apache.juli.FileHandler.level = FINE
+2localhost.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
+2localhost.org.apache.juli.FileHandler.prefix = localhost.
+
+3manager.org.apache.juli.FileHandler.level = FINE
+3manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
+3manager.org.apache.juli.FileHandler.prefix = manager.
+
+4host-manager.org.apache.juli.FileHandler.level = FINE
+4host-manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
+4host-manager.org.apache.juli.FileHandler.prefix = host-manager.
+
+java.util.logging.ConsoleHandler.level = FINE
+java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
+
+
+############################################################
+# Facility specific properties.
+# Provides extra control for each logger.
+############################################################
+
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = INFO
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = 2localhost.org.apache.juli.FileHandler
+
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].level = INFO
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = 3manager.org.apache.juli.FileHandler
+
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].level = INFO
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = 4host-manager.org.apache.juli.FileHandler
+
+# For example, set the com.xyz.foo logger to only log SEVERE
+# messages:
+#org.apache.catalina.startup.ContextConfig.level = FINE
+#org.apache.catalina.startup.HostConfig.level = FINE
+#org.apache.catalina.session.ManagerBase.level = FINE
+#org.apache.catalina.core.AprLifecycleListener.level=FINE
diff --git a/pki/base/kra/shared/conf/server.xml b/pki/base/kra/shared/conf/server.xml
index 71b433bef..9a24cfa44 100644
--- a/pki/base/kra/shared/conf/server.xml
+++ b/pki/base/kra/shared/conf/server.xml
@@ -1,208 +1,196 @@
-<!-- Example Server Configuration File -->
-<!-- Note that component elements are nested corresponding to their
-     parent-child relationships with each other -->
-
-<!-- A "Server" is a singleton element that represents the entire JVM,
-     which may contain one or more "Service" instances.  The Server
-     listens for a shutdown command on the indicated port.
-
-     Note:  A "Server" is not itself a "Container", so you may not
-     define subcomponents such as "Valves" or "Loggers" at this level.
+<?xml version='1.0' encoding='utf-8'?>
+<!-- BEGIN COPYRIGHT BLOCK
+     Copyright (C) 2006-2010 Red Hat, Inc.
+     All rights reserved.
+     Modifications: configuration parameters
+     END COPYRIGHT BLOCK -->
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<!-- Note:  A "Server" is not itself a "Container", so you may not
+     define subcomponents such as "Valves" at this level.
+     Documentation at /docs/config/server.html
  -->
 
 <!-- DO NOT REMOVE - Begin PKI Status Definitions -->
 <!--
-Unsecure Port     = http://[PKI_MACHINE_NAME]:[PKI_UNSECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/ee/[PKI_SUBSYSTEM_TYPE]
-Secure Agent Port = https://[PKI_MACHINE_NAME]:[PKI_AGENT_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/agent/[PKI_SUBSYSTEM_TYPE]
-Secure EE Port    = https://[PKI_MACHINE_NAME]:[PKI_EE_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/ee/[PKI_SUBSYSTEM_TYPE]
-Secure Admin Port = https://[PKI_MACHINE_NAME]:[PKI_ADMIN_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/services
-PKI Console Port  = pkiconsole https://[PKI_MACHINE_NAME]:[PKI_ADMIN_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]
-Tomcat Port       = [TOMCAT_SERVER_PORT] (for shutdown)
+Unsecure Port       = http://[PKI_MACHINE_NAME]:[PKI_UNSECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/ee/[PKI_SUBSYSTEM_TYPE]
+Secure Agent Port   = https://[PKI_MACHINE_NAME]:[PKI_AGENT_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/agent/[PKI_SUBSYSTEM_TYPE]
+Secure EE Port      = https://[PKI_MACHINE_NAME]:[PKI_EE_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/ee/[PKI_SUBSYSTEM_TYPE]
+Secure Admin Port   = https://[PKI_MACHINE_NAME]:[PKI_ADMIN_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/services
+PKI Console Port    = pkiconsole https://[PKI_MACHINE_NAME]:[PKI_ADMIN_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]
+Tomcat Port         = [TOMCAT_SERVER_PORT] (for shutdown)
 -->
 <!-- DO NOT REMOVE - End PKI Status Definitions -->
 
 <Server port="[TOMCAT_SERVER_PORT]" shutdown="SHUTDOWN">
 
-  <!-- Comment these entries out to disable JMX MBeans support used for the 
-       administration web application -->
+  <!--APR library loader. Documentation at /docs/apr.html -->
+  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
+  <!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html -->
+  <Listener className="org.apache.catalina.core.JasperListener" />
+  <!-- JMX Support for the Tomcat server. Documentation at /docs/non-existent.html -->
   <Listener className="org.apache.catalina.mbeans.ServerLifecycleListener" />
   <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
-  <Listener className="org.apache.catalina.storeconfig.StoreConfigLifecycleListener"/>
 
-  <!-- Global JNDI resources -->
+  <!-- Global JNDI resources
+       Documentation at /docs/jndi-resources-howto.html
+  -->
   <GlobalNamingResources>
-
-    <!-- Test entry for demonstration purposes -->
-    <Environment name="simpleValue" type="java.lang.Integer" value="30"/>
-
     <!-- Editable user database that can also be used by
-         UserDatabaseRealm to authenticate users -->
+         UserDatabaseRealm to authenticate users
+    -->
     <Resource name="UserDatabase" auth="Container"
               type="org.apache.catalina.UserDatabase"
-       description="User database that can be updated and saved"
-           factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
-          pathname="conf/tomcat-users.xml" />
-
+              description="User database that can be updated and saved"
+              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
+              pathname="conf/tomcat-users.xml" />
   </GlobalNamingResources>
 
   <!-- A "Service" is a collection of one or more "Connectors" that share
-       a single "Container" (and therefore the web applications visible
-       within that Container).  Normally, that Container is an "Engine",
-       but this is not required.
-
-       Note:  A "Service" is not itself a "Container", so you may not
-       define subcomponents such as "Valves" or "Loggers" at this level.
+       a single "Container" Note:  A "Service" is not itself a "Container", 
+       so you may not define subcomponents such as "Valves" at this level.
+       Documentation at /docs/config/service.html
    -->
-
-  <!-- Define the Tomcat Stand-Alone Service -->
   <Service name="Catalina">
-
+  
+    <!--The connectors can use a shared executor, you can define one or more named thread pools-->
+    <!--
+    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-" 
+        maxThreads="150" minSpareThreads="4"/>
+    -->
+    
+    
     <!-- A "Connector" represents an endpoint by which requests are received
-         and responses are returned.  Each Connector passes requests on to the
-         associated "Container" (normally an Engine) for processing.
-
-         By default, a non-SSL HTTP/1.1 Connector is established on port 8080.
-         You can also enable an SSL HTTP/1.1 Connector on port 8443 by
-         following the instructions below and uncommenting the second Connector
-         entry.  SSL support requires the following steps (see the SSL Config
-         HOWTO in the Tomcat 5 documentation bundle for more detailed
-         instructions):
-         * If your JDK version 1.3 or prior, download and install JSSE 1.0.2 or
-           later, and put the JAR files into "$JAVA_HOME/jre/lib/ext".
-         * Execute:
-             %JAVA_HOME%\bin\keytool -genkey -alias tomcat -keyalg RSA (Windows)
-             $JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA  (Unix)
-           with a password value of "changeit" for both the certificate and
-           the keystore itself.
-
-         By default, DNS lookups are enabled when a web application calls
-         request.getRemoteHost().  This can have an adverse impact on
-         performance, so you can disable it by setting the
-         "enableLookups" attribute to "false".  When DNS lookups are disabled,
-         request.getRemoteHost() will return the String version of the
-         IP address of the remote client.
+         and responses are returned. Documentation at :
+         Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
+         Java AJP  Connector: /docs/config/ajp.html
+         APR (HTTP/AJP) Connector: /docs/apr.html
+         Define a non-SSL HTTP/1.1 Connector on port 8080
     -->
 
-<!-- Define a non-SSL HTTP/1.1 Connector on port 8080 -->
-[PKI_UNSECURE_PORT_SERVER_COMMENT]
-<Connector name="[PKI_UNSECURE_PORT_CONNECTOR_NAME]" port="[PKI_UNSECURE_PORT]" maxHttpHeaderSize="8192"
-        maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
-        enableLookups="false" redirectPort="8443" acceptCount="100"
-        connectionTimeout="20000" disableUploadTimeout="true"/>
-
-
-<!-- Define a SSL HTTP/1.1 Connector on port 8443 -->
-[PKI_SECURE_PORT_SERVER_COMMENT]
-<!-- DO NOT REMOVE - Begin define PKI secure port -->
-<Connector name="[PKI_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_SECURE_PORT]" maxHttpHeaderSize="8192"
-        maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
-        enableLookups="false" disableUploadTimeout="true"
-        acceptCount="100" scheme="https" secure="true"
-        clientAuth="[PKI_AGENT_CLIENTAUTH]" sslProtocol="SSL"
-        sslOptions="ssl2=false,ssl3=true,tls=true"
-        ssl2Ciphers="-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL2_DES_64_CBC_WITH_MD5,-SSL2_DES_192_EDE3_CBC_WITH_MD5"
-        ssl3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        tls3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
-        serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
-        passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
-        passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
-        certdbDir="[PKI_INSTANCE_PATH]/alias"/>
-<!-- DO NOT REMOVE - End define PKI secure port -->
-
-[PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_ADMIN_SECURE_PORT_SERVER_COMMENT]
-<Connector name="[PKI_ADMIN_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_ADMIN_SECURE_PORT]" maxHttpHeaderSize="8192"
-        maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
-        enableLookups="false" disableUploadTimeout="true"
-        acceptCount="100" scheme="https" secure="true"
-        clientAuth="false" sslProtocol="SSL"
-        sslOptions="ssl2=false,ssl3=true,tls=true"
-        ssl2Ciphers="-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL2_DES_64_CBC_WITH_MD5,-SSL2_DES_192_EDE3_CBC_WITH_MD5"
-        ssl3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        tls3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
-        serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
-        passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
-        passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
-        certdbDir="[PKI_INSTANCE_PATH]/alias"/>
-[PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT]
-
-[PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_EE_SECURE_PORT_SERVER_COMMENT]
-<Connector name="[PKI_EE_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_EE_SECURE_PORT]" maxHttpHeaderSize="8192"
-        maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
-        enableLookups="false" disableUploadTimeout="true"
-        acceptCount="100" scheme="https" secure="true"
-        clientAuth="false" sslProtocol="SSL"
-        sslOptions="ssl2=false,ssl3=true,tls=true"
-        ssl2Ciphers="-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL2_DES_64_CBC_WITH_MD5,-SSL2_DES_192_EDE3_CBC_WITH_MD5"
-        ssl3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        tls3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
-        serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
-        passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
-        passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
-        certdbDir="[PKI_INSTANCE_PATH]/alias"/>
-[PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT]
-
-    <!-- Note : To disable connection timeouts, set connectionTimeout value
-     to 0 -->
-	
-	<!-- Note : To use gzip compression you could set the following properties :
-	
-			   compression="on" 
-			   compressionMinSize="2048" 
-			   noCompressionUserAgents="gozilla, traviata" 
-			   compressableMimeType="text/html,text/xml"
-	-->
-
+    [PKI_UNSECURE_PORT_SERVER_COMMENT]
+    <Connector name="[PKI_UNSECURE_PORT_CONNECTOR_NAME]" port="[PKI_UNSECURE_PORT]" protocol="HTTP/1.1" redirectPort="8443" 
+	       maxHttpHeaderSize="8192"
+	       acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
+	       enableLookups="false" connectionTimeout="20000" disableUploadTimeout="true"
+	       />
+
+    <!-- Define a SSL HTTP/1.1 Connector on port 8443 -->
+    [PKI_SECURE_PORT_SERVER_COMMENT]
+    <!-- DO NOT REMOVE - Begin define PKI secure port -->
+    <Connector name="[PKI_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_SECURE_PORT]" protocol="HTTP/1.1" SSLEnabled="true" sslProtocol="SSL" scheme="https" secure="true"
+	       maxHttpHeaderSize="8192"
+	       acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
+	       enableLookups="false" connectionTimeout="20000" disableUploadTimeout="true"
+	       SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
+	       clientAuth="[PKI_AGENT_CLIENTAUTH]"
+	       sslOptions="[TOMCAT_SSL_OPTIONS]"
+	       ssl2Ciphers="[TOMCAT_SSL2_CIPHERS]"
+	       ssl3Ciphers="[TOMCAT_SSL3_CIPHERS]"
+	       tls3Ciphers="[TOMCAT_TLS3_CIPHERS]"
+	       serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
+	       passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
+	       passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
+	       certdbDir="[PKI_INSTANCE_PATH]/alias"
+	       />
+    <!-- DO NOT REMOVE - End define PKI secure port -->
+
+    [PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_ADMIN_SECURE_PORT_SERVER_COMMENT]
+    <Connector name="[PKI_ADMIN_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_ADMIN_SECURE_PORT]" SSLEnabled="true" sslProtocol="SSL" scheme="https" secure="true"
+	       maxHttpHeaderSize="8192"
+	       acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
+	       enableLookups="false" disableUploadTimeout="true"
+	       SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
+	       clientAuth="false"
+	       sslOptions="[TOMCAT_SSL_OPTIONS]"
+	       ssl2Ciphers="[TOMCAT_SSL2_CIPHERS]"
+	       ssl3Ciphers="[TOMCAT_SSL3_CIPHERS]"
+	       tls3Ciphers="[TOMCAT_TLS3_CIPHERS]"
+	       serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
+	       passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
+	       passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
+	       certdbDir="[PKI_INSTANCE_PATH]/alias"/>
+    [PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT]
+
+    [PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_EE_SECURE_PORT_SERVER_COMMENT]
+    <Connector name="[PKI_EE_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_EE_SECURE_PORT]" SSLEnabled="true" sslProtocol="SSL" scheme="https" secure="true"
+	       maxHttpHeaderSize="8192"
+	       acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
+	       enableLookups="false" connectionTimeout="20000" disableUploadTimeout="true"
+	       SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
+	       clientAuth="false"
+	       sslOptions="[TOMCAT_SSL_OPTIONS]"
+	       ssl2Ciphers="[TOMCAT_SSL2_CIPHERS]"
+	       ssl3Ciphers="[TOMCAT_SSL3_CIPHERS]"
+	       tls3Ciphers="[TOMCAT_TLS3_CIPHERS]"
+	       serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
+	       passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
+	       passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
+	       certdbDir="[PKI_INSTANCE_PATH]/alias"/>
+    [PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT]
+
+    <!-- A "Connector" using the shared thread pool-->
+    <!--
+    <Connector executor="tomcatThreadPool"
+               port="8080" protocol="HTTP/1.1" 
+               connectionTimeout="20000" 
+               redirectPort="8443" />
+    -->           
+    <!-- Define a SSL HTTP/1.1 Connector on port 8443
+         This connector uses the JSSE configuration, when using APR, the 
+         connector should be using the OpenSSL style configuration
+         described in the APR documentation -->
+    <!--
+    <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
+               maxThreads="150" scheme="https" secure="true"
+               clientAuth="false" sslProtocol="TLS" />
+    -->
 
     <!-- Define an AJP 1.3 Connector on port 8009 -->
 <!--
-    <Connector port="8009" 
-               enableLookups="false" redirectPort="8443" protocol="AJP/1.3" />
+    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
 -->
 
-    <!-- Define a Proxied HTTP/1.1 Connector on port 8082 -->
-    <!-- See proxy documentation for more information about using this. -->
-    <!--
-    <Connector port="8082" 
-               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
-               enableLookups="false" acceptCount="100" connectionTimeout="20000"
-               proxyPort="80" disableUploadTimeout="true" />
-    -->
 
     <!-- An Engine represents the entry point (within Catalina) that processes
          every request.  The Engine implementation for Tomcat stand alone
          analyzes the HTTP headers included with the request, and passes them
-         on to the appropriate Host (virtual host). -->
+         on to the appropriate Host (virtual host).
+         Documentation at /docs/config/engine.html -->
 
     <!-- You should set jvmRoute to support load-balancing via AJP ie :
-    <Engine name="Standalone" defaultHost="localhost" jvmRoute="jvm1">         
+    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">         
     --> 
-         
-    <!-- Define the top level container in our container hierarchy -->
     <Engine name="Catalina" defaultHost="localhost">
 
-      <!-- The request dumper valve dumps useful debugging information about
-           the request headers and cookies that were received, and the response
-           headers and cookies that were sent, for all requests received by
-           this instance of Tomcat.  If you care only about requests to a
-           particular virtual host, or a particular application, nest this
-           element inside the corresponding <Host> or <Context> entry instead.
-
-           For a similar mechanism that is portable to all Servlet 2.4
-           containers, check out the "RequestDumperFilter" Filter in the
-           example application (the source for this filter may be found in
-           "$CATALINA_HOME/webapps/examples/WEB-INF/classes/filters").
+      <!--For clustering, please take a look at documentation at:
+          /docs/cluster-howto.html  (simple how to)
+          /docs/config/cluster.html (reference documentation) -->
+      <!--
+      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
+      -->        
 
-           Request dumping is disabled by default.  Uncomment the following
-           element to enable it. -->
+      <!-- The request dumper valve dumps useful debugging information about
+           the request and response data received and sent by Tomcat.
+           Documentation at: /docs/config/valve.html -->
       <!--
       <Valve className="org.apache.catalina.valves.RequestDumperValve"/>
       -->
 
-      <!-- Because this Realm is here, an instance will be shared globally -->
-
       <!-- This Realm uses the UserDatabase configured in the global JNDI
            resources under the key "UserDatabase".  Any edits
            that are performed against this UserDatabase are immediately
@@ -210,229 +198,27 @@ Tomcat Port       = [TOMCAT_SERVER_PORT] (for shutdown)
       <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
              resourceName="UserDatabase"/>
 
-      <!-- Comment out the old realm but leave here for now in case we
-           need to go back quickly -->
-      <!--
-      <Realm className="org.apache.catalina.realm.MemoryRealm" />
-      -->
-
-      <!-- Replace the above Realm with one of the following to get a Realm
-           stored in a database and accessed via JDBC -->
-
-      <!--
-      <Realm  className="org.apache.catalina.realm.JDBCRealm"
-             driverName="org.gjt.mm.mysql.Driver"
-          connectionURL="jdbc:mysql://localhost/authority"
-         connectionName="test" connectionPassword="test"
-              userTable="users" userNameCol="user_name" userCredCol="user_pass"
-          userRoleTable="user_roles" roleNameCol="role_name" />
-      -->
-
-      <!--
-      <Realm  className="org.apache.catalina.realm.JDBCRealm"
-             driverName="oracle.jdbc.driver.OracleDriver"
-          connectionURL="jdbc:oracle:thin:@ntserver:1521:ORCL"
-         connectionName="scott" connectionPassword="tiger"
-              userTable="users" userNameCol="user_name" userCredCol="user_pass"
-          userRoleTable="user_roles" roleNameCol="role_name" />
-      -->
-
-      <!--
-      <Realm  className="org.apache.catalina.realm.JDBCRealm"
-             driverName="sun.jdbc.odbc.JdbcOdbcDriver"
-          connectionURL="jdbc:odbc:CATALINA"
-              userTable="users" userNameCol="user_name" userCredCol="user_pass"
-          userRoleTable="user_roles" roleNameCol="role_name" />
-      -->
-
       <!-- Define the default virtual host
            Note: XML Schema validation will not work with Xerces 2.2.
        -->
-      <Host name="localhost" appBase="webapps"
-       unpackWARs="true" autoDeploy="false" 
-       xmlValidation="false" xmlNamespaceAware="false">
-
-        <!-- Defines a cluster for this node,
-             By defining this element, means that every manager will be changed.
-             So when running a cluster, only make sure that you have webapps in there
-             that need to be clustered and remove the other ones.
-             A cluster has the following parameters:
-
-             className = the fully qualified name of the cluster class
-
-             name = a descriptive name for your cluster, can be anything
-
-             mcastAddr = the multicast address, has to be the same for all the nodes
-
-             mcastPort = the multicast port, has to be the same for all the nodes
-             
-             mcastBindAddr = bind the multicast socket to a specific address
-             
-             mcastTTL = the multicast TTL if you want to limit your broadcast
-             
-             mcastSoTimeout = the multicast readtimeout 
-
-             mcastFrequency = the number of milliseconds in between sending a "I'm alive" heartbeat
+      <Host name="localhost"  appBase="webapps"
+            unpackWARs="true" autoDeploy="false"
+            xmlValidation="false" xmlNamespaceAware="false">
 
-             mcastDropTime = the number a milliseconds before a node is considered "dead" if no heartbeat is received
-
-             tcpThreadCount = the number of threads to handle incoming replication requests, optimal would be the same amount of threads as nodes 
-
-             tcpListenAddress = the listen address (bind address) for TCP cluster request on this host, 
-                                in case of multiple ethernet cards.
-                                auto means that address becomes
-                                InetAddress.getLocalHost().getHostAddress()
-
-             tcpListenPort = the tcp listen port
-
-             tcpSelectorTimeout = the timeout (ms) for the Selector.select() method in case the OS
-                                  has a wakup bug in java.nio. Set to 0 for no timeout
-
-             printToScreen = true means that managers will also print to std.out
-
-             expireSessionsOnShutdown = true means that 
-
-             useDirtyFlag = true means that we only replicate a session after setAttribute,removeAttribute has been called.
-                            false means to replicate the session after each request.
-                            false means that replication would work for the following piece of code: (only for SimpleTcpReplicationManager)
-                            <%
-                            HashMap map = (HashMap)session.getAttribute("map");
-                            map.put("key","value");
-                            %>
-             replicationMode = can be either 'pooled', 'synchronous' or 'asynchronous'.
-                               * Pooled means that the replication happens using several sockets in a synchronous way. Ie, the data gets replicated, then the request return. This is the same as the 'synchronous' setting except it uses a pool of sockets, hence it is multithreaded. This is the fastest and safest configuration. To use this, also increase the nr of tcp threads that you have dealing with replication.
-                               * Synchronous means that the thread that executes the request, is also the
-                               thread the replicates the data to the other nodes, and will not return until all
-                               nodes have received the information.
-                               * Asynchronous means that there is a specific 'sender' thread for each cluster node,
-                               so the request thread will queue the replication request into a "smart" queue,
-                               and then return to the client.
-                               The "smart" queue is a queue where when a session is added to the queue, and the same session
-                               already exists in the queue from a previous request, that session will be replaced
-                               in the queue instead of replicating two requests. This almost never happens, unless there is a 
-                               large network delay.
-        -->             
-        <!--
-            When configuring for clustering, you also add in a valve to catch all the requests
-            coming in, at the end of the request, the session may or may not be replicated.
-            A session is replicated if and only if all the conditions are met:
-            1. useDirtyFlag is true or setAttribute or removeAttribute has been called AND
-            2. a session exists (has been created)
-            3. the request is not trapped by the "filter" attribute
-
-            The filter attribute is to filter out requests that could not modify the session,
-            hence we don't replicate the session after the end of this request.
-            The filter is negative, ie, anything you put in the filter, you mean to filter out,
-            ie, no replication will be done on requests that match one of the filters.
-            The filter attribute is delimited by ;, so you can't escape out ; even if you wanted to.
-
-            filter=".*\.gif;.*\.js;" means that we will not replicate the session after requests with the URI
-            ending with .gif and .js are intercepted.
-            
-            The deployer element can be used to deploy apps cluster wide.
-            Currently the deployment only deploys/undeploys to working members in the cluster
-            so no WARs are copied upons startup of a broken node.
-            The deployer watches a directory (watchDir) for WAR files when watchEnabled="true"
-            When a new war file is added the war gets deployed to the local instance,
-            and then deployed to the other instances in the cluster.
-            When a war file is deleted from the watchDir the war is undeployed locally 
-            and cluster wide
-        -->
-        
-        <!--
-        <Cluster className="org.apache.catalina.cluster.tcp.SimpleTcpCluster"
-                 managerClassName="org.apache.catalina.cluster.session.DeltaManager"
-                 expireSessionsOnShutdown="false"
-                 useDirtyFlag="true"
-                 notifyListenersOnReplication="true">
-
-            <Membership 
-                className="org.apache.catalina.cluster.mcast.McastService"
-                mcastAddr="228.0.0.4"
-                mcastPort="45564"
-                mcastFrequency="500"
-                mcastDropTime="3000"/>
-
-            <Receiver 
-                className="org.apache.catalina.cluster.tcp.ReplicationListener"
-                tcpListenAddress="auto"
-                tcpListenPort="4001"
-                tcpSelectorTimeout="100"
-                tcpThreadCount="6"/>
-
-            <Sender
-                className="org.apache.catalina.cluster.tcp.ReplicationTransmitter"
-                replicationMode="pooled"
-                ackTimeout="15000"/>
-
-            <Valve className="org.apache.catalina.cluster.tcp.ReplicationValve"
-                   filter=".*\.gif;.*\.js;.*\.jpg;.*\.png;.*\.htm;.*\.html;.*\.css;.*\.txt;"/>
-                   
-            <Deployer className="org.apache.catalina.cluster.deploy.FarmWarDeployer"
-                      tempDir="/tmp/war-temp/"
-                      deployDir="/tmp/war-deploy/"
-                      watchDir="/tmp/war-listen/"
-                      watchEnabled="false"/>
-        </Cluster>
-        -->        
-
-
-
-        <!-- Normally, users must authenticate themselves to each web app
-             individually.  Uncomment the following entry if you would like
-             a user to be authenticated the first time they encounter a
-             resource protected by a security constraint, and then have that
-             user identity maintained across *all* web applications contained
-             in this virtual host. -->
+        <!-- SingleSignOn valve, share authentication between web applications
+             Documentation at: /docs/config/valve.html -->
         <!--
         <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
         -->
 
-        <!-- Access log processes all requests for this virtual host.  By
-             default, log files are created in the "logs" directory relative to
-             $CATALINA_HOME.  If you wish, you can specify a different
-             directory with the "directory" attribute.  Specify either a relative
-             (to $CATALINA_HOME) or absolute path to the desired directory.
-        -->
-        <Valve className="org.apache.catalina.valves.AccessLogValve"
-                 directory="logs"  prefix="localhost_access_log." suffix=".txt"
-                 pattern="common" resolveHosts="false"/>
-
-        <!-- Access log processes all requests for this virtual host.  By
-             default, log files are created in the "logs" directory relative to
-             $CATALINA_HOME.  If you wish, you can specify a different
-             directory with the "directory" attribute.  Specify either a relative
-             (to $CATALINA_HOME) or absolute path to the desired directory.
-             This access log implementation is optimized for maximum performance,
-             but is hardcoded to support only the "common" and "combined" patterns.
-        -->
+        <!-- Access log processes all example.
+             Documentation at: /docs/config/valve.html -->
         <!--
-        <Valve className="org.apache.catalina.valves.FastCommonAccessLogValve"
-                 directory="logs"  prefix="localhost_access_log." suffix=".txt"
-                 pattern="common" resolveHosts="false"/>
+        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"  
+               prefix="localhost_access_log." suffix=".txt" pattern="common" resolveHosts="false"/>
         -->
-        <!-- Access log processes all requests for this virtual host.  By
-             default, log files are created in the "logs" directory relative to
-             $CATALINA_HOME.  If you wish, you can specify a different
-             directory with the "directory" attribute.  Specify either a relative
-             (to $CATALINA_HOME) or absolute path to the desired directory.
-             This access log implementation is optimized for maximum performance,
-             but is hardcoded to support only the "common" and "combined" patterns.
 
-             This valve use NIO direct Byte Buffer to asynchornously store the
-             log.
-        -->
-        <!--
-        <Valve className="org.apache.catalina.valves.ByteBufferAccessLogValve"
-                 directory="logs"  prefix="localhost_access_log." suffix=".txt"
-                 pattern="common" resolveHosts="false"/>
-        -->
-
-       <!--  <Context docBase="webapps" path="/webapps" reloadable="false"/> -->
       </Host>
-
     </Engine>
-
   </Service>
-
 </Server>
diff --git a/pki/base/kra/shared/conf/tomcat-users.xml b/pki/base/kra/shared/conf/tomcat-users.xml
index 920e68240..daa9260cc 100644
--- a/pki/base/kra/shared/conf/tomcat-users.xml
+++ b/pki/base/kra/shared/conf/tomcat-users.xml
@@ -1,13 +1,45 @@
 <?xml version='1.0' encoding='utf-8'?>
+<!-- BEGIN COPYRIGHT BLOCK
+     Copyright (C) 2006-2010 Red Hat, Inc.
+     All rights reserved.
+     Modifications: configuration parameters
+     END COPYRIGHT BLOCK -->
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+
+<!--
+  <role rolename="tomcat"/>
+  <role rolename="role1"/>
+  <user username="tomcat" password="tomcat" roles="tomcat"/>
+  <user username="both" password="tomcat" roles="tomcat,role1"/>
+  <user username="role1" password="tomcat" roles="role1"/>
+-->
+
+<!-- The host manager webapp is restricted to users with role "admin" -->
+<!--<user name="tomcat" password="password" roles="admin" />-->
+<!-- The manager webapp is restricted to users with role "manager" -->
+<!--<user name="tomcat" password="password" roles="manager" />-->
 <tomcat-users>
   <role rolename="pkiuser"/>
   <role rolename="tomcat"/>
-  <role rolename="role1"/>
   <role rolename="manager"/>
   <role rolename="admin"/>
+
   <user username="pkiuser" password="pkiuser" roles="pkiuser"/>
   <user username="tomcat" password="tomcat" roles="tomcat"/>
-  <user username="both" password="tomcat" roles="tomcat,role1"/>
-  <user username="role1" password="tomcat" roles="role1"/>
   <user username="admin" password="netscape" roles="admin,manager"/>
 </tomcat-users>
diff --git a/pki/base/kra/shared/conf/tomcat5.conf b/pki/base/kra/shared/conf/tomcat5.conf
deleted file mode 100644
index 181fb12dc..000000000
--- a/pki/base/kra/shared/conf/tomcat5.conf
+++ /dev/null
@@ -1,74 +0,0 @@
-# tomcat5 service configuration file
-
-# Check to insure that this configuration file's associated PKI
-# subsystem currently resides on this system.
-PKI_SUBSYSTEM_TYPE=[PKI_SUBSYSTEM_TYPE]
-if [ ! -d /usr/share/pki/${PKI_SUBSYSTEM_TYPE} ] ; then
-	echo "This machine is missing the '${PKI_SUBSYSTEM_TYPE}' subsystem!"
-	exit 255
-fi
-
-# you could also override JAVA_HOME here
-# Where your java installation lives
-JAVA_HOME="/usr/lib/jvm/jre"
-
-# You can pass some parameters to java
-# here if you wish to
-#JAVA_OPTS="-Xminf0.1 -Xmaxf0.3"
-
-# Where your tomcat installation lives
-# That change from previous RPM where TOMCAT_HOME 
-# used to be /var/tomcat.
-# Now /var/tomcat will be the base for webapps only
-CATALINA_HOME="/usr/share/tomcat5"
-JASPER_HOME="/usr/share/tomcat5"
-CATALINA_TMPDIR="/usr/share/tomcat5/temp"
-JAVA_ENDORSED_DIRS="/usr/share/tomcat5/common/endorsed"
-
-# What user should run tomcat
-TOMCAT_USER="[PKI_USER]"
-TOMCAT_GROUP="[PKI_GROUP]"
-
-# You can change your tomcat locale here
-#LANG=en_US
-
-# Time to wait in seconds, while starting process
-STARTUP_WAIT=30
-
-# Time to wait in seconds, before killing process
-SHUTDOWN_WAIT=30
-
-
-# If you wish to further customize your tomcat environment,
-# put your own definitions here
-# (i.e. LD_LIBRARY_PATH for some jdbc drivers)
-# Just do not forget to export them :)
-
-OS=`uname -s`
-if [ $OS = "Linux" ]; then
-	PLATFORM=`uname -i`
-	if [ $PLATFORM = "i386" ]; then
-		# 32-bit Linux
-		LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib/dirsec:/usr/lib
-	elif [ $PLATFORM = "x86_64" ]; then
-		# 64-bit Linux
-		LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib64/dirsec:/usr/lib64:/usr/lib
-	fi
-	export LD_LIBRARY_PATH
-elif [ $PLATFORM = "SunOS" ]; then
-	PLATFORM=`uname -p`
-	if	[ "${PLATFORM}" = "sparc" ] &&
-		[ -d "/usr/lib/sparcv9/" ] ; then
-		PLATFORM="sparcv9"
-	fi
-	if [ $PLATFORM = "sparc" ]; then
-		# 32-bit Solaris
-		LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib/dirsec:/usr/lib
-	elif [ $PLATFORM = "sparcv9" ]; then
-		# 64-bit Solaris
-		JAVA_OPTS="-d64"
-		export JAVA_OPTS
-		LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib/sparcv9/dirsec:/usr/lib/sparcv9:/usr/lib/dirsec:/usr/lib
-	fi
-	export LD_LIBRARY_PATH
-fi
diff --git a/pki/base/kra/shared/conf/tomcat6.conf b/pki/base/kra/shared/conf/tomcat6.conf
new file mode 100644
index 000000000..31385567d
--- /dev/null
+++ b/pki/base/kra/shared/conf/tomcat6.conf
@@ -0,0 +1,55 @@
+# Service-specific configuration file for tomcat6. This will be sourced by
+# the SysV init script after the global configuration file
+# /etc/tomcat6/tomcat6.conf, thus allowing values to be overridden in
+# a per-service manner.
+#
+# NEVER change the init script itself. To change values for all services make
+# your changes in /etc/tomcat6/tomcat6.conf
+#
+# To change values for a specific service make your edits here.
+# To create a new service create a link from /etc/init.d/<your new service> to
+# /etc/init.d/tomcat6 (do not copy the init script) and make a copy of the
+# /etc/sysconfig/tomcat6 file to /etc/sysconfig/<your new service> and change
+# the property values so the two services won't conflict. Register the new
+# service in the system as usual (see chkconfig and similars).
+#
+
+# Where your java installation lives
+#JAVA_HOME="/usr/lib/jvm/java"
+
+# Where your tomcat installation lives
+CATALINA_BASE="[PKI_INSTANCE_PATH]"
+#CATALINA_HOME="/usr/share/tomcat6"
+#JASPER_HOME="/usr/share/tomcat6"
+#CATALINA_TMPDIR="/var/cache/tomcat6/temp"
+
+# You can pass some parameters to java here if you wish to
+#JAVA_OPTS="-Xminf0.1 -Xmaxf0.3"
+
+# Use JAVA_OPTS to set java.library.path for libtcnative.so
+#JAVA_OPTS="-Djava.library.path=/usr/lib64"
+
+# What user should run tomcat
+TOMCAT_USER="[PKI_USER]"
+
+# You can change your tomcat locale here
+#LANG="en_US"
+
+# Run tomcat under the Java Security Manager
+#SECURITY_MANAGER="false"
+
+# Time to wait in seconds, before killing process
+#SHUTDOWN_WAIT="30"
+
+# Whether to annoy the user with "attempting to shut down" messages or not
+#SHUTDOWN_VERBOSE="false"
+
+# Set the TOMCAT_PID location
+CATALINA_PID="[TOMCAT_PIDFILE]"
+
+# Connector port is 8080 for this tomcat6 instance
+#CONNECTOR_PORT="8080"
+
+# If you wish to further customize your tomcat environment,
+# put your own definitions here
+# (i.e. LD_LIBRARY_PATH for some jdbc drivers)
diff --git a/pki/base/kra/shared/etc/init.d/pki-krad b/pki/base/kra/shared/etc/init.d/pki-krad
index 5a3b9be9b..b27dc8c62 100755
--- a/pki/base/kra/shared/etc/init.d/pki-krad
+++ b/pki/base/kra/shared/etc/init.d/pki-krad
@@ -14,1816 +14,70 @@
 # with this program; if not, write to the Free Software Foundation, Inc.,
 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
-# Copyright (C) 2007 Red Hat, Inc.
+# Copyright (C) 2007-2010 Red Hat, Inc.
 # All rights reserved.
-# --- END COPYRIGHT BLOCK ### ---
+# --- END COPYRIGHT BLOCK ---
 #
-# pki-krad   Startup script for Tomcat 5.0 pki-kra, the Apache Servlet Engine
+# pki-krad   Startup script pki-kra with tomcat6
 #
 # chkconfig:    - 82 18
-# description:  Data Recovery Manager \
-#               (Tomcat 5.0)
+# description:  Data Recovery Manager (Tomcat 6.0)
 # processname:  pki-krad
 # piddir:       /var/run/pki/kra
-# config:       ${PKI_INSTANCE_PATH}/conf/tomcat5.conf
-#
-# Gomez Henri <hgomez@users.sourceforge.net>
-# Keith Irwin <keith_irwin@non.hp.com>
-# Nicolas Mailhot <nicolas.mailhot@one2team.com>
-#
-# version 1.02 - Removed initlog support
-# version 1.03 - Removed config:
-# version 1.04 - tomcat will start before httpd and stop after httpd
-# version 1.05 - jdk hardcoded to link /usr/java/jdk and tomcat runs
-#                as "nobody"
-# version 1.06 - split up into script and config file
-# version 1.07 - Rework from Nicolas ideas
-# version 1.08 - Fix work dir permission at start time, switch to use tomcat4
-# version 1.09 - Fix pidfile and config tags
-# version 1.10 - Fallback to su direct use on systems without
-#                Redhat/Mandrake init.d functions
-# version 1.11 - Fix webapps dir permissions
-# version 1.12 - remove initial start/stop level for chkconfig (- 80 20)
-# version 1.13 - remove chown of logs/work/temp/webapps dir,
-#                owned by tomcat4 at install time
-# version 1.14 - correct the start/stop ugly hack by waiting
-#                all the threads stops
-# version 1.15 - ensure we're looking for TOMCAT_USER running catalina
-# version 1.16 - Add support for CATALINA_PID env var
-# version 1.17 - Remove run files only tomcat started correctl
-#                in start area, check that tomcat is not allready running
-# version 1.18 - Fix kill typo (thanks Kaj J. Niemi)
-# version 1.19 - Add jar relinking
-# version 1.20 - Check there is no stalling tomcat4.pid
-# version 1.20tc5 - Changed all instances of tomcat4 to
-#                   tomcat5 except TOMCAT_USER
-# version 1.20tc5rh - Changed TOMCAT_USER from tomcat4 to tomcat
 #
 
-PKI_INIT_SCRIPT=""
+PROG_NAME=`basename $0`
+SERVICE_NAME="pki-krad"
+SERVICE_PROG="/sbin/service"
 PKI_PATH="/usr/share/pki/kra"
-PKI_PIDDIR="/var/run/pki/kra"
-PKI_PROCESS="pki-krad"
 PKI_REGISTRY="/etc/sysconfig/pki/kra"
 PKI_TYPE="pki-kra"
-
-# PKI subsystem-level directory and file values for locks
-lockfile="/var/lock/subsys/pki-krad"
+PKI_TOTAL_PORTS=6
 
 # Disallow 'others' the ability to 'write' to new files
 umask 00002
 
-default_error=0
 command="$1"
 pki_instance="$2"
-case "${command}" in
-	start|stop|restart|condrestart|force-restart|try-restart)
-		# * 1 generic or unspecified error (current practice)
-		default_error=1
-		;;
-	reload)
-		default_error=3
-		;;
-	status)
-		# * 4 program or service status is unknown
-		default_error=4
-		;;
-	*)
-		# * 2 invalid argument(s)
-		default_error=2
-		;;
-esac
-
-# Check to insure that this script's original invocation directory
-# has not been deleted!
-CWD=`/bin/pwd > /dev/null 2>&1`
-if [ $? -ne 0 ] ; then
-	echo "Cannot invoke '$0' from non-existent directory!"
-	exit ${default_error}
-fi
-
-# Check to insure that this script's associated PKI
-# subsystem currently resides on this system.
-if [ ! -d ${PKI_PATH} ] ; then
-	echo "This machine is missing the '${PKI_TYPE}' subsystem!"
-	if [ "${command}" != "status" ]; then
-		# * 5 program is not installed
-		exit 5
-	else
-		exit ${default_error}
-	fi
-fi
-
-# Check to insure that this script's associated PKI
-# subsystem instance registry currently resides on this system.
-if [ ! -d ${PKI_REGISTRY} ] ; then
-	echo "This machine contains no registered '${PKI_TYPE}' subsystem instances!"
-	if [ "${command}" != "status" ]; then
-		# * 5 program is not installed
-		exit 5
-	else
-		exit ${default_error}
-	fi
-fi
-
-# Obtain the operating system upon which this script is being executed
-OS=`uname -s`
-ARCHITECTURE=""
-
-# This script must be run as root!
-RV=0
-if [ ${OS} = "Linux" ] ; then
-	PKI_INIT_SCRIPT="/sbin/service ${PKI_PROCESS}"
-	if [ `id -u` -ne 0 ] ; then
-		echo "Must be 'root' to execute '$0'!"
-		if [ "${command}" != "status" ]; then
-			# * 4 user had insufficient privilege
-			exit 4
-		else
-			# * 4 program or service status is unknown
-			exit 4
-		fi
-	fi
-	ARCHITECTURE=`uname -i`
-elif [ ${OS} = "SunOS" ] ; then
-	PKI_INIT_SCRIPT="/etc/init.d/${PKI_PROCESS}"
-	if [ `/usr/xpg4/bin/id -u` -ne 0 ] ; then
-		echo "Must be 'root' to execute '$0'!"
-		if [ "${command}" != "status" ]; then
-			# * 4 user had insufficient privilege
-			exit 4
-		else
-			# * 4 program or service status is unknown
-			exit 4
-		fi
-	fi
-	ARCHITECTURE=`uname -p`
-	if	[ "${ARCHITECTURE}" = "sparc" ] &&
-		[ -d "/usr/lib/sparcv9/" ] ; then
-		ARCHITECTURE="sparcv9"
-	fi
-else
-	echo "Unsupported OS '${OS}'!"
-	exit ${default_error}
-fi
 
 # Source function library.
-if [ -f /etc/init.d/functions ]; then
-	. /etc/init.d/functions
-else
-	# The checkpid() function is provided for platforms that do not
-	# contain the "/etc/init.d/functions" file (e. g. - Solaris) . . .
-
-	# Check if ${pid} (could be plural) are running (keep count)
-	checkpid()
-	{
-		rv=0
-		for i in $* ; do
-			ps -p $i > /dev/null 2>&1 ;
-			if [ $? -ne 0 ] ; then
-				rv=`expr ${rv} + 1`
-			else
-				rv=`expr ${rv} + 0`
-			fi
-		done
-		# echo "rv=${rv}"
-		return ${rv}
-	}
-
-	# Create the following directories on platforms
-	# where they do not exist (e. g. - Solaris) . . .
-	if [ ! -d "/var/lock" ] ; then
-		mkdir -p /var/lock
-		chown root:sys /var/lock
-		chmod 00755 /var/lock
-	fi
-	if [ ! -d "/var/lock/subsys" ] ; then
-		mkdir -p /var/lock/subsys
-		chown root:root /var/lock/subsys
-		chmod 00755 /var/lock/subsys
-	fi
-
-	#######################################################################
-	## NOTE:  The following code needs to eventually be moved into the   ##
-	##        template used to create the                                ##
-	##        "${PKI_INSTANCE_PATH}/conf/tomcat5.conf" file!             ##
-	#######################################################################
-
-	if [ ${OS} = "SunOS" ] ; then
-		DEFAULT_SOLARIS_JAVA_HOME="/usr/jdk/instances/jdk1.5.0/jre"
-		DEFAULT_LINUX_JAVA_HOME="/usr/lib/jvm/jre"
-		DEFAULT_LINUX_JAVA_HOME_PATH=`dirname ${DEFAULT_LINUX_JAVA_HOME}`
-
-		# ensure that the Sun JRE 1.5.0 exists at the default location
-		if [ -d ${DEFAULT_SOLARIS_JAVA_HOME} ] ; then
-			# create the directory in which the symlink resides (if necessary)
-			if [ ! -d ${DEFAULT_LINUX_JAVA_HOME_PATH} ] ; then
-				mkdir -p ${DEFAULT_LINUX_JAVA_HOME_PATH}
-			fi
-			# create the actual symlink (if necessary)
-			if [ ! -h ${DEFAULT_LINUX_JAVA_HOME} ] ; then
-				ln -s ${DEFAULT_SOLARIS_JAVA_HOME} ${DEFAULT_LINUX_JAVA_HOME}
-			fi
-		else
-			# for now, simply exit with an appropriate error message
-			echo -n "The Solaris 1.5.0 JRE must be installed "
-			echo -n "at \"${DEFAULT_SOLARIS_JAVA_HOME}\"!"
-			echo
-			echo
-			exit ${default_error}
-		fi
-	fi
-fi
-
-PKI_REGISTRY_ENTRIES=""
-TOTAL_PKI_REGISTRY_ENTRIES=0
-TOTAL_UNCONFIGURED_PKI_ENTRIES=0
-
-# Gather ALL registered instances of this PKI subsystem type
-for FILE in `/bin/ls -1 ${PKI_REGISTRY}/* 2>/dev/null`; do
-	if [ -f "$FILE" ] ; then
-		inst=`echo "$FILE"`
-		PKI_REGISTRY_ENTRIES="${PKI_REGISTRY_ENTRIES} $inst"
-		TOTAL_PKI_REGISTRY_ENTRIES=`expr ${TOTAL_PKI_REGISTRY_ENTRIES} + 1`
-	fi
-done
-
-if [ -n "${pki_instance}" ]; then
-	for I in ${PKI_REGISTRY_ENTRIES}; do
-		if [ "${PKI_REGISTRY}/${pki_instance}" = "$I" ]; then
-			PKI_REGISTRY_ENTRIES="${PKI_REGISTRY}/${pki_instance}"
-			TOTAL_PKI_REGISTRY_ENTRIES=1
-			break
-		fi
-	done
-fi
-
-usage()
-{
-	echo -n "Usage: ${PKI_INIT_SCRIPT} "
-	echo -n "{start"
-	echo -n "|stop"
-	echo -n "|restart"
-	echo -n "|condrestart"
-	echo -n "|force-restart"
-	echo -n "|try-restart"
-	echo -n "|reload"
-	echo -n "|status} "
-	echo -n "[instance-name]"
-	echo
-	echo
-}
-
-list_instances()
-{
-	echo
-	for FILE in `/bin/ls -1 ${PKI_REGISTRY}/* 2>/dev/null`; do
-		echo "    ${FILE}"
-	done
-	echo
-}
-
-# Check arguments
-if [ $# -lt 1 ] ; then
-	# * 3 unimplemented feature (for example, "reload")
-	#     [insufficient arguments]
-	echo "$0:  Insufficient arguments!"
-	echo
-	usage
-	echo "where valid instance names include:"
-	list_instances
-	exit 3
-elif [ ${default_error} -eq 2 ] ; then
-	# * 2 invalid argument
-	echo "$0:  Invalid arguments!"
-	echo
-	usage
-	echo "where valid instance names include:"
-	list_instances
-	exit 2
-elif [ $# -gt 2 ] ; then
-	echo "$0:  Excess arguments!"
-	echo
-	usage
-	echo "where valid instance names include:"
-	list_instances
-	if [ "${command}" != "status" ]; then
-		# * 2 excess arguments
-		exit 2
-	else
-		# * 4 program or service status is unknown
-		exit 4
-	fi
-fi
-
-# If an "instance" was supplied, check that it is a "valid" instance
-if [ -n "${pki_instance}" ]; then
-	if [ "${PKI_REGISTRY}/${pki_instance}" != "${PKI_REGISTRY_ENTRIES}" ]; then
-		echo -n "${pki_instance} is an invalid '${PKI_TYPE}' instance"
-		echo_failure
-		echo
-		if [ "${command}" != "status" ]; then
-			# * 5 program is not installed
-			exit 5
-		else
-			# * 4 program or service status is unknown
-			exit 4
-		fi
-	fi
-fi
-
-# On Solaris /var/run is in tmpfs and gets wiped out upon reboot
-# we have to recreate the ${PKI_PIDDIR} directory and make sure that
-# the directory is writable by the ${PKI_TYPE} server process.
-#
-# IMPORTANT:  ALL PKI subsystems installed on this machine MUST utilize
-#             the SAME values for ${PKI_GROUP} and ${PKI_USER}, since the
-#             "${PKI_PIDDIR}" will end up with the ownership permissions
-#             of the first instance that executes this function!
-#
-fix_pid_dir_ownership()
-{
-	if [ ! -d ${PKI_PIDDIR} ] ; then
-		mkdir -p ${PKI_PIDDIR}
-
-		chown root:root /var/run/pki
-		chmod 00755 /var/run/pki
-
-		chown root:root ${PKI_PIDDIR}
-		chmod 00755 ${PKI_PIDDIR}
-	fi
-}
-
-check_pki_configuration_status()
-{
-	rv=0
-
-	rv=`grep -c ^preop ${pki_instance_configuration_file}`
-
-	rv=`expr ${rv} + 0`
-
-	if [ ${rv} -ne 0 ] ; then
-		echo "    '${PKI_INSTANCE_ID}' must still be CONFIGURED!"
-		echo "    (see /var/log/${PKI_INSTANCE_ID}-install.log)"
-		if [ "${command}" != "status" ]; then
-			# * 6 program is not configured
-			rv=6
-		else
-			# * 4 program or service status is unknown
-			rv=4
-		fi
-		TOTAL_UNCONFIGURED_PKI_ENTRIES=`expr ${TOTAL_UNCONFIGURED_PKI_ENTRIES} + 1`
-	elif [ -f ${RESTART_SERVER} ] ; then
-		echo -n "    Although '${PKI_INSTANCE_ID}' has been CONFIGURED, "
-		echo -n "it must still be RESTARTED!"
-		echo
-		if [ "${command}" != "status" ]; then
-			# * 1 generic or unspecified error (current practice)
-			rv=1
-		else
-			# * 4 program or service status is unknown
-			rv=4
-		fi
-	fi
-
-	return ${rv}
-}
-
-get_pki_status_definitions()
-{
-	# establish well-known strings
-	begin_pki_status_comment="<!-- DO NOT REMOVE - Begin PKI Status Definitions -->"
-	end_pki_status_comment="<!-- DO NOT REMOVE - End PKI Status Definitions -->"
-	total_ports=0
-	unsecure_port_statement="Unsecure Port     = "
-	secure_agent_port_statement="Secure Agent Port = "
-	secure_ee_port_statement="Secure EE Port    = "
-	secure_admin_port_statement="Secure Admin Port = "
-	pki_console_port_statement="PKI Console Port  = "
-	tomcat_port_statement="Tomcat Port       = "
-
-	# initialize looping variables
-	pki_status_comment_found=0
-
-	# first check to see that an instance-specific "server.xml" file exists
-	if [ ! -f ${PKI_SERVER_XML_CONF} ] ; then
-		echo "File '${PKI_SERVER_XML_CONF}' does not exist!"
-		exit ${default_error}
-	fi
-
-	# read this instance-specific "server.xml" file line-by-line
-	# to obtain the current PKI Status Definitions
-	exec < ${PKI_SERVER_XML_CONF}
-	while read line; do
-		# first look for the well-known end PKI Status comment
-		# (to turn off processing)
-		if [ "$line" == "$end_pki_status_comment" ] ; then
-			pki_status_comment_found=0
-			break;
-		fi
-
-		# then look for the well-known begin PKI Status comment
-		# (to turn on processing)
-		if [ "$line" == "$begin_pki_status_comment" ] ; then
-			pki_status_comment_found=1
-		fi
-
-		# once the well-known begin PKI Status comment has been found,
-		# begin processing to obtain all of the PKI Status Definitions
-		if [ $pki_status_comment_found -eq 1 ] ; then
-			# look for a PKI Status Definition and print it
-			head=`echo "$line" | cut -b1-20`
-			if	[ "$head" == "$unsecure_port_statement"     ] ||
-				[ "$head" == "$secure_agent_port_statement" ] ||
-				[ "$head" == "$secure_ee_port_statement"    ] ||
-				[ "$head" == "$secure_admin_port_statement" ] ||
-				[ "$head" == "$pki_console_port_statement"  ] ||
-				[ "$head" == "$tomcat_port_statement"       ] ; then
-				echo "    $line"
-				total_ports=`expr ${total_ports} + 1`
-			fi
-		fi
-	done
-
-	if [ ${total_ports} -eq 6 ] ; then
-		return 0
-	else
-		return ${default_error}
-	fi
-}
-
-get_pki_configuration_definitions()
-{
-	# Obtain the PKI Subsystem Type
-	line=`grep ^cs.type= ${pki_instance_configuration_file}`
-	pki_subsystem=`echo "${line}" | cut -b9-`
-	if [ "${line}" != "" ] ; then
-		if	[ "${pki_subsystem}" != "CA"   ]  &&
-			[ "${pki_subsystem}" != "KRA"  ]  &&
-			[ "${pki_subsystem}" != "OCSP" ]  &&
-			[ "${pki_subsystem}" != "TKS"  ]  &&
-			[ "${pki_subsystem}" != "RA"   ]  &&
-			[ "${pki_subsystem}" != "TPS"  ]
-		then
-			return ${default_error}
-		fi
-		if	[ "${pki_subsystem}" == "KRA"   ] ; then
-			# Rename "KRA" to "DRM"
-			pki_subsystem="DRM"
-		fi
-	else
-		return ${default_error}
-	fi
-
-	# If "${pki_subsystem}" is a CA, DRM, OCSP, or TKS,
-	# check to see if "${pki_subsystem}" is a "Clone"
-	pki_clone=""
-	if	[ "${pki_subsystem}" == "CA"   ]  ||
-		[ "${pki_subsystem}" == "DRM"  ]  ||
-		[ "${pki_subsystem}" == "OCSP" ]  ||
-		[ "${pki_subsystem}" == "TKS"  ]
-	then
-		line=`grep ^subsystem.select= ${pki_instance_configuration_file}`
-		if [ "${line}" != "" ] ; then
-			pki_clone=`echo "${line}" | cut -b18-`
-			if [ "${pki_clone}" != "Clone" ] ; then
-				# Reset "${pki_clone}" to be empty
-				pki_clone=""
-			fi
-		else
-			return ${default_error}
-		fi
-	fi
-
-	# If "${pki_subsystem}" is a CA, and is NOT a "Clone", check to
-	# see "${pki_subsystem}" is a "Root" or a "Subordinate" CA
-	pki_hierarchy=""
-	if	[ "${pki_subsystem}" == "CA" ]  &&
-		[ "${pki_clone}" != "Clone"  ]
-	then
-		line=`grep ^hierarchy.select= ${pki_instance_configuration_file}`
-		if [ "${line}" != "" ] ; then
-			pki_hierarchy=`echo "${line}" | cut -b18-`
-		else
-			return ${default_error}
-		fi
-	fi
-
-	# If ${pki_subsystem} is a CA, check to
-	# see if it is also a Security Domain
-	pki_security_domain=""
-	if	[ "${pki_subsystem}" == "CA" ] ; then
-		line=`grep ^securitydomain.select= ${pki_instance_configuration_file}`
-		if [ "${line}" != "" ] ; then
-			pki_security_domain=`echo "${line}" | cut -b23-`
-			if [ "${pki_security_domain}" == "new" ] ; then
-				# Set a fixed value for "${pki_security_domain}"
-				pki_security_domain="(Security Domain)"
-			else
-				# Reset "${pki_security_domain}" to be empty
-				pki_security_domain=""
-			fi
-		else
-			return ${default_error}
-		fi
-	fi
-
-	# Always obtain this PKI instance's "registered"
-	# security domain information
-	pki_security_domain_name=""
-	pki_security_domain_hostname=""
-	pki_security_domain_https_admin_port=""
-
-	line=`grep ^securitydomain.name= ${pki_instance_configuration_file}`
-	if [ "${line}" != "" ] ; then
-		pki_security_domain_name=`echo "${line}" | cut -b21-`
-	else
-		return ${default_error}
-	fi
-
-	line=`grep ^securitydomain.host= ${pki_instance_configuration_file}`
-	if [ "${line}" != "" ] ; then
-		pki_security_domain_hostname=`echo "${line}" | cut -b21-`
-	else
-		return ${default_error}
-	fi
-
-	line=`grep ^securitydomain.httpsadminport= ${pki_instance_configuration_file}`
-	if [ "${line}" != "" ] ; then
-		pki_security_domain_https_admin_port=`echo "${line}" | cut -b31-`
-	else
-		return ${default_error}
-	fi
-
-	# Compose the "PKI Instance Name" Status Line
-	pki_instance_name="PKI Instance Name:   ${PKI_INSTANCE_ID}"
-
-	# Compose the "PKI Subsystem Type" Status Line
-	header="PKI Subsystem Type: "
-	if   [ "${pki_clone}" != "" ] ; then
-		if [ "${pki_security_domain}" != "" ]; then
-			# Possible Values:
-			#
-			#     "CA Clone (Security Domain)"
-			#
-			data="${pki_subsystem} ${pki_clone} ${pki_security_domain}"
-		else
-			# Possible Values:
-			#
-			#     "CA Clone"
-			#     "DRM Clone"
-			#     "OCSP Clone"
-			#     "TKS Clone"
-			#
-			data="${pki_subsystem} ${pki_clone}"
-		fi
-	elif [ "${pki_hierarchy}" != "" ] ; then
-		if [ "${pki_security_domain}" != "" ]; then
-			# Possible Values:
-			#
-			#     "Root CA (Security Domain)"
-			#     "Subordinate CA (Security Domain)"
-			#
-			data="${pki_hierarchy} ${pki_subsystem} ${pki_security_domain}"
-		else
-			# Possible Values:
-			#
-			#     "Root CA"
-			#     "Subordinate CA"
-			#
-			data="${pki_hierarchy} ${pki_subsystem}"
-		fi
-	else
-		# Possible Values:
-		#
-		#     "DRM"
-		#     "OCSP"
-		#     "RA"
-		#     "TKS"
-		#     "TPS"
-		#
-		data="${pki_subsystem}"
-	fi
-	pki_subsystem_type="${header} ${data}"
-
-	# Compose the "Registered PKI Security Domain Information" Status Line
-	header="Name: "
-	registered_pki_security_domain_name="${header} ${pki_security_domain_name}"
-
-	header="URL:  "
-	if	[ "${pki_security_domain_hostname}" != ""         ] &&
-		[ "${pki_security_domain_https_admin_port}" != "" ]
-	then
-		data="https://${pki_security_domain_hostname}:${pki_security_domain_https_admin_port}"
-	else
-		return ${default_error}
-	fi
-	registered_pki_security_domain_url="${header} ${data}"
-
-	# Print the "PKI Subsystem Type" Status Line
-	echo
-	echo "    ${pki_instance_name}"
-
-	# Print the "PKI Subsystem Type" Status Line
-	echo
-	echo "    ${pki_subsystem_type}"
-
-	# Print the "Registered PKI Security Domain Information" Status Line
-	echo
-	echo "    Registered PKI Security Domain Information:"
-	echo "    =========================================================================="
-	echo "    ${registered_pki_security_domain_name}"
-	echo "    ${registered_pki_security_domain_url}"
-	echo "    =========================================================================="
-
-	return 0
-}
-
-get_pki_secure_port()
-{
-	# establish well-known strings
-	begin_ssl_comment="<!-- DO NOT REMOVE - Begin define PKI secure port -->"
-	end_ssl_comment="<!-- DO NOT REMOVE - End define PKI secure port -->"
-	connector_statement="<Connector name=\""
-
-	# initialize looping variables
-	ssl_comment_found=0
-
-	# first check to see that an instance-specific "server.xml" file exists
-	if [ ! -f ${PKI_SERVER_XML_CONF} ] ; then
-		echo "File '${PKI_SERVER_XML_CONF}' does not exist!"
-		exit ${default_error}
-	fi
-
-	# read this instance-specific "server.xml" file line-by-line
-	# to obtain the current value of the PKI secure port
-	exec < ${PKI_SERVER_XML_CONF}
-	while read line; do
-		# first look for the well-known end SSL comment
-		# (to turn off processing)
-		if [ "$line" == "$end_ssl_comment" ] ; then
-			ssl_comment_found=0
-		fi
-
-		# then look for the well-known begin SSL comment
-		# (to turn on processing)
-		if [ "$line" == "$begin_ssl_comment" ] ; then
-			ssl_comment_found=1
-		fi
-
-		# once the well-known begin SSL comment has been found,
-		# begin processing to obtain the numeric port information
-		if [ $ssl_comment_found -eq 1 ] ; then
-			# look for the next Connector statement
-			head=`echo $line | cut -b1-17`
-			if [ "$head" == "$connector_statement" ] ; then
-				# once the Connector statement has been found,
-				tail=`echo $line | cut -b18-`
-				# extract the name of the connector
-				name=`echo $tail | cut -d\" -f1`
-				if	[ "$name" == "Agent"  ] ||
-					[ "$name" == "Secure" ] ; then
-					# extract the numeric port information
-					port=`echo $tail | cut -d\" -f3`
-					PKI_SECURE_PORT=$port
-					return 0
-				fi
-			fi
-		fi
-	done
-
-	return ${default_error}
-}
-
-display_instance_status()
-{
-	rv=0
-
-	if [ -f ${pidfile} ] ; then
-		pid=`cat ${pidfile}`
-		if [ "${pid}" == "" ] ; then
-			echo "${PKI_INSTANCE_ID} pid file exists but is empty"
-			if [ "${command}" != "status" ]; then
-				# * 1 generic or unspecified error (current practice)
-				rv=1
-			else
-				# * 4 program or service status is unknown
-				rv=4
-			fi
-		elif kill -0 ${pid} > /dev/null 2>&1 ; then
-			echo "${PKI_INSTANCE_ID} (pid ${pid}) is running ..."
-			echo
-			check_pki_configuration_status
-			rv=$?
-			if [ ${rv} -eq 0 ] ; then
-				get_pki_status_definitions
-				rv=$?
-				if [ ${rv} -ne 0 ] ; then
-					echo
-					echo "${PKI_INSTANCE_ID} Status Definitions not found"
-				else
-					get_pki_configuration_definitions
-					rv=$?
-					if [ ${rv} -ne 0 ] ; then
-						echo
-						echo "${PKI_INSTANCE_ID} Configuration Definitions not found"
-					fi
-				fi
-			else
-				# From the PKI point of view for a "non-status" action,
-				# a returned error code of "6" implies that the program
-				# is not "configured".  Similarly, an error code of "1"
-				# implies that the program was "configured" but must
-				# still be restarted.
-				#
-				# Similarly, from the PKI point of view for a "status"
-				# action, a returned error code of "4" implies that either
-				# the program is not "configured", or that the program
-				# was "configured" but must still be restarted.
-				#
-				# Regardless, it must still be considered that the instance
-				# is "running" from the viewpoint of other OS programs such
-				# as 'chkconfig'.
-				#
-				# For this reason, when returning from
-				# 'display_instance_status()', ignore non-zero return codes
-				# returned from 'check_pki_configuration_status()'.
-				#
-				if [ "${command}" != "status" ]; then
-					# * 0 action was successful
-					rv=0
-				else
-					# * 0 program is running or service is OK
-					rv=0
-				fi
-			fi
-			echo
-		else
-			echo "${PKI_INSTANCE_ID} is dead but pid file exists"
-			if [ "${command}" != "status" ]; then
-				# * 1 generic or unspecified error (current practice)
-				rv=1
-			else
-				# * 1 program is dead and /var/run pid file exists
-				rv=1
-			fi
-		fi
-	else
-		echo "${PKI_INSTANCE_ID} is stopped"
-		if [ "${command}" != "status" ]; then
-			# * 7 program is not running
-			rv=7
-		else
-			# * 3 program is not running
-			rv=3
-		fi
-	fi
-
-	return ${rv}
-}
-
-start_instance()
-{
-	rv=0
-
-	echo -n "Starting $TOMCAT_PROG: "
-
-	if [ -f ${RESTART_SERVER} ] ; then
-		rm -f ${RESTART_SERVER}
-	fi
-
-	if [ -f ${PKI_LOCKFILE} ] ; then
-		if [ -f ${pidfile} ]; then
-			read kpid < ${pidfile}
-			if checkpid $kpid 2>&1; then
-				echo
-				echo "${PKI_INSTANCE_ID} (pid ${kpid}) is already running ..."
-				echo
-				check_pki_configuration_status
-				rv=$?
-				if [ ${rv} != 0 ]; then
-					# From the PKI point of view for a "non-status" action,
-					# a returned error code of "6" implies that the program
-					# is not "configured".  Similarly, an error code of "1"
-					# implies that the program was "configured" but must
-					# still be restarted.
-					#
-					# Regardless, it must still be considered that the instance
-					# is "running" from the viewpoint of other OS programs such
-					# as 'chkconfig'.
-					#
-					# For "non-status" actions, ignore return codes of "1"
-					# from 'check_pki_configuration_status()'.
-					#
-					# However, for "non-status" actions that have a return
-					# code of "6", return this value unchanged to
-					# the calling routine so that the total number of
-					# configuration errors may be counted.
-					#
-
-					echo
-					if [ ${rv} = 1 ] ; then
-						# * 0 action was successful
-						return 0
-					elif [ ${rv} = 6 ] ; then
-						# * 6 program is not configured
-						return 6
-					else
-						# should never be reached
-						return ${rv}
-					fi
-				else
-					return 0
-				fi
-			else
-				echo
-				echo -n "lock file found but no process "
-				echo -n "running for pid $kpid, continuing"
-				echo
-				echo
-				rm -f ${PKI_LOCKFILE}
-			fi
-		fi
-	fi
-
-	fix_pid_dir_ownership
-
-	CATALINA_PID=${pidfile}
-	export CATALINA_PID
-	touch $CATALINA_PID
-	chown $TOMCAT_USER:$TOMCAT_GROUP $CATALINA_PID
-	chmod 00600 $CATALINA_PID
-	[ -x /sbin/restorecon ] && /sbin/restorecon  $CATALINA_PID
-
-	# restore context for ncipher hsm
-	[ -x /sbin/restorecon ] && [ -d /dev/nfast ] && /sbin/restorecon -R /dev/nfast
-
-	# Always initialize CLASSPATH to start looking
-	# in the local PKI classes directory . . .
-	CLASSPATH=/usr/share/pki/classes
-
-	if [ ${OS} = "Linux" ] ; then
-		$TOMCAT_RELINK_SCRIPT
-	elif [ ${OS} = "SunOS" ] ; then
-		# The following definitions are provided for Solaris
-		# platforms since they are unable to execute the
-		# "/usr/share/tomcat5/bin/relink",
-		# "/usr/bin/rebuild-jar-repository", and
-		# "/usr/share/java-utils/java-functions" files . . .
-
-		#######################################
-		##    /var/lib/tomcat5/common/lib:
-		#######################################
-
-		# Build the tomcat jar classpath . . .
-		CLASSPATH="$CLASSPATH":/usr/share/java/ant.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-collections.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-dbcp.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-el.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-logging-api.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-pool.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-ejb-2.1.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2ee-1.4.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2ee-connector-1.5.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2ee-deployment-1.1.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2ee-jacc-1.0.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2ee-management-1.0.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2eeschema-1.0.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-jms-1.1.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-jsp-2.0.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-jta-1.0.1B.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-servlet-2.4.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/jaf.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/jakarta-commons-collections.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/jakarta-commons-modeler.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/jasper5-compiler.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/jasper5-runtime.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/imap.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/mailapi.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/nntp.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/pop3.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/providers.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/smtp.jar
-
-		# BEGIN LINUX-SPECIFIC FILE
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jdtCompilerAdapter.jar
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jdtcore.jar
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jsp.jar
-		# END LINUX-SPECIFIC FILE
-
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-impl.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-jmx.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-remote.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-rimpl.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-rjmx.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-tools.jar
-
-		# BEGIN LINUX-SPECIFIC FILE
-		# CLASSPATH="$CLASSPATH":/usr/share/java/servlet.jar
-		# END LINUX-SPECIFIC FILE
-
-		CLASSPATH="$CLASSPATH":/usr/share/java/avalon-logkit.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/cmsutil.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-logging.jar
-		if [ "$ARCHITECTURE" = "sparc" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/java/dirsec/jss4.jar
-		elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/sparcv9/java/dirsec/jss4.jar
-		fi
-		CLASSPATH="$CLASSPATH":/usr/share/java/ldapjdk.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/common/lib/naming-factory.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/common/lib/naming-resources.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/nsutil.jar
-		if [ "$ARCHITECTURE" = "sparc" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/java/osutil.jar
-		elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/sparcv9/java/osutil.jar
-		fi
-		CLASSPATH="$CLASSPATH":/usr/share/java/rhino.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/servletapi5.jar
-		if [ "$ARCHITECTURE" = "sparc" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/java/symkey.jar
-		elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/sparcv9/java/symkey.jar
-		fi
-		CLASSPATH="$CLASSPATH":/usr/share/java/velocity.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/xalan-j2.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/xerces-j2.jar
-
-		# Relink tomcat jar repositories . . .
-		cd /var/lib/tomcat5/common/lib
-
-		if [ ! -e /var/lib/tomcat5/common/lib/\[ant\].jar ]; then
-			ln -s /usr/share/java/ant.jar [ant].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[commons\-collections\].jar ]; then
-			ln -s /usr/share/java/commons-collections.jar [commons-collections].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[commons\-dbcp\].jar ]; then
-			ln -s /usr/share/java/commons-dbcp.jar [commons-dbcp].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[commons\-el\].jar ]; then
-			ln -s /usr/share/java/commons-el.jar [commons-el].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[commons\-logging-api\].jar ]; then
-			ln -s /usr/share/java/commons-logging-api.jar [commons-logging-api].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[commons\-pool\].jar ]; then
-			ln -s /usr/share/java/commons-pool.jar [commons-pool].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-ejb\-2.1\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-ejb-2.1-rc2.jar [geronimo]spec-ejb-2.1-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-ejb\-2.1.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-ejb-2.1.jar [geronimo]spec-ejb-2.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-1.4\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-1.4-rc2.jar [geronimo]spec-j2ee-1.4-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-1.4.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-1.4.jar [geronimo]spec-j2ee-1.4.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-connector\-1.5\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-connector-1.5-rc2.jar [geronimo]spec-j2ee-connector-1.5-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-connector\-1.5.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-connector-1.5.jar [geronimo]spec-j2ee-connector-1.5.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-deployment\-1.1\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-deployment-1.1-rc2.jar [geronimo]spec-j2ee-deployment-1.1-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-deployment\-1.1.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-deployment-1.1.jar [geronimo]spec-j2ee-deployment-1.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-jacc\-1.0\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-jacc-1.0-rc2.jar [geronimo]spec-j2ee-jacc-1.0-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-jacc\-1.0.jar ]; then
-			ln -s  /usr/share/java/geronimo/spec-j2ee-jacc-1.0.jar [geronimo]spec-j2ee-jacc-1.0.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-management\-1.0\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-management-1.0-rc2.jar [geronimo]spec-j2ee-management-1.0-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-management\-1.0.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-management-1.0.jar [geronimo]spec-j2ee-management-1.0.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2eeschema\-1.0\-M2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2eeschema-1.0-M2.jar [geronimo]spec-j2eeschema-1.0-M2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2eeschema\-1.0.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2eeschema-1.0.jar [geronimo]spec-j2eeschema-1.0.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-jms\-1.1\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jms-1.1-rc2.jar [geronimo]spec-jms-1.1-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-jms\-1.1.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jms-1.1.jar [geronimo]spec-jms-1.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-jsp\-2.0\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jsp-2.0-rc2.jar [geronimo]spec-jsp-2.0-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-jsp\-2.0.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jsp-2.0.jar [geronimo]spec-jsp-2.0.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec-jta-1.0.1B-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jta-1.0.1B-rc2.jar [geronimo]spec-jta-1.0.1B-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-jta\-1.0.1B.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jta-1.0.1B.jar [geronimo]spec-jta-1.0.1B.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-servlet\-2.4\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-servlet-2.4-rc2.jar [geronimo]spec-servlet-2.4-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-servlet\-2.4.jar ]; then
-			ln -s  /usr/share/java/geronimo/spec-servlet-2.4.jar [geronimo]spec-servlet-2.4.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[jaf\].jar ]; then
-			ln -s /usr/share/java/jaf.jar [jaf].jar
-		fi
-
-		### BEGIN SOLARIS-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jakarta\-commons\-collections.jar\] ]; then
-		###     ln -s /usr/share/java/jakarta-commons-collections.jar [jakarta-commons-collections.jar]
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jakarta\-commons\-modeler.jar\] ]; then
-		###     ln -s /usr/share/java/jakarta-commons-modeler.jar [jakarta-commons-modeler.jar]
-		### fi
-		### END SOLARIS-SPECIFIC LINKS
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jasper5\-compiler\].jar ]; then
-		###     ln -s /usr/share/java/jasper5-compiler.jar [jasper5-compiler].jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jasper5\-runtime\].jar ]; then
-		###     ln -s /usr/share/java/jasper5-runtime.jar [jasper5-runtime].jar
-		### fi
-
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]imap\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/imap-1.3.1.jar [javamail]imap-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]imap.jar ]; then
-			ln -s /usr/share/java/javamail/imap.jar [javamail]imap.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]mailapi\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/mailapi-1.3.1.jar [javamail]mailapi-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]mailapi.jar ]; then
-			ln -s /usr/share/java/javamail/mailapi.jar [javamail]mailapi.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]nntp\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/nntp-1.3.1.jar [javamail]nntp-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]nntp.jar ]; then
-			ln -s /usr/share/java/javamail/nntp.jar [javamail]nntp.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]pop3\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/pop3-1.3.1.jar [javamail]pop3-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]pop3.jar ]; then
-			ln -s /usr/share/java/javamail/pop3.jar [javamail]pop3.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]providers\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/providers-1.3.1.jar [javamail]providers-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]providers.jar ]; then
-			ln -s /usr/share/java/javamail/providers.jar [javamail]providers.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]smtp\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/smtp-1.3.1.jar [javamail]smtp-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]smtp.jar ]; then
-			ln -s /usr/share/java/javamail/smtp.jar [javamail]smtp.jar
-		fi
-
-		### BEGIN LINUX-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jdtCompilerAdapter\].jar ]; then
-		###     ln -s /usr/share/java/jdtCompilerAdapter.jar [jdtCompilerAdapter].jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jdtcore\].jar ]; then
-		###     ln -s /usr/share/java/jdtcore.jar [jdtcore].jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jsp\].jar ]; then
-		###     ln -s /usr/share/java/jsp.jar [jsp].jar
-		### fi
-		### END LINUX-SPECIFIC LINKS
-
-		if [ ! -e /var/lib/tomcat5/common/lib/\[mx4j\]\[mx4j\].jar ]; then
-			ln -s /usr/share/java/mx4j/mx4j.jar [mx4j][mx4j].jar
-		fi
-
-		### BEGIN LINUX-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[servlet\].jar ]; then
-		###     ln -s /usr/share/java/servlet.jar [servlet].jar
-		### fi
-		### END LINUX-SPECIFIC LINKS
-
-		### BEGIN LINUX-SPECIFIC FILE BUT SOLARIS-SPECIFIC LINK
-		if [ ! -e /var/lib/tomcat5/common/lib/avalon\-logkit.jar ]; then
-			ln -s /usr/share/java/avalon-logkit.jar avalon-logkit.jar
-		fi
-		### END LINUX-SPECIFIC FILE BUT SOLARIS-SPECIFIC LINK
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/cmsutil.jar ]; then
-		###     ln -s /usr/share/java/rphki/cmsutil.jar cmsutil.jar
-		### fi
-
-		### BEGIN LINUX-SPECIFIC FILE BUT SOLARIS-SPECIFIC LINK
-		if [ ! -e /var/lib/tomcat5/common/lib/commons\-logging.jar ]; then
-			ln -s /usr/share/java/commons-logging.jar commons-logging.jar
-		fi
-		### END LINUX-SPECIFIC FILE BUT SOLARIS-SPECIFIC LINK
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/jss4.jar ]; then
-		###     if [ "$ARCHITECTURE" = "sparc" ] ; then
-		###         ln -s /usr/lib/java/dirsec/jss4.jar jss4.jar
-		###     elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-		###         ln -s /usr/lib/sparcv9/java/dirsec/jss4.jar jss4.jar
-		###     fi
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/ldapjdk.jar ]; then
-		###     ln -s /usr/share/java/ldapjdk.jar ldapjdk.jar
-		### fi
-
-		### naming-factory.jar
-		### naming-resources.jar
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/nsutil.jar ]; then
-		###     ln -s /usr/share/java/pki/nsutil.jar nsutil.jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/osutil.jar ]; then
-		###     if [ "$ARCHITECTURE" = "sparc" ] ; then
-		###         ln -s /usr/lib/java/osutil.jar osutil.jar
-		###     elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-		###         ln -s /usr/lib/sparcv9/java/osutil.jar osutil.jar
-		###     fi
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/rhino.jar ]; then
-		###     ln -s /usr/share/java/rhino.jar rhino.jar
-		### fi
-
-		### BEGIN SOLARIS-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[servletapi5.jar\] ]; then
-		###     ln -s /usr/share/java/servletapi5.jar [servletapi5.jar]
-		### fi
-		### END SOLARIS-SPECIFIC LINKS
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/symkey.jar ]; then
-		###     if [ "$ARCHITECTURE" = "sparc" ] ; then
-		###         ln -s /usr/lib/java/symkey.jar symkey.jar
-		###     elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-		###         ln -s /usr/lib/sparcv9/java/symkey.jar symkey.jar
-		###     fi
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/velocity.jar ]; then
-		###     ln -s /usr/share/java/velocity.jar velocity.jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/xalan\-j2.jar ]; then
-		###     ln -s /usr/share/java/xalan-j2.jar xalan-j2.jar
-		### fi
-
-		if [ ! -e /var/lib/tomcat5/common/lib/xerces\-j2\-2.6.2.jar ]; then
-			ln -s /usr/share/java/xerces-j2-2.6.2.jar xerces-j2-2.6.2.jar
-		fi
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/xerces\-j2.jar ]; then
-		###     ln -s /usr/share/java/xerces-j2.jar xerces-j2.jar
-		### fi
+. /etc/init.d/functions
 
-
-		#######################################
-		##    /var/lib/tomcat5/common/endorsed:
-		#######################################
-
-		# Build the tomcat jar classpath . . .
-		CLASSPATH="$CLASSPATH":/usr/share/java/xml-commons-apis.jar
-
-		# BEGIN LINUX-SPECIFIC FILE
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jaxp_parser_impl.jar
-		# END LINUX-SPECIFIC FILE
-
-
-		# Relink tomcat jar repositories . . .
-		cd /var/lib/tomcat5/common/endorsed
-
-		### BEGIN LINUX-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/common/endorsed/\[jaxp_parser_impl\].jar ]; then
-		###     ln -s /usr/share/java/jaxp_parser_impl.jar [jaxp_parser_impl].jar
-		### fi
-		### END LINUX-SPECIFIC LINKS
-
-		if [ ! -e /var/lib/tomcat5/common/endorsed/\[xml\-commons\-apis\].jar ]; then
-			ln -s /usr/share/java/xml-commons-apis.jar [xml-commons-apis].jar
-		fi
-
-
-		#######################################
-		##    /var/lib/tomcat5/server/lib:
-		#######################################
-
-		# Build the tomcat jar classpath . . .
-		CLASSPATH="$CLASSPATH":/usr/share/java/catalina-ant5.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-beanutils.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-digester.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-el.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-fileupload.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-logging.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-modeler.jar
-
-		# BEGIN LINUX-SPECIFIC FILE
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jdtCompilerAdapter.jar
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jdtcore.jar
-		# END LINUX-SPECIFIC FILE
-
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-impl.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-jmx.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-remote.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-rimpl.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-rjmx.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-tools.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/regexp.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/catalina-cluster.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/catalina-optional.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/catalina-storeconfig.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/catalina.jar
-		if [ "$ARCHITECTURE" = "sparc" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/java/dirsec/jss4.jar
-		elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/sparcv9/java/dirsec/jss4.jar
-		fi
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/servlets-cgi.renametojar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/servlets-default.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/servlets-invoker.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/servlets-ssi.renametojar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/servlets-webdav.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/tomcat-ajp.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/tomcat-coyote.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/tomcat-http.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/tomcat-util.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/tomcatjss.jar
-
-
-		# Relink tomcat jar repositories . . .
-		cd /var/lib/tomcat5/server/lib
-
-		if [ ! -e /var/lib/tomcat5/server/lib/\[catalina\-ant5\].jar ]; then
-			ln -s /usr/share/java/catalina-ant5.jar [catalina-ant5].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-beanutils\].jar ]; then
-			ln -s /usr/share/java/commons-beanutils.jar [commons-beanutils].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-digester\].jar ]; then
-			ln -s /usr/share/java/commons-digester.jar [commons-digester].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-el\].jar ]; then
-			ln -s /usr/share/java/commons-el.jar [commons-el].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-fileupload\].jar ]; then
-			ln -s /usr/share/java/commons-fileupload.jar [commons-fileupload].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-logging\].jar ]; then
-			ln -s /usr/share/java/commons-logging.jar [commons-logging].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-modeler\].jar ]; then
-			ln -s /usr/share/java/commons-modeler.jar [commons-modeler].jar
-		fi
-
-		### BEGIN LINUX-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/server/lib/\[jdtCompilerAdapter\].jar ]; then
-		###     ln -s /usr/share/java/jdtCompilerAdapter.jar [jdtCompilerAdapter].jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/server/lib/\[jdtcore\].jar ]; then
-		###     ln -s /usr/share/java/jdtcore.jar [jdtcore].jar
-		### fi
-		### END LINUX-SPECIFIC LINKS
-
-		if [ ! -e /var/lib/tomcat5/server/lib/\[mx4j\]\[mx4j\].jar ]; then
-			ln -s /usr/share/java/mx4j/mx4j.jar [mx4j][mx4j].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[regexp\].jar ]; then
-			ln -s /usr/share/java/regexp.jar [regexp].jar
-		fi
-
-		### catalina-cluster.jar
-		### catalina-optional.jar
-		### catalina-storeconfig.jar
-		### catalina.jar
-		### if [ ! -e /var/lib/tomcat5/server/lib/jss4.jar ]; then
-		###     if [ "$ARCHITECTURE" = "sparc" ] ; then
-		###         ln -s /usr/lib/java/dirsec/jss4.jar jss4.jar
-		###     elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-		###         ln -s /usr/lib/sparcv9/java/dirsec/jss4.jar jss4.jar
-		###     fi
-		### fi
-		### servlets-cgi.renametojar
-		### servlets-default.jar
-		### servlets-invoker.jar
-		### servlets-ssi.renametojar
-		### servlets-webdav.jar
-		### tomcat-ajp.jar
-		### tomcat-coyote.jar
-		### tomcat-http.jar
-		### tomcat-util.jar
-		### if [ ! -e /var/lib/tomcat5/server/lib/tomcatjss.jar ]; then
-		###     ln -s /usr/share/java/tomcatjss.jar tomcatjss.jar
-		### fi
-
-
-		#######################################
-		##    /var/lib/tomcat5/shared/lib:
-		#######################################
-
-		# Build the tomcat jar classpath . . .
-
-		export CLASSPATH
-
-
-		# Relink tomcat jar repositories . . .
-		cd /var/lib/tomcat5/shared/lib
-	fi
-
-	# daemon --user $TOMCAT_USER $TOMCAT_SCRIPT start
-	if [ ${OS} = "SunOS" ] ; then
-		su  $TOMCAT_USER -c "$TOMCAT_SCRIPT start" > /dev/null
-	else
-		runuser -s /bin/bash $TOMCAT_USER -c "$TOMCAT_SCRIPT start" > /dev/null
-	fi
-
-	rv=$?
-	if [ ${rv} = 0 ] ; then
-		touch ${PKI_LOCKFILE}
-		chown $TOMCAT_USER:$TOMCAT_GROUP $PKI_LOCKFILE
-		chmod 00600 $PKI_LOCKFILE
-	fi
-
-	if [ ${rv} = 0 ] ; then
-		count=0;
-
-		let swait=$STARTUP_WAIT
-		while	[ ! -s ${pidfile} ] &&
-				[ $count -lt $swait ]
-		do
-			echo -n "."
-			sleep 1
-			let count=$count+1;
-		done
-
-		if [ -f /etc/init.d/functions ]; then
-			if [ "$CONSOLETYPE" = "serial" ]; then
-				echo -n "         "
-			fi
-			echo_success
-			echo
-		else
-			echo "         [  OK  ]"
-		fi
-
-		get_pki_secure_port
-		if [ $? -ne 0 ] ; then
-			PKI_SECURE_PORT="<Port Undefined>"
-		fi
-
-                # Set permissions of log files
-                pki_logs_directory=${PKI_INSTANCE_PATH}/logs
-                pki_signedAudit="${pki_logs_directory}/signedAudit"
-                for file in ${pki_logs_directory}/*; do
-                    if  [  ! -d "${file}" ]; then
-                            chmod 00640 ${file}
-                            chgrp $TOMCAT_GROUP ${file}
-                            chown $TOMCAT_USER ${file}
-                    fi
-                done
-
-                # Set permissions of signedAudit log files
-                # do not set the group id, this will be set by the sgid on the directory
-                pki_signedAudit_files=`ls -1A ${pki_signedAudit} | wc -l`
-                if  [ ${pki_signedAudit_files} -gt 0 ]; then
-                    for file in ${pki_signedAudit}/*; do
-                        chmod 00640 ${file}
-                        chown $TOMCAT_USER ${file}
-                    done
-                fi
-
-		# ignore "status" return codes
-		echo
-		display_instance_status
-	else
-		if [ -f /etc/init.d/functions ]; then
-			if [ "$CONSOLETYPE" = "serial" ]; then
-				$0	echo -n "         "
-			fi
-			echo_failure
-			echo
-		else
-			echo "         [  FAILED  ]"
-		fi
-	fi
-
-	sleep 5
-	return ${rv}
-}
-
-stop_instance()
-{
-	rv=0
-
-	echo -n "Stopping $TOMCAT_PROG: "
-
-	if [ -f ${PKI_LOCKFILE} ] ; then
-		CATALINA_PID=${pidfile}
-		export CATALINA_PID
-
-		# daemon --user $TOMCAT_USER $TOMCAT_SCRIPT stop
-		if [ ${OS} = "SunOS" ] ; then
-			su  $TOMCAT_USER -c "$TOMCAT_SCRIPT stop" > /dev/null
-		else
-			runuser -s /bin/bash $TOMCAT_USER -c "$TOMCAT_SCRIPT stop" > /dev/null
-		fi
-
-		rv=$?
-
-		if [ ${rv} = 0 ]; then
-			count=0;
-
-			if [ -f ${pidfile} ]; then
-				read kpid < ${pidfile}
-				let kwait=$SHUTDOWN_WAIT
-
-				until	[ `ps -p $kpid | grep -c $kpid` = '0' ] ||
-						[ $count -gt $kwait ]
-				do
-					echo -n "."
-					sleep 1
-					let count=$count+1;
-				done
-
-				if [ $count -gt $kwait ]; then
-					kill -9 $kpid
-				fi
-			fi
-
-			rm -f ${PKI_LOCKFILE}
-			rm -f ${pidfile}
-
-			if [ -f /etc/init.d/functions ]; then
-				if [ "$CONSOLETYPE" = "serial" ]; then
-					echo -n "         "
-				fi
-				echo_success
-				echo
-			else
-				echo "         [  OK  ]"
-			fi
-		else
-			if [ -f /etc/init.d/functions ]; then
-				if [ "$CONSOLETYPE" = "serial" ]; then
-					echo -n "         "
-				fi
-				echo_failure
-				echo
-			else
-				echo "         [  FAILED  ]"
-			fi
-			rv=${default_error}
-		fi
-	else
-		echo
-		echo "process already stopped"
-		rv=0
-	fi
-
-	return ${rv}
-}
-
-start()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		config_errors=0
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "BEGIN STARTING '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Start every PKI instance of this type that isn't already running
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			start_instance
-
-			rv=$?
-			if [ ${rv} = 6 ] ; then
-				# Since at least ONE configuration error exists, then there
-				# is at least ONE unconfigured instance from the PKI point
-				# of view.
-				#
-				# However, it must still be considered that the
-				# instance is "running" from the point of view of other
-				# OS programs such as 'chkconfig'.
-				#
-				# Therefore, ignore non-zero return codes resulting
-				# from configuration errors.
-				#
-
-				config_errors=`expr $config_errors + 1`
-				rv=0
-			elif [ ${rv} != 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt ${errors} ] ; then
-			touch ${lockfile}
-			chmod 00600 ${lockfile}
-		fi
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			# NOTE:  "bad" return code(s) OVERRIDE configuration errors!
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "1 generic or unspecified error (current practice)"
-				rv=1
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances failed to start!"
-				echo
-			fi
-
-			if [ ${TOTAL_UNCONFIGURED_PKI_ENTRIES} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${TOTAL_UNCONFIGURED_PKI_ENTRIES} "
-				echo -n "of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances MUST be configured!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED STARTING '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances installed!"
-		rv=5
-	fi
-
-	return ${rv}
-}
-
-stop()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "BEGIN SHUTTING DOWN '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Shutdown every PKI instance of this type that is running
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			stop_instance
-
-			rv=$?
-			if [ ${rv} != 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		if [ ${errors} -eq 0 ] ; then
-			rm -f ${lockfile}
-		fi
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "1 generic or unspecified error (current practice)"
-				rv=1
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances were "
-				echo -n "unsuccessfully stopped!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED SHUTTING DOWN '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances installed!"
-		rv=5
-	fi
-
-	return ${rv}
-}
-
-restart()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	stop
-	sleep 2
-	echo
-	echo "============================================================"
-	echo
-	start
-
-	return $?
-}
-
-status()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 program is running or service is OK
-	#     * 1 program is dead and /var/run pid file exists
-	#     * 2 program is dead and /var/lock lock file exists
-	#     * 3 program is not running
-	#     * 4 program or service status is unknown
-	#     * 5-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "REPORT STATUS OF '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Obtain status of every PKI instance of this type
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			display_instance_status
-
-			rv=$?
-			if [ ${rv} -ne 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "4 - program or service status is unknown"
-				rv=4
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances reported status failures!"
-				echo
-			fi
-
-			if [ ${TOTAL_UNCONFIGURED_PKI_ENTRIES} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${TOTAL_UNCONFIGURED_PKI_ENTRIES} "
-				echo -n "of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances MUST be configured!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED REPORTING STATUS OF '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances installed!"
-		rv=4
-	fi
-
-	return ${rv}
-}
+# Source the PKI function library
+. /usr/share/pki/scripts/functions
 
 # See how we were called.
-case "${command}" in
-	start|stop|restart|status)
-		${command}
-		exit $?
-		;;
-	condrestart|force-restart|try-restart)
-		[ ! -f ${lockfile} ] || restart
-		exit $?
-		;;
-	reload)
-		echo "The 'reload' action is an unimplemented feature."
-		exit ${default_error}
-		;;
-	*)
-		# * 3 unimplemented feature (for example, "reload")
-		#     [invalid command - should never be reached]
-		echo
-		usage
-		echo "where valid instance names include:"
-		list_instances
-		exit 3
-		;;
+case $command in
+    status)
+	registry_status
+	exit $?
+	;;
+    start)
+	start
+	exit $?
+	;;
+    restart)
+	restart
+	exit $?
+	;;
+    stop)
+	stop
+	exit $?
+	;;
+    condrestart|force-restart|try-restart)
+        [ ! -f ${lockfile} ] || restart
+        exit $?
+        ;;
+    reload)
+        echo "The 'reload' action is an unimplemented feature."
+        exit ${default_error}
+        ;;
+    *)
+	echo "unknown action ($command)"
+        usage
+        echo "where valid instance names include:"
+        list_instances
+        exit ${default_error}
+        ;;
 esac
 
diff --git a/pki/base/ocsp/build.xml b/pki/base/ocsp/build.xml
index 27cec54ef..d9b783c1d 100644
--- a/pki/base/ocsp/build.xml
+++ b/pki/base/ocsp/build.xml
@@ -191,6 +191,7 @@
                         filemode="644"
                         prefix="usr/share/${product.prefix}/${product}/setup">
                 <include name="config.desktop"/>
+                <include name="registry_instance"/>
             </zipfileset>
             <zipfileset dir="./shared/etc/init.d"
                         filemode="755"
@@ -198,15 +199,9 @@
                 <include name="pki-ocspd"/>
             </zipfileset>
             <zipfileset dir="./shared"
-                        filemode="755"
-                        prefix="usr/share/${product.prefix}/${product}">
-                <include name="conf/dtomcat5"/>
-            </zipfileset>
-            <zipfileset dir="./shared"
                         filemode="644"
                         prefix="usr/share/${product.prefix}/${product}">
                 <include name="**"/>
-                <exclude name="conf/dtomcat5"/>
                 <exclude name="etc/init.d/pki-ocspd"/>
             </zipfileset>
             <zipfileset dir="."
@@ -230,6 +225,7 @@
                         mode="644"
                         prefix="${dist.name}/usr/share/${product.prefix}/${product}/setup">
                 <include name="config.desktop"/>
+                <include name="registry_instance"/>
             </tarfileset>
             <tarfileset dir="./shared/etc/init.d"
                         mode="755"
@@ -237,15 +233,9 @@
                 <include name="pki-ocspd"/>                 
             </tarfileset>
             <tarfileset dir="./shared"
-                        mode="755"
-                        prefix="${dist.name}/usr/share/${product.prefix}/${product}">
-                <include name="conf/dtomcat5"/>
-            </tarfileset>
-            <tarfileset dir="./shared"
                         mode="644"
                         prefix="${dist.name}/usr/share/${product.prefix}/${product}">
                 <include name="**"/>
-                <exclude name="conf/dtomcat5"/>
                 <exclude name="etc/init.d/pki-ocspd"/>
             </tarfileset>
             <tarfileset dir="."
diff --git a/pki/base/ocsp/setup/registry_instance b/pki/base/ocsp/setup/registry_instance
new file mode 100644
index 000000000..7f0e592a1
--- /dev/null
+++ b/pki/base/ocsp/setup/registry_instance
@@ -0,0 +1,54 @@
+# Establish PKI Variable "Slot" Substitutions
+
+PKI_FLAVOR=[PKI_FLAVOR]
+export PKI_FLAVOR
+
+PKI_SUBSYSTEM_TYPE=[PKI_SUBSYSTEM_TYPE]
+export PKI_SUBSYSTEM_TYPE
+
+PKI_USER=[PKI_USER]
+export PKI_USER
+
+PKI_GROUP=[PKI_GROUP]
+export PKI_GROUP
+
+PKI_INSTANCE_ID=[PKI_INSTANCE_ID]
+export PKI_INSTANCE_ID
+
+PKI_INSTANCE_PATH=[PKI_INSTANCE_PATH]
+export PKI_INSTANCE_PATH
+
+PKI_INSTANCE_INITSCRIPT=[PKI_INSTANCE_INITSCRIPT]
+export PKI_INSTANCE_INITSCRIPT
+
+PKI_SERVER_XML_CONF=[PKI_SERVER_XML_CONF]
+export PKI_SERVER_XML_CONF
+
+# Use CATALINA_BASE
+
+CATALINA_BASE=$PKI_INSTANCE_PATH
+export CATALINA_BASE
+
+TOMCAT_PROG=$PKI_INSTANCE_ID
+export TOMCAT_PROG
+
+TOMCAT_USER=$PKI_USER
+export TOMCAT_USER
+
+TOMCAT_GROUP=$PKI_GROUP
+export TOMCAT_GROUP
+
+PKI_LOCKDIR="/var/lock/${PKI_FLAVOR}/${PKI_SUBSYSTEM_TYPE}"
+export PKI_LOCKDIR
+
+PKI_LOCKFILE="${PKI_LOCKDIR}/${PKI_INSTANCE_ID}.pid"
+export PKI_LOCKFILE
+
+TOMCAT_PIDFILE=[TOMCAT_PIDFILE]
+export TOMCAT_PIDFILE
+
+pki_instance_configuration_file=${PKI_INSTANCE_PATH}/conf/CS.cfg
+export pki_instance_configuration_file
+
+RESTART_SERVER=${PKI_INSTANCE_PATH}/conf/restart_server_after_configuration
+export RESTART_SERVER
diff --git a/pki/base/ocsp/shared/conf/catalina.policy b/pki/base/ocsp/shared/conf/catalina.policy
index 8f481e333..cf8302cd0 100644
--- a/pki/base/ocsp/shared/conf/catalina.policy
+++ b/pki/base/ocsp/shared/conf/catalina.policy
@@ -1,5 +1,26 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// Copyright (C) 2006-2010 Red Hat, Inc.
+// All rights reserved.
+// Modifications: configuration parameters
+// --- END COPYRIGHT BLOCK ---
+
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 // ============================================================================
-// catalina.corepolicy - Security Policy Permissions for Tomcat 5
+// catalina.corepolicy - Security Policy Permissions for Tomcat 6
 //
 // This file contains a default set of security policies to be enforced (by the
 // JVM) when Catalina is executed with the "-security" option.  In addition
@@ -40,35 +61,16 @@ grant codeBase "file:${java.home}/lib/ext/-" {
 // ========== CATALINA CODE PERMISSIONS =======================================
 
 
-// These permissions apply to the launcher code
-grant codeBase "file:${catalina.home}/bin/commons-launcher.jar" {
-        permission java.security.AllPermission;
-};
-
 // These permissions apply to the daemon code
 grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {
         permission java.security.AllPermission;
 };
 
-// These permissions apply to the commons-logging API
-grant codeBase "file:${catalina.home}/bin/commons-logging-api.jar" {
-        permission java.security.AllPermission;
-};
-
-// These permissions apply to the server startup code
-grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
-        permission java.security.AllPermission;
-};
-
-// These permissions apply to the JMX server
-grant codeBase "file:${catalina.home}/bin/jmx.jar" {
-        permission java.security.AllPermission;
-};
-
-// These permissions apply to JULI
+// These permissions apply to the logging API
 grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
         permission java.util.PropertyPermission "java.util.logging.config.class", "read";
         permission java.util.PropertyPermission "java.util.logging.config.file", "read";
+        permission java.io.FilePermission "${java.home}${file.separator}lib${file.separator}logging.properties", "read"; 
         permission java.lang.RuntimePermission "shutdownHooks";
         permission java.io.FilePermission "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read";
         permission java.util.PropertyPermission "catalina.base", "read";
@@ -82,24 +84,19 @@ grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
         // permission java.io.FilePermission "${catalina.base}${file.separator}webapps${file.separator}examples${file.separator}WEB-INF${file.separator}classes${file.separator}logging.properties", "read";
 };
 
-// These permissions apply to the servlet API classes
-// and those that are shared across all class loaders
-// located in the "common" directory
-grant codeBase "file:${catalina.home}/common/-" {
+// These permissions apply to the server startup code
+grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
         permission java.security.AllPermission;
 };
 
-// These permissions apply to the container's core code, plus any additional
-// libraries installed in the "server" directory
-grant codeBase "file:${catalina.home}/server/-" {
+// These permissions apply to the servlet API classes
+// and those that are shared across all class loaders
+// located in the "lib" directory
+grant codeBase "file:${catalina.home}/lib/-" {
         permission java.security.AllPermission;
 };
 
-// The permissions granted to the balancer WEB-INF/classes and WEB-INF/lib directory
-grant codeBase "file:${catalina.home}/webapps/balancer/-" {
-        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.util.digester";
-        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.util.digester.*";
-};
+
 // ========== WEB APPLICATION PERMISSIONS =====================================
 
 
@@ -147,6 +144,9 @@ grant {
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime";
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime.*";
     
+    // Precompiled JSPs need access to this system property.
+    permission java.util.PropertyPermission "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";
+
 };
 
 
@@ -182,58 +182,3 @@ grant {
 //      permission java.net.SocketPermission "*.noaa.gov:80", "connect";
 // };
 
-
-
-// These permissions apply to Tomcat5 java
-grant codeBase "file:/usr/share/java/tomcat5/-" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/jakarta-commons-modeler.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/jasper5-compiler.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/jasper5-runtime.jar" {
-        permission java.security.AllPermission;
-};
-
-
-
-// These permissions apply to PKI configuration
-grant codeBase "file:/usr/share/java/velocity.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/tomcat5-servlet-2.4-api.jar" {
-        permission java.security.AllPermission;
-};
-
-
-
-
-// These permissions apply to PKI support
-grant codeBase "file:/usr/share/java/ldapjdk.jar" {
-        permission java.security.AllPermission;
-};
-
-
-
-// These permissions apply to PKI
-grant codeBase "file:/usr/lib/java/jss4.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/tomcatjss.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/lib/java/osutil.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/lib/java/symkey.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/pki/-" {
-        permission java.security.AllPermission;
-};
-
-
-
diff --git a/pki/base/ocsp/shared/conf/catalina.properties b/pki/base/ocsp/shared/conf/catalina.properties
index 3778ce4f6..70cb7c05e 100644
--- a/pki/base/ocsp/shared/conf/catalina.properties
+++ b/pki/base/ocsp/shared/conf/catalina.properties
@@ -1,8 +1,24 @@
 # --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2006 Red Hat, Inc.
+# Copyright (C) 2006-2010 Red Hat, Inc.
 # All rights reserved.
+# Modifications: configuration parameters
 # --- END COPYRIGHT BLOCK ---
+
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
 #
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 #
 # List of comma-separated packages that start with or equal this string
 # will cause a security exception to be thrown when
@@ -34,7 +50,7 @@ package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,org.apache
 #     "foo/*.jar": Add all the JARs of the specified folder as class 
 #                  repositories
 #     "foo/bar.jar": Add bar.jar as a class repository
-common.loader=${catalina.home}/common/classes,${catalina.home}/common/i18n/*.jar,${catalina.home}/common/endorsed/*.jar,${catalina.home}/common/lib/*.jar
+common.loader=${catalina.home}/lib,${catalina.home}/lib/*.jar,[TOMCAT_INSTANCE_COMMON_LIB]
 
 #
 # List of comma-separated paths defining the contents of the "server" 
@@ -47,7 +63,7 @@ common.loader=${catalina.home}/common/classes,${catalina.home}/common/i18n/*.jar
 #     "foo/*.jar": Add all the JARs of the specified folder as class 
 #                  repositories
 #     "foo/bar.jar": Add bar.jar as a class repository
-server.loader=${catalina.home}/server/classes,${catalina.home}/server/lib/*.jar
+server.loader=
 
 #
 # List of comma-separated paths defining the contents of the "shared" 
@@ -59,7 +75,9 @@ server.loader=${catalina.home}/server/classes,${catalina.home}/server/lib/*.jar
 #     "foo/*.jar": Add all the JARs of the specified folder as class 
 #                  repositories
 #     "foo/bar.jar": Add bar.jar as a class repository 
-shared.loader=${catalina.base}/shared/classes,${catalina.base}/shared/lib/*.jar
+# Please note that for single jars, e.g. bar.jar, you need the URL form
+# starting with file:.
+shared.loader=
 
 #
 # String cache configuration.
diff --git a/pki/base/ocsp/shared/conf/context.xml b/pki/base/ocsp/shared/conf/context.xml
index 60878b74b..8b6fe4905 100644
--- a/pki/base/ocsp/shared/conf/context.xml
+++ b/pki/base/ocsp/shared/conf/context.xml
@@ -1,9 +1,27 @@
+<?xml version='1.0' encoding='utf-8'?>
 <!-- BEGIN COPYRIGHT BLOCK
-     Copyright (C) 2006 Red Hat, Inc.
+     Copyright (C) 2006-2010 Red Hat, Inc.
      All rights reserved.
+     Modifications: configuration parameters
      END COPYRIGHT BLOCK -->
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
 <!-- The contents of this file will be loaded for each web application -->
-<Context crossContext="true">
+<Context crossContext="true" allowLinking="true">
 
     <!-- Default set of monitored resources -->
     <WatchedResource>WEB-INF/web.xml</WatchedResource>
@@ -13,4 +31,10 @@
     <Manager pathname="" />
     -->
 
+    <!-- Uncomment this to enable Comet connection tacking (provides events
+         on session expiration as well as webapp lifecycle) -->
+    <!--
+    <Valve className="org.apache.catalina.valves.CometConnectionManagerValve" />
+    -->
+
 </Context>
diff --git a/pki/base/ocsp/shared/conf/dtomcat5 b/pki/base/ocsp/shared/conf/dtomcat5
deleted file mode 100755
index 2eeb889e6..000000000
--- a/pki/base/ocsp/shared/conf/dtomcat5
+++ /dev/null
@@ -1,476 +0,0 @@
-#!/bin/bash
-#
-# --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2006 Red Hat, Inc.
-# All rights reserved.
-# --- END COPYRIGHT BLOCK ---
-#
-# -----------------------------------------------------------------------------
-# Start/Stop Script for the CATALINA Server
-#
-# Environment Variable Prequisites
-#
-#   CATALINA_HOME   May point at your Catalina "build" directory.
-#
-#   CATALINA_BASE   (Optional) Base directory for resolving dynamic portions
-#                   of a Catalina installation.  If not present, resolves to
-#                   the same directory that CATALINA_HOME points to.
-#
-#   CATALINA_OPTS   (Optional) Java runtime options used when the "start",
-#                   "stop", or "run" command is executed.
-#
-#   CATALINA_TMPDIR (Optional) Directory path location of temporary directory
-#                   the JVM should use (java.io.tmpdir).  Defaults to
-#                   $CATALINA_BASE/temp.
-#
-#   JAVA_HOME       Must point at your Java Development Kit installation.
-#                   Required to run the with the "debug" or "javac" argument.
-#
-#   JRE_HOME        Must point at your Java Development Kit installation.
-#                   Defaults to JAVA_HOME if empty.
-#
-#   JAVA_OPTS       (Optional) Java runtime options used when the "start",
-#                   "stop", or "run" command is executed.
-#
-#   JPDA_TRANSPORT  (Optional) JPDA transport used when the "jpda start"
-#                   command is executed. The default is "dt_socket".
-#
-#   JPDA_ADDRESS    (Optional) Java runtime options used when the "jpda start"
-#                   command is executed. The default is 8000.
-#
-#   JSSE_HOME       (Optional) May point at your Java Secure Sockets Extension
-#                   (JSSE) installation, whose JAR files will be added to the
-#                   system class path used to start Tomcat.
-#
-#   CATALINA_PID    (Optional) Path of the file which should contains the pid
-#                   of catalina startup java process, when start (fork) is used
-#
-# $Id$
-# -----------------------------------------------------------------------------
-
-# Disallow 'others' the ability to 'write' to new files
-umask 00002
-
-# Check to insure that this script's original invocation directory
-# has not been deleted!
-CWD=`/bin/pwd > /dev/null 2>&1`
-if [ $? -ne 0 ] ; then
-	echo "Cannot invoke '$0' from non-existent directory!"
-	exit 255
-fi
-
-# Check to insure that this script's associated PKI
-# subsystem currently resides on this system.
-PKI_SUBSYSTEM_TYPE=[PKI_SUBSYSTEM_TYPE]
-if [ ! -d /usr/share/pki/${PKI_SUBSYSTEM_TYPE} ] ; then
-	echo "This machine is missing the '${PKI_SUBSYSTEM_TYPE}' subsystem!"
-	exit 255
-fi
-
-# OS specific support.  $var _must_ be set to either true or false.
-OS=`uname -s`
-cygwin=false
-os400=false
-case "${OS}" in
-CYGWIN*) cygwin=true;;
-OS400*) os400=true;;
-esac
-
-TOMCAT_CFG=[PKI_INSTANCE_PATH]/conf/tomcat5.conf
-JAVADIR="/usr/share/java"
-
-# resolve links - $0 may be a softlink
-PRG="$0"
-
-while [ -h "$PRG" ]; do
-  ls=`ls -ld "$PRG"`
-  link=`expr "$ls" : '.*-> \(.*\)$'`
-  if expr "$link" : '.*/.*' > /dev/null; then
-    PRG="$link"
-  else
-    PRG=`dirname "$PRG"`/"$link"
-  fi
-done
-
-# Get standard environment variables
-PRGDIR=`dirname "$PRG"`
-
-# Only set CATALINA_HOME if not already set
-[ -z "$CATALINA_HOME" ] && CATALINA_HOME=`cd "$PRGDIR/.." ; pwd`
-
-if [ -r "$CATALINA_HOME"/bin/setenv.sh ]; then
-  . "$CATALINA_HOME"/bin/setenv.sh
-fi
-
-# For Cygwin, ensure paths are in UNIX format before anything is touched
-if $cygwin; then
-  [ -n "$JAVA_HOME" ] && JAVA_HOME=`cygpath --unix "$JAVA_HOME"`
-  [ -n "$JRE_HOME" ] && JRE_HOME=`cygpath --unix "$JRE_HOME"`
-  [ -n "$CATALINA_HOME" ] && CATALINA_HOME=`cygpath --unix "$CATALINA_HOME"`
-  [ -n "$CATALINA_BASE" ] && CATALINA_BASE=`cygpath --unix "$CATALINA_BASE"`
-  [ -n "$CLASSPATH" ] && CLASSPATH=`cygpath --path --unix "$CLASSPATH"`
-  [ -n "$JSSE_HOME" ] && JSSE_HOME=`cygpath --absolute --unix "$JSSE_HOME"`
-fi
-
-# For OS400
-if $os400; then
-  # Set job priority to standard for interactive (interactive - 6) by using
-  # the interactive priority - 6, the helper threads that respond to requests
-  # will be running at the same priority as interactive jobs.
-  COMMAND='chgjob job('$JOBNAME') runpty(6)'
-  system $COMMAND
-
-  # Enable multi threading
-  export QIBM_MULTI_THREADED=Y
-fi
-
-[ -r "$TOMCAT_CFG" ] && . "${TOMCAT_CFG}"
-
-### Set up defaults if they were omitted in TOMCAT_CFG
-###  JVM lookup
-if [ -z "$JAVA_HOME" ]; then
-    # Search for java in PATH
-    JAVA=`which java`
-    if [ -z "$JAVA" ] ; then
-        JAVA_BINDIR=`dirname ${JAVA}`
-        JAVA_HOME="${JAVA_BINDIR}/.."
-    fi
-    # Default clean JAVA_HOME
-    [ -z "$JAVA_HOME" -a -d "/usr/lib/java" ] && JAVA_HOME="/usr/lib/java"
-    # Default IBM JAVA_HOME
-    [ -z "$JAVA_HOME" -a -d "/opt/IBMJava2-13" ] && \
-        JAVA_HOME="/opt/IBMJava2-13"
-    [ -z "$JAVA_HOME" -a -d "/opt/IBMJava2-131" ] && \
-        JAVA_HOME="/opt/IBMJava2-131"
-    [ -z "$JAVA_HOME" -a -d "/opt/IBMJava2-14" ] && \
-        JAVA_HOME="/opt/IBMJava2-14"
-    [ -z "$JAVA_HOME" -a -d "/opt/IBMJava2-141" ] && \
-        JAVA_HOME="/opt/IBMJava2-141"
-    # Another solution
-    [ -z "$JAVA_HOME" -a -d "/usr/java/jdk" ] && \
-        JAVA_HOME="/usr/java/jdk"
-    # madeinlinux JAVA_HOME
-    [ -z "$JAVA_HOME" -a -d "/usr/local/jdk1.2.2" ] && \
-        JAVA_HOME="/usr/local/jdk1.2.2"
-    # Kondara JAVA_HOME
-    [ -z "$JAVA_HOME"  -a -d "/usr/lib/java/jdk1.2.2" ] && \
-        JAVA_HOME="/usr/lib/java/jdk1.2.2"
-    # Other commonly found JAVA_HOMEs
-    [ -z "$JAVA_HOME"  -a -d "/usr/jdk1.2" ] && JAVA_HOME="/usr/jdk1.2"
-    # Default Caldera JAVA_HOME
-    [ -z "$JAVA_HOME"  -a -d "/opt/java-1.3" ] && \
-        JAVA_HOME="/opt/java-1.3"
-    # Add other locations here
-    if [ -z "$JAVA_HOME" ]; then
-        echo "No JAVA_HOME specified in ${TOMCAT_CFG} and no java found"
-        exit 1
-    else
-        echo "Found JAVA_HOME: ${JAVA_HOME}"
-        echo "Please complete your ${TOMCAT_CFG} so we won't have to look for it next time"
-    fi
-fi
-
-# Set juli LogManager if it is present
-if [ -r "$CATALINA_HOME"/bin/tomcat-juli.jar ]; then
-  JAVA_OPTS="$JAVA_OPTS "-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
-fi
-
-# Set standard commands for invoking Java.
-_RUNJAVA="$JAVA_HOME"/bin/java
-_RUNJAVAC="$JAVA_HOME"/bin/javac
-_RUNJDB="$JAVA_HOME"/bin/jdb
-
-# Set standard CLASSPATH
-# (always inherit any preset values from the PKI start script)
-if [ ${OS} = "Linux" ] ; then
-	# Checking for OpenJDK JVM
-	OPENJDK_JVM="`java -version 2>&1 | tail -1 | awk '{print $1};'`"
-	if	[ "${OPENJDK_JVM}" = "OpenJDK" ] ||
-		[ "${OPENJDK_JVM}" = "IcedTea" ]; then
-		# using OpenJDK
-		CLASSPATH="$CLASSPATH":"$JAVA_HOME"/lib/rt.jar
-
-		# add required classes to the CLASSPATH for OpenJDK
-		CLASSPATH="$CLASSPATH":"$JAVADIR"/commons-collections.jar
-	else
-		# NOT using OpenJDK
-		CLASSPATH="$CLASSPATH":"$JAVA_HOME"/lib/tools.jar
-	fi
-elif [ ${OS} = "SunOS" ] ; then
-	CLASSPATH="$CLASSPATH":"$JAVA_HOME"/lib/rt.jar
-fi
-
-# Add on extra jar files to CLASSPATH
-if [ -n "$JSSE_HOME" ]; then
-  CLASSPATH="$CLASSPATH":"$JSSE_HOME"/lib/jcert.jar:"$JSSE_HOME"/lib/jnet.jar:"$JSSE_HOME"/lib/jsse.jar
-fi
-
-# JPackage JSSE location check
-if [ -r "$JAVADIR/jsse/jcert.jar" ]; then
-  CLASSPATH="$CLASSPATH":"$JAVADIR"/jsse/jcert.jar:"$JAVADIR"/jsse/jnet.jar:"$JAVADIR"/jsse/jsse.jar
-fi
-
-if [ ${OS} = "Linux" ] ; then
-	CLASSPATH="$CLASSPATH":"$CATALINA_HOME"/bin/bootstrap.jar:"$CATALINA_HOME"/bin/commons-logging-api.jar:`/usr/bin/build-classpath mx4j/mx4j-impl`:`/usr/bin/build-classpath mx4j/mx4j-jmx`
-
-        # add jars in required components for velocity >= 1.6 (just in case)
-        VELOCITY=`rpm -q velocity|sed 's/velocity-\([0-9]*\)\.\([0-9]*\).*/\1\2/'`
-        if [ "$VELOCITY" -ge 16 ]; then 
-            CLASSPATH="$CLASSPATH":`/usr/bin/build-classpath bcel hsqldb commons-collections commons-lang commons-logging commons-logging-api jdom junit oro servletapi5 werken.xpath`
-        fi
-
-elif [ ${OS} = "SunOS" ] ; then
-	# The following definitions are provided for Solaris
-	# platforms since they are unable to execute the
-	# "/usr/bin/build-classpath" and
-	# "/usr/share/java-utils/java-functions" files . . .
-
-	CLASSPATH="$CLASSPATH":"$CATALINA_HOME"/bin/bootstrap.jar
-	CLASSPATH="$CLASSPATH":"$CATALINA_HOME"/bin/commons-logging-api.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-impl.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-jmx.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/base.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/certsrv.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cms.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cms72.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cms72_en.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cmsbundle.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cmscore.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cmsutil.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/mcc70.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/mcc70_en.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/nmclf70.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/nmclf70_en.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/nsutil.jar
-
-	if [ -f /usr/share/java/pkitools.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pkitools.jar
-	elif [ -f /usr/share/java/cstools.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/cstools.jar
-	elif [ -f /usr/share/java/pki/cstools.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/cstools.jar
-	fi
-
-	if [ -f /usr/share/java/ca.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/ca.jar
-	elif [ -f /usr/share/java/pki/ca/ca.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/ca/ca.jar
-	fi
-	if [ -f /usr/share/java/kra.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/kra.jar
-	elif [ -f /usr/share/java/pki/kra/kra.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/kra/kra.jar
-	fi
-	if [ -f /usr/share/java/ocsp.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/ocsp.jar
-	elif [ -f /usr/share/java/pki/ocsp/ocsp.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/ocsp/ocsp.jar
-	fi
-	if [ -f /usr/share/java/tks.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/tks.jar
-	elif [ -f /usr/share/java/pki/tks/tks.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/tks/tks.jar
-	fi
-
-        # add jars for velocity 1.6 (just in case) 
-        CLASSPATH="$CLASSPATH":/usr/share/java/bcel.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/hsqldb.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/commons-collections.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/commons-lang.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/commons-logging.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/commons-logging-api.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/jdom.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/junit.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/oro.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/servletapi5.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/werken.xpath.jar
-
-fi
-
-if [ -z "$CATALINA_BASE" ] ; then
-  CATALINA_BASE="$CATALINA_HOME"
-fi
-
-if [ -z "$CATALINA_TMPDIR" ] ; then
-  # Define the java.io.tmpdir to use for Catalina
-  CATALINA_TMPDIR="$CATALINA_BASE"/temp
-fi
-
-if [ -z "$CATALINA_PID" ] ; then
-    export CATALINA_PID=/var/run/tomcat5.pid
-fi
-
-# For Cygwin, switch paths to Windows format before running java
-if $cygwin; then
-  JAVA_HOME=`cygpath --absolute --windows "$JAVA_HOME"`
-  JRE_HOME=`cygpath --absolute --windows "$JRE_HOME"`
-  CATALINA_HOME=`cygpath --absolute --windows "$CATALINA_HOME"`
-  CATALINA_BASE=`cygpath --absolute --windows "$CATALINA_BASE"`
-  CATALINA_TMPDIR=`cygpath --absolute --windows "$CATALINA_TMPDIR"`
-  CLASSPATH=`cygpath --path --windows "$CLASSPATH"`
-  [ -n "$JSSE_HOME" ] && JSSE_HOME=`cygpath --absolute --windows "$JSSE_HOME"`
-  JAVA_ENDORSED_DIRS=`cygpath --path --windows "$JAVA_ENDORSED_DIRS"`
-fi
-
-# ----- Execute The Requested Command -----------------------------------------
-echo "Using CATALINA_PID $CATALINA_PID"
-echo "Using CATALINA_BASE:   $CATALINA_BASE"
-echo "Using CATALINA_HOME:   $CATALINA_HOME"
-echo "Using CATALINA_TMPDIR: $CATALINA_TMPDIR"
-if [ "$1" = "debug" -o "$1" = "javac" ] ; then
-  echo "Using JAVA_HOME:       $JAVA_HOME"
-else
-  echo "Using JRE_HOME:       $JRE_HOME"
-fi
-
-if [ "$1" = "jpda" ] ; then
-  if [ -z "$JPDA_TRANSPORT" ]; then
-    JPDA_TRANSPORT="dt_socket"
-  fi
-  if [ -z "$JPDA_ADDRESS" ]; then
-    JPDA_ADDRESS="8000"
-  fi
-  if [ -z "$JPDA_OPTS" ]; then
-    JPDA_OPTS="-Xdebug -Xrunjdwp:transport=$JPDA_TRANSPORT,address=$JPDA_ADDRESS,server=y,suspend=n"
-  fi
-  CATALINA_OPTS="$CATALINA_OPTS $JPDA_OPTS"
-  shift
-fi
-
-if [ "$1" = "debug" ] ; then
-  if $os400; then
-    echo "Debug command not available on OS400"
-    exit 1
-  else
-    shift
-    if [ "$1" = "-security" ] ; then
-      echo "Using Security Manager"
-      shift
-      exec "$_RUNJDB" $JAVA_OPTS $CATALINA_OPTS \
-        -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-        -sourcepath "$CATALINA_HOME"/../../jakarta-tomcat-catalina/catalina/src/share \
-        -Djava.security.manager \
-        -Djava.security.policy=="$CATALINA_BASE"/conf/catalina.policy \
-        -Dcatalina.base="$CATALINA_BASE" \
-        -Dcatalina.home="$CATALINA_HOME" \
-        -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-        org.apache.catalina.startup.Bootstrap "$@" start
-    else
-      exec "$_RUNJDB" $JAVA_OPTS $CATALINA_OPTS \
-        -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-        -sourcepath "$CATALINA_HOME"/../../jakarta-tomcat-catalina/catalina/src/share \
-        -Dcatalina.base="$CATALINA_BASE" \
-        -Dcatalina.home="$CATALINA_HOME" \
-        -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-        org.apache.catalina.startup.Bootstrap "$@" start
-    fi
-  fi
-
-elif [ "$1" = "run" ]; then
-
-  shift
-  if [ "$1" = "-security" ] ; then
-    echo "Using Security Manager"
-    shift
-    exec "$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \
-      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-      -Djava.security.manager \
-      -Djava.security.policy=="$CATALINA_BASE"/conf/catalina.policy \
-      -Dcatalina.base="$CATALINA_BASE" \
-      -Dcatalina.home="$CATALINA_HOME" \
-      -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-      org.apache.catalina.startup.Bootstrap "$@" start
-  else
-    exec "$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \
-      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-      -Dcatalina.base="$CATALINA_BASE" \
-      -Dcatalina.home="$CATALINA_HOME" \
-      -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-      org.apache.catalina.startup.Bootstrap "$@" start
-  fi
-
-elif [ "$1" = "start" ] ; then
-
-  shift
-  touch "$CATALINA_BASE"/logs/catalina.out
-  if [ "$1" = "-security" ] ; then
-    echo "Using Security Manager"
-    shift
-    "$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \
-      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-      -Djava.security.manager \
-      -Djava.security.policy=="$CATALINA_BASE"/conf/catalina.policy \
-      -Dcatalina.base="$CATALINA_BASE" \
-      -Dcatalina.home="$CATALINA_HOME" \
-      -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-      org.apache.catalina.startup.Bootstrap "$@" start \
-      >> "$CATALINA_BASE"/logs/catalina.out 2>&1 &
-
-      if [ ! -z "$CATALINA_PID" ]; then
-        echo $! > $CATALINA_PID
-      fi
-  else
-    "$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \
-      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-      -Dcatalina.base="$CATALINA_BASE" \
-      -Dcatalina.home="$CATALINA_HOME" \
-      -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-      org.apache.catalina.startup.Bootstrap "$@" start \
-      >> "$CATALINA_BASE"/logs/catalina.out 2>&1 &
-
-      if [ ! -z "$CATALINA_PID" ]; then
-        echo $! > $CATALINA_PID
-      fi
-  fi
-
-elif [ "$1" = "stop" ] ; then
-
-  shift
-  FORCE=0
-  if [ "$1" = "-force" ]; then
-    shift
-    FORCE=1
-  fi
-
-  "$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \
-    -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-    -Dcatalina.base="$CATALINA_BASE" \
-    -Dcatalina.home="$CATALINA_HOME" \
-    -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-    org.apache.catalina.startup.Bootstrap "$@" stop
-
-  if [ $FORCE -eq 1 ]; then
-    if [ ! -z "$CATALINA_PID" ]; then
-       echo "Killing: `cat $CATALINA_PID`"
-       kill -9 `cat $CATALINA_PID`
-    fi
-  fi
-
-elif [ "$1" = "version" ] ; then
-
-    "$_RUNJAVA"   \
-      -classpath "$CATALINA_HOME/server/lib/catalina.jar" \
-      org.apache.catalina.util.ServerInfo
-
-else
-
-  echo "Usage: dtomcat5 ( commands ... )"
-  echo "commands:"
-  if $os400; then
-    echo "  debug             Start Catalina in a debugger (not available on OS400)"
-    echo "  debug -security   Debug Catalina with a security manager (not available on OS400)"
-  else
-    echo "  debug             Start Catalina in a debugger"
-    echo "  debug -security   Debug Catalina with a security manager"
-  fi
-  echo "  jpda start        Start Catalina under JPDA debugger"
-  echo "  run               Start Catalina in the current window"
-  echo "  run -security     Start in the current window with security manager"
-  echo "  start             Start Catalina in a separate window"
-  echo "  start -security   Start in a separate window with security manager"
-  echo "  stop              Stop Catalina"
-  echo "  stop -force       Stop Catalina (followed by kill -KILL)"
-  echo "  version           What version of tomcat are you running?"
-  exit 1
-
-fi
diff --git a/pki/base/ocsp/shared/conf/logging.properties b/pki/base/ocsp/shared/conf/logging.properties
new file mode 100644
index 000000000..796cfc071
--- /dev/null
+++ b/pki/base/ocsp/shared/conf/logging.properties
@@ -0,0 +1,70 @@
+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2006-2010 Red Hat, Inc.
+# All rights reserved.
+# Modifications: configuration parameters
+# --- END COPYRIGHT BLOCK ---
+
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+handlers = 1catalina.org.apache.juli.FileHandler, 2localhost.org.apache.juli.FileHandler, 3manager.org.apache.juli.FileHandler, 4host-manager.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler
+
+.handlers = 1catalina.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler
+
+############################################################
+# Handler specific properties.
+# Describes specific configuration info for Handlers.
+############################################################
+
+1catalina.org.apache.juli.FileHandler.level = FINE
+1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
+1catalina.org.apache.juli.FileHandler.prefix = catalina.
+
+2localhost.org.apache.juli.FileHandler.level = FINE
+2localhost.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
+2localhost.org.apache.juli.FileHandler.prefix = localhost.
+
+3manager.org.apache.juli.FileHandler.level = FINE
+3manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
+3manager.org.apache.juli.FileHandler.prefix = manager.
+
+4host-manager.org.apache.juli.FileHandler.level = FINE
+4host-manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
+4host-manager.org.apache.juli.FileHandler.prefix = host-manager.
+
+java.util.logging.ConsoleHandler.level = FINE
+java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
+
+
+############################################################
+# Facility specific properties.
+# Provides extra control for each logger.
+############################################################
+
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = INFO
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = 2localhost.org.apache.juli.FileHandler
+
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].level = INFO
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = 3manager.org.apache.juli.FileHandler
+
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].level = INFO
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = 4host-manager.org.apache.juli.FileHandler
+
+# For example, set the com.xyz.foo logger to only log SEVERE
+# messages:
+#org.apache.catalina.startup.ContextConfig.level = FINE
+#org.apache.catalina.startup.HostConfig.level = FINE
+#org.apache.catalina.session.ManagerBase.level = FINE
+#org.apache.catalina.core.AprLifecycleListener.level=FINE
diff --git a/pki/base/ocsp/shared/conf/server.xml b/pki/base/ocsp/shared/conf/server.xml
index 71b433bef..9a24cfa44 100644
--- a/pki/base/ocsp/shared/conf/server.xml
+++ b/pki/base/ocsp/shared/conf/server.xml
@@ -1,208 +1,196 @@
-<!-- Example Server Configuration File -->
-<!-- Note that component elements are nested corresponding to their
-     parent-child relationships with each other -->
-
-<!-- A "Server" is a singleton element that represents the entire JVM,
-     which may contain one or more "Service" instances.  The Server
-     listens for a shutdown command on the indicated port.
-
-     Note:  A "Server" is not itself a "Container", so you may not
-     define subcomponents such as "Valves" or "Loggers" at this level.
+<?xml version='1.0' encoding='utf-8'?>
+<!-- BEGIN COPYRIGHT BLOCK
+     Copyright (C) 2006-2010 Red Hat, Inc.
+     All rights reserved.
+     Modifications: configuration parameters
+     END COPYRIGHT BLOCK -->
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<!-- Note:  A "Server" is not itself a "Container", so you may not
+     define subcomponents such as "Valves" at this level.
+     Documentation at /docs/config/server.html
  -->
 
 <!-- DO NOT REMOVE - Begin PKI Status Definitions -->
 <!--
-Unsecure Port     = http://[PKI_MACHINE_NAME]:[PKI_UNSECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/ee/[PKI_SUBSYSTEM_TYPE]
-Secure Agent Port = https://[PKI_MACHINE_NAME]:[PKI_AGENT_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/agent/[PKI_SUBSYSTEM_TYPE]
-Secure EE Port    = https://[PKI_MACHINE_NAME]:[PKI_EE_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/ee/[PKI_SUBSYSTEM_TYPE]
-Secure Admin Port = https://[PKI_MACHINE_NAME]:[PKI_ADMIN_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/services
-PKI Console Port  = pkiconsole https://[PKI_MACHINE_NAME]:[PKI_ADMIN_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]
-Tomcat Port       = [TOMCAT_SERVER_PORT] (for shutdown)
+Unsecure Port       = http://[PKI_MACHINE_NAME]:[PKI_UNSECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/ee/[PKI_SUBSYSTEM_TYPE]
+Secure Agent Port   = https://[PKI_MACHINE_NAME]:[PKI_AGENT_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/agent/[PKI_SUBSYSTEM_TYPE]
+Secure EE Port      = https://[PKI_MACHINE_NAME]:[PKI_EE_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/ee/[PKI_SUBSYSTEM_TYPE]
+Secure Admin Port   = https://[PKI_MACHINE_NAME]:[PKI_ADMIN_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/services
+PKI Console Port    = pkiconsole https://[PKI_MACHINE_NAME]:[PKI_ADMIN_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]
+Tomcat Port         = [TOMCAT_SERVER_PORT] (for shutdown)
 -->
 <!-- DO NOT REMOVE - End PKI Status Definitions -->
 
 <Server port="[TOMCAT_SERVER_PORT]" shutdown="SHUTDOWN">
 
-  <!-- Comment these entries out to disable JMX MBeans support used for the 
-       administration web application -->
+  <!--APR library loader. Documentation at /docs/apr.html -->
+  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
+  <!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html -->
+  <Listener className="org.apache.catalina.core.JasperListener" />
+  <!-- JMX Support for the Tomcat server. Documentation at /docs/non-existent.html -->
   <Listener className="org.apache.catalina.mbeans.ServerLifecycleListener" />
   <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
-  <Listener className="org.apache.catalina.storeconfig.StoreConfigLifecycleListener"/>
 
-  <!-- Global JNDI resources -->
+  <!-- Global JNDI resources
+       Documentation at /docs/jndi-resources-howto.html
+  -->
   <GlobalNamingResources>
-
-    <!-- Test entry for demonstration purposes -->
-    <Environment name="simpleValue" type="java.lang.Integer" value="30"/>
-
     <!-- Editable user database that can also be used by
-         UserDatabaseRealm to authenticate users -->
+         UserDatabaseRealm to authenticate users
+    -->
     <Resource name="UserDatabase" auth="Container"
               type="org.apache.catalina.UserDatabase"
-       description="User database that can be updated and saved"
-           factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
-          pathname="conf/tomcat-users.xml" />
-
+              description="User database that can be updated and saved"
+              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
+              pathname="conf/tomcat-users.xml" />
   </GlobalNamingResources>
 
   <!-- A "Service" is a collection of one or more "Connectors" that share
-       a single "Container" (and therefore the web applications visible
-       within that Container).  Normally, that Container is an "Engine",
-       but this is not required.
-
-       Note:  A "Service" is not itself a "Container", so you may not
-       define subcomponents such as "Valves" or "Loggers" at this level.
+       a single "Container" Note:  A "Service" is not itself a "Container", 
+       so you may not define subcomponents such as "Valves" at this level.
+       Documentation at /docs/config/service.html
    -->
-
-  <!-- Define the Tomcat Stand-Alone Service -->
   <Service name="Catalina">
-
+  
+    <!--The connectors can use a shared executor, you can define one or more named thread pools-->
+    <!--
+    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-" 
+        maxThreads="150" minSpareThreads="4"/>
+    -->
+    
+    
     <!-- A "Connector" represents an endpoint by which requests are received
-         and responses are returned.  Each Connector passes requests on to the
-         associated "Container" (normally an Engine) for processing.
-
-         By default, a non-SSL HTTP/1.1 Connector is established on port 8080.
-         You can also enable an SSL HTTP/1.1 Connector on port 8443 by
-         following the instructions below and uncommenting the second Connector
-         entry.  SSL support requires the following steps (see the SSL Config
-         HOWTO in the Tomcat 5 documentation bundle for more detailed
-         instructions):
-         * If your JDK version 1.3 or prior, download and install JSSE 1.0.2 or
-           later, and put the JAR files into "$JAVA_HOME/jre/lib/ext".
-         * Execute:
-             %JAVA_HOME%\bin\keytool -genkey -alias tomcat -keyalg RSA (Windows)
-             $JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA  (Unix)
-           with a password value of "changeit" for both the certificate and
-           the keystore itself.
-
-         By default, DNS lookups are enabled when a web application calls
-         request.getRemoteHost().  This can have an adverse impact on
-         performance, so you can disable it by setting the
-         "enableLookups" attribute to "false".  When DNS lookups are disabled,
-         request.getRemoteHost() will return the String version of the
-         IP address of the remote client.
+         and responses are returned. Documentation at :
+         Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
+         Java AJP  Connector: /docs/config/ajp.html
+         APR (HTTP/AJP) Connector: /docs/apr.html
+         Define a non-SSL HTTP/1.1 Connector on port 8080
     -->
 
-<!-- Define a non-SSL HTTP/1.1 Connector on port 8080 -->
-[PKI_UNSECURE_PORT_SERVER_COMMENT]
-<Connector name="[PKI_UNSECURE_PORT_CONNECTOR_NAME]" port="[PKI_UNSECURE_PORT]" maxHttpHeaderSize="8192"
-        maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
-        enableLookups="false" redirectPort="8443" acceptCount="100"
-        connectionTimeout="20000" disableUploadTimeout="true"/>
-
-
-<!-- Define a SSL HTTP/1.1 Connector on port 8443 -->
-[PKI_SECURE_PORT_SERVER_COMMENT]
-<!-- DO NOT REMOVE - Begin define PKI secure port -->
-<Connector name="[PKI_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_SECURE_PORT]" maxHttpHeaderSize="8192"
-        maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
-        enableLookups="false" disableUploadTimeout="true"
-        acceptCount="100" scheme="https" secure="true"
-        clientAuth="[PKI_AGENT_CLIENTAUTH]" sslProtocol="SSL"
-        sslOptions="ssl2=false,ssl3=true,tls=true"
-        ssl2Ciphers="-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL2_DES_64_CBC_WITH_MD5,-SSL2_DES_192_EDE3_CBC_WITH_MD5"
-        ssl3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        tls3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
-        serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
-        passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
-        passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
-        certdbDir="[PKI_INSTANCE_PATH]/alias"/>
-<!-- DO NOT REMOVE - End define PKI secure port -->
-
-[PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_ADMIN_SECURE_PORT_SERVER_COMMENT]
-<Connector name="[PKI_ADMIN_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_ADMIN_SECURE_PORT]" maxHttpHeaderSize="8192"
-        maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
-        enableLookups="false" disableUploadTimeout="true"
-        acceptCount="100" scheme="https" secure="true"
-        clientAuth="false" sslProtocol="SSL"
-        sslOptions="ssl2=false,ssl3=true,tls=true"
-        ssl2Ciphers="-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL2_DES_64_CBC_WITH_MD5,-SSL2_DES_192_EDE3_CBC_WITH_MD5"
-        ssl3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        tls3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
-        serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
-        passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
-        passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
-        certdbDir="[PKI_INSTANCE_PATH]/alias"/>
-[PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT]
-
-[PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_EE_SECURE_PORT_SERVER_COMMENT]
-<Connector name="[PKI_EE_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_EE_SECURE_PORT]" maxHttpHeaderSize="8192"
-        maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
-        enableLookups="false" disableUploadTimeout="true"
-        acceptCount="100" scheme="https" secure="true"
-        clientAuth="false" sslProtocol="SSL"
-        sslOptions="ssl2=false,ssl3=true,tls=true"
-        ssl2Ciphers="-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL2_DES_64_CBC_WITH_MD5,-SSL2_DES_192_EDE3_CBC_WITH_MD5"
-        ssl3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        tls3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
-        serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
-        passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
-        passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
-        certdbDir="[PKI_INSTANCE_PATH]/alias"/>
-[PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT]
-
-    <!-- Note : To disable connection timeouts, set connectionTimeout value
-     to 0 -->
-	
-	<!-- Note : To use gzip compression you could set the following properties :
-	
-			   compression="on" 
-			   compressionMinSize="2048" 
-			   noCompressionUserAgents="gozilla, traviata" 
-			   compressableMimeType="text/html,text/xml"
-	-->
-
+    [PKI_UNSECURE_PORT_SERVER_COMMENT]
+    <Connector name="[PKI_UNSECURE_PORT_CONNECTOR_NAME]" port="[PKI_UNSECURE_PORT]" protocol="HTTP/1.1" redirectPort="8443" 
+	       maxHttpHeaderSize="8192"
+	       acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
+	       enableLookups="false" connectionTimeout="20000" disableUploadTimeout="true"
+	       />
+
+    <!-- Define a SSL HTTP/1.1 Connector on port 8443 -->
+    [PKI_SECURE_PORT_SERVER_COMMENT]
+    <!-- DO NOT REMOVE - Begin define PKI secure port -->
+    <Connector name="[PKI_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_SECURE_PORT]" protocol="HTTP/1.1" SSLEnabled="true" sslProtocol="SSL" scheme="https" secure="true"
+	       maxHttpHeaderSize="8192"
+	       acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
+	       enableLookups="false" connectionTimeout="20000" disableUploadTimeout="true"
+	       SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
+	       clientAuth="[PKI_AGENT_CLIENTAUTH]"
+	       sslOptions="[TOMCAT_SSL_OPTIONS]"
+	       ssl2Ciphers="[TOMCAT_SSL2_CIPHERS]"
+	       ssl3Ciphers="[TOMCAT_SSL3_CIPHERS]"
+	       tls3Ciphers="[TOMCAT_TLS3_CIPHERS]"
+	       serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
+	       passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
+	       passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
+	       certdbDir="[PKI_INSTANCE_PATH]/alias"
+	       />
+    <!-- DO NOT REMOVE - End define PKI secure port -->
+
+    [PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_ADMIN_SECURE_PORT_SERVER_COMMENT]
+    <Connector name="[PKI_ADMIN_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_ADMIN_SECURE_PORT]" SSLEnabled="true" sslProtocol="SSL" scheme="https" secure="true"
+	       maxHttpHeaderSize="8192"
+	       acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
+	       enableLookups="false" disableUploadTimeout="true"
+	       SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
+	       clientAuth="false"
+	       sslOptions="[TOMCAT_SSL_OPTIONS]"
+	       ssl2Ciphers="[TOMCAT_SSL2_CIPHERS]"
+	       ssl3Ciphers="[TOMCAT_SSL3_CIPHERS]"
+	       tls3Ciphers="[TOMCAT_TLS3_CIPHERS]"
+	       serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
+	       passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
+	       passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
+	       certdbDir="[PKI_INSTANCE_PATH]/alias"/>
+    [PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT]
+
+    [PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_EE_SECURE_PORT_SERVER_COMMENT]
+    <Connector name="[PKI_EE_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_EE_SECURE_PORT]" SSLEnabled="true" sslProtocol="SSL" scheme="https" secure="true"
+	       maxHttpHeaderSize="8192"
+	       acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
+	       enableLookups="false" connectionTimeout="20000" disableUploadTimeout="true"
+	       SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
+	       clientAuth="false"
+	       sslOptions="[TOMCAT_SSL_OPTIONS]"
+	       ssl2Ciphers="[TOMCAT_SSL2_CIPHERS]"
+	       ssl3Ciphers="[TOMCAT_SSL3_CIPHERS]"
+	       tls3Ciphers="[TOMCAT_TLS3_CIPHERS]"
+	       serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
+	       passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
+	       passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
+	       certdbDir="[PKI_INSTANCE_PATH]/alias"/>
+    [PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT]
+
+    <!-- A "Connector" using the shared thread pool-->
+    <!--
+    <Connector executor="tomcatThreadPool"
+               port="8080" protocol="HTTP/1.1" 
+               connectionTimeout="20000" 
+               redirectPort="8443" />
+    -->           
+    <!-- Define a SSL HTTP/1.1 Connector on port 8443
+         This connector uses the JSSE configuration, when using APR, the 
+         connector should be using the OpenSSL style configuration
+         described in the APR documentation -->
+    <!--
+    <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
+               maxThreads="150" scheme="https" secure="true"
+               clientAuth="false" sslProtocol="TLS" />
+    -->
 
     <!-- Define an AJP 1.3 Connector on port 8009 -->
 <!--
-    <Connector port="8009" 
-               enableLookups="false" redirectPort="8443" protocol="AJP/1.3" />
+    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
 -->
 
-    <!-- Define a Proxied HTTP/1.1 Connector on port 8082 -->
-    <!-- See proxy documentation for more information about using this. -->
-    <!--
-    <Connector port="8082" 
-               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
-               enableLookups="false" acceptCount="100" connectionTimeout="20000"
-               proxyPort="80" disableUploadTimeout="true" />
-    -->
 
     <!-- An Engine represents the entry point (within Catalina) that processes
          every request.  The Engine implementation for Tomcat stand alone
          analyzes the HTTP headers included with the request, and passes them
-         on to the appropriate Host (virtual host). -->
+         on to the appropriate Host (virtual host).
+         Documentation at /docs/config/engine.html -->
 
     <!-- You should set jvmRoute to support load-balancing via AJP ie :
-    <Engine name="Standalone" defaultHost="localhost" jvmRoute="jvm1">         
+    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">         
     --> 
-         
-    <!-- Define the top level container in our container hierarchy -->
     <Engine name="Catalina" defaultHost="localhost">
 
-      <!-- The request dumper valve dumps useful debugging information about
-           the request headers and cookies that were received, and the response
-           headers and cookies that were sent, for all requests received by
-           this instance of Tomcat.  If you care only about requests to a
-           particular virtual host, or a particular application, nest this
-           element inside the corresponding <Host> or <Context> entry instead.
-
-           For a similar mechanism that is portable to all Servlet 2.4
-           containers, check out the "RequestDumperFilter" Filter in the
-           example application (the source for this filter may be found in
-           "$CATALINA_HOME/webapps/examples/WEB-INF/classes/filters").
+      <!--For clustering, please take a look at documentation at:
+          /docs/cluster-howto.html  (simple how to)
+          /docs/config/cluster.html (reference documentation) -->
+      <!--
+      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
+      -->        
 
-           Request dumping is disabled by default.  Uncomment the following
-           element to enable it. -->
+      <!-- The request dumper valve dumps useful debugging information about
+           the request and response data received and sent by Tomcat.
+           Documentation at: /docs/config/valve.html -->
       <!--
       <Valve className="org.apache.catalina.valves.RequestDumperValve"/>
       -->
 
-      <!-- Because this Realm is here, an instance will be shared globally -->
-
       <!-- This Realm uses the UserDatabase configured in the global JNDI
            resources under the key "UserDatabase".  Any edits
            that are performed against this UserDatabase are immediately
@@ -210,229 +198,27 @@ Tomcat Port       = [TOMCAT_SERVER_PORT] (for shutdown)
       <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
              resourceName="UserDatabase"/>
 
-      <!-- Comment out the old realm but leave here for now in case we
-           need to go back quickly -->
-      <!--
-      <Realm className="org.apache.catalina.realm.MemoryRealm" />
-      -->
-
-      <!-- Replace the above Realm with one of the following to get a Realm
-           stored in a database and accessed via JDBC -->
-
-      <!--
-      <Realm  className="org.apache.catalina.realm.JDBCRealm"
-             driverName="org.gjt.mm.mysql.Driver"
-          connectionURL="jdbc:mysql://localhost/authority"
-         connectionName="test" connectionPassword="test"
-              userTable="users" userNameCol="user_name" userCredCol="user_pass"
-          userRoleTable="user_roles" roleNameCol="role_name" />
-      -->
-
-      <!--
-      <Realm  className="org.apache.catalina.realm.JDBCRealm"
-             driverName="oracle.jdbc.driver.OracleDriver"
-          connectionURL="jdbc:oracle:thin:@ntserver:1521:ORCL"
-         connectionName="scott" connectionPassword="tiger"
-              userTable="users" userNameCol="user_name" userCredCol="user_pass"
-          userRoleTable="user_roles" roleNameCol="role_name" />
-      -->
-
-      <!--
-      <Realm  className="org.apache.catalina.realm.JDBCRealm"
-             driverName="sun.jdbc.odbc.JdbcOdbcDriver"
-          connectionURL="jdbc:odbc:CATALINA"
-              userTable="users" userNameCol="user_name" userCredCol="user_pass"
-          userRoleTable="user_roles" roleNameCol="role_name" />
-      -->
-
       <!-- Define the default virtual host
            Note: XML Schema validation will not work with Xerces 2.2.
        -->
-      <Host name="localhost" appBase="webapps"
-       unpackWARs="true" autoDeploy="false" 
-       xmlValidation="false" xmlNamespaceAware="false">
-
-        <!-- Defines a cluster for this node,
-             By defining this element, means that every manager will be changed.
-             So when running a cluster, only make sure that you have webapps in there
-             that need to be clustered and remove the other ones.
-             A cluster has the following parameters:
-
-             className = the fully qualified name of the cluster class
-
-             name = a descriptive name for your cluster, can be anything
-
-             mcastAddr = the multicast address, has to be the same for all the nodes
-
-             mcastPort = the multicast port, has to be the same for all the nodes
-             
-             mcastBindAddr = bind the multicast socket to a specific address
-             
-             mcastTTL = the multicast TTL if you want to limit your broadcast
-             
-             mcastSoTimeout = the multicast readtimeout 
-
-             mcastFrequency = the number of milliseconds in between sending a "I'm alive" heartbeat
+      <Host name="localhost"  appBase="webapps"
+            unpackWARs="true" autoDeploy="false"
+            xmlValidation="false" xmlNamespaceAware="false">
 
-             mcastDropTime = the number a milliseconds before a node is considered "dead" if no heartbeat is received
-
-             tcpThreadCount = the number of threads to handle incoming replication requests, optimal would be the same amount of threads as nodes 
-
-             tcpListenAddress = the listen address (bind address) for TCP cluster request on this host, 
-                                in case of multiple ethernet cards.
-                                auto means that address becomes
-                                InetAddress.getLocalHost().getHostAddress()
-
-             tcpListenPort = the tcp listen port
-
-             tcpSelectorTimeout = the timeout (ms) for the Selector.select() method in case the OS
-                                  has a wakup bug in java.nio. Set to 0 for no timeout
-
-             printToScreen = true means that managers will also print to std.out
-
-             expireSessionsOnShutdown = true means that 
-
-             useDirtyFlag = true means that we only replicate a session after setAttribute,removeAttribute has been called.
-                            false means to replicate the session after each request.
-                            false means that replication would work for the following piece of code: (only for SimpleTcpReplicationManager)
-                            <%
-                            HashMap map = (HashMap)session.getAttribute("map");
-                            map.put("key","value");
-                            %>
-             replicationMode = can be either 'pooled', 'synchronous' or 'asynchronous'.
-                               * Pooled means that the replication happens using several sockets in a synchronous way. Ie, the data gets replicated, then the request return. This is the same as the 'synchronous' setting except it uses a pool of sockets, hence it is multithreaded. This is the fastest and safest configuration. To use this, also increase the nr of tcp threads that you have dealing with replication.
-                               * Synchronous means that the thread that executes the request, is also the
-                               thread the replicates the data to the other nodes, and will not return until all
-                               nodes have received the information.
-                               * Asynchronous means that there is a specific 'sender' thread for each cluster node,
-                               so the request thread will queue the replication request into a "smart" queue,
-                               and then return to the client.
-                               The "smart" queue is a queue where when a session is added to the queue, and the same session
-                               already exists in the queue from a previous request, that session will be replaced
-                               in the queue instead of replicating two requests. This almost never happens, unless there is a 
-                               large network delay.
-        -->             
-        <!--
-            When configuring for clustering, you also add in a valve to catch all the requests
-            coming in, at the end of the request, the session may or may not be replicated.
-            A session is replicated if and only if all the conditions are met:
-            1. useDirtyFlag is true or setAttribute or removeAttribute has been called AND
-            2. a session exists (has been created)
-            3. the request is not trapped by the "filter" attribute
-
-            The filter attribute is to filter out requests that could not modify the session,
-            hence we don't replicate the session after the end of this request.
-            The filter is negative, ie, anything you put in the filter, you mean to filter out,
-            ie, no replication will be done on requests that match one of the filters.
-            The filter attribute is delimited by ;, so you can't escape out ; even if you wanted to.
-
-            filter=".*\.gif;.*\.js;" means that we will not replicate the session after requests with the URI
-            ending with .gif and .js are intercepted.
-            
-            The deployer element can be used to deploy apps cluster wide.
-            Currently the deployment only deploys/undeploys to working members in the cluster
-            so no WARs are copied upons startup of a broken node.
-            The deployer watches a directory (watchDir) for WAR files when watchEnabled="true"
-            When a new war file is added the war gets deployed to the local instance,
-            and then deployed to the other instances in the cluster.
-            When a war file is deleted from the watchDir the war is undeployed locally 
-            and cluster wide
-        -->
-        
-        <!--
-        <Cluster className="org.apache.catalina.cluster.tcp.SimpleTcpCluster"
-                 managerClassName="org.apache.catalina.cluster.session.DeltaManager"
-                 expireSessionsOnShutdown="false"
-                 useDirtyFlag="true"
-                 notifyListenersOnReplication="true">
-
-            <Membership 
-                className="org.apache.catalina.cluster.mcast.McastService"
-                mcastAddr="228.0.0.4"
-                mcastPort="45564"
-                mcastFrequency="500"
-                mcastDropTime="3000"/>
-
-            <Receiver 
-                className="org.apache.catalina.cluster.tcp.ReplicationListener"
-                tcpListenAddress="auto"
-                tcpListenPort="4001"
-                tcpSelectorTimeout="100"
-                tcpThreadCount="6"/>
-
-            <Sender
-                className="org.apache.catalina.cluster.tcp.ReplicationTransmitter"
-                replicationMode="pooled"
-                ackTimeout="15000"/>
-
-            <Valve className="org.apache.catalina.cluster.tcp.ReplicationValve"
-                   filter=".*\.gif;.*\.js;.*\.jpg;.*\.png;.*\.htm;.*\.html;.*\.css;.*\.txt;"/>
-                   
-            <Deployer className="org.apache.catalina.cluster.deploy.FarmWarDeployer"
-                      tempDir="/tmp/war-temp/"
-                      deployDir="/tmp/war-deploy/"
-                      watchDir="/tmp/war-listen/"
-                      watchEnabled="false"/>
-        </Cluster>
-        -->        
-
-
-
-        <!-- Normally, users must authenticate themselves to each web app
-             individually.  Uncomment the following entry if you would like
-             a user to be authenticated the first time they encounter a
-             resource protected by a security constraint, and then have that
-             user identity maintained across *all* web applications contained
-             in this virtual host. -->
+        <!-- SingleSignOn valve, share authentication between web applications
+             Documentation at: /docs/config/valve.html -->
         <!--
         <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
         -->
 
-        <!-- Access log processes all requests for this virtual host.  By
-             default, log files are created in the "logs" directory relative to
-             $CATALINA_HOME.  If you wish, you can specify a different
-             directory with the "directory" attribute.  Specify either a relative
-             (to $CATALINA_HOME) or absolute path to the desired directory.
-        -->
-        <Valve className="org.apache.catalina.valves.AccessLogValve"
-                 directory="logs"  prefix="localhost_access_log." suffix=".txt"
-                 pattern="common" resolveHosts="false"/>
-
-        <!-- Access log processes all requests for this virtual host.  By
-             default, log files are created in the "logs" directory relative to
-             $CATALINA_HOME.  If you wish, you can specify a different
-             directory with the "directory" attribute.  Specify either a relative
-             (to $CATALINA_HOME) or absolute path to the desired directory.
-             This access log implementation is optimized for maximum performance,
-             but is hardcoded to support only the "common" and "combined" patterns.
-        -->
+        <!-- Access log processes all example.
+             Documentation at: /docs/config/valve.html -->
         <!--
-        <Valve className="org.apache.catalina.valves.FastCommonAccessLogValve"
-                 directory="logs"  prefix="localhost_access_log." suffix=".txt"
-                 pattern="common" resolveHosts="false"/>
+        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"  
+               prefix="localhost_access_log." suffix=".txt" pattern="common" resolveHosts="false"/>
         -->
-        <!-- Access log processes all requests for this virtual host.  By
-             default, log files are created in the "logs" directory relative to
-             $CATALINA_HOME.  If you wish, you can specify a different
-             directory with the "directory" attribute.  Specify either a relative
-             (to $CATALINA_HOME) or absolute path to the desired directory.
-             This access log implementation is optimized for maximum performance,
-             but is hardcoded to support only the "common" and "combined" patterns.
 
-             This valve use NIO direct Byte Buffer to asynchornously store the
-             log.
-        -->
-        <!--
-        <Valve className="org.apache.catalina.valves.ByteBufferAccessLogValve"
-                 directory="logs"  prefix="localhost_access_log." suffix=".txt"
-                 pattern="common" resolveHosts="false"/>
-        -->
-
-       <!--  <Context docBase="webapps" path="/webapps" reloadable="false"/> -->
       </Host>
-
     </Engine>
-
   </Service>
-
 </Server>
diff --git a/pki/base/ocsp/shared/conf/tomcat-users.xml b/pki/base/ocsp/shared/conf/tomcat-users.xml
index f986faed3..daa9260cc 100644
--- a/pki/base/ocsp/shared/conf/tomcat-users.xml
+++ b/pki/base/ocsp/shared/conf/tomcat-users.xml
@@ -1,17 +1,45 @@
 <?xml version='1.0' encoding='utf-8'?>
 <!-- BEGIN COPYRIGHT BLOCK
-     Copyright (C) 2006 Red Hat, Inc.
+     Copyright (C) 2006-2010 Red Hat, Inc.
      All rights reserved.
+     Modifications: configuration parameters
      END COPYRIGHT BLOCK -->
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+
+<!--
+  <role rolename="tomcat"/>
+  <role rolename="role1"/>
+  <user username="tomcat" password="tomcat" roles="tomcat"/>
+  <user username="both" password="tomcat" roles="tomcat,role1"/>
+  <user username="role1" password="tomcat" roles="role1"/>
+-->
+
+<!-- The host manager webapp is restricted to users with role "admin" -->
+<!--<user name="tomcat" password="password" roles="admin" />-->
+<!-- The manager webapp is restricted to users with role "manager" -->
+<!--<user name="tomcat" password="password" roles="manager" />-->
 <tomcat-users>
   <role rolename="pkiuser"/>
   <role rolename="tomcat"/>
-  <role rolename="role1"/>
   <role rolename="manager"/>
   <role rolename="admin"/>
+
   <user username="pkiuser" password="pkiuser" roles="pkiuser"/>
   <user username="tomcat" password="tomcat" roles="tomcat"/>
-  <user username="both" password="tomcat" roles="tomcat,role1"/>
-  <user username="role1" password="tomcat" roles="role1"/>
   <user username="admin" password="netscape" roles="admin,manager"/>
 </tomcat-users>
diff --git a/pki/base/ocsp/shared/conf/tomcat5.conf b/pki/base/ocsp/shared/conf/tomcat5.conf
deleted file mode 100644
index c17539431..000000000
--- a/pki/base/ocsp/shared/conf/tomcat5.conf
+++ /dev/null
@@ -1,81 +0,0 @@
-# --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2006 Red Hat, Inc.
-# All rights reserved.
-# --- END COPYRIGHT BLOCK ---
-#
-# tomcat5 service configuration file
-
-# Check to insure that this configuration file's associated PKI
-# subsystem currently resides on this system.
-PKI_SUBSYSTEM_TYPE=[PKI_SUBSYSTEM_TYPE]
-if [ ! -d /usr/share/pki/${PKI_SUBSYSTEM_TYPE} ] ; then
-	echo "This machine is missing the '${PKI_SUBSYSTEM_TYPE}' subsystem!"
-	exit 255
-fi
-
-# you could also override JAVA_HOME here
-# Where your java installation lives
-JAVA_HOME="/usr/lib/jvm/jre"
-
-# You can pass some parameters to java
-# here if you wish to
-#JAVA_OPTS="-Xminf0.1 -Xmaxf0.3"
-
-# Where your tomcat installation lives
-# That change from previous RPM where TOMCAT_HOME 
-# used to be /var/tomcat.
-# Now /var/tomcat will be the base for webapps only
-CATALINA_HOME="/usr/share/tomcat5"
-JASPER_HOME="/usr/share/tomcat5"
-CATALINA_TMPDIR="/usr/share/tomcat5/temp"
-JAVA_ENDORSED_DIRS="/usr/share/tomcat5/common/endorsed"
-
-# What user should run tomcat
-TOMCAT_USER="[PKI_USER]"
-TOMCAT_GROUP="[PKI_GROUP]"
-
-# You can change your tomcat locale here
-#LANG=en_US
-
-# Time to wait in seconds, while starting process
-STARTUP_WAIT=30
-
-# Time to wait in seconds, before killing process
-SHUTDOWN_WAIT=30
-
-
-# If you wish to further customize your tomcat environment,
-# put your own definitions here
-# (i.e. LD_LIBRARY_PATH for some jdbc drivers)
-# Just do not forget to export them :)
-
-OS=`uname -s`
-PLATFORM=""
-
-if [ $OS = "Linux" ]; then
-	PLATFORM=`uname -i`
-	if [ $PLATFORM = "i386" ]; then
-		# 32-bit Linux
-		LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib/dirsec:/usr/lib
-	elif [ $PLATFORM = "x86_64" ]; then
-		# 64-bit Linux
-		LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib64/dirsec:/usr/lib64:/usr/lib
-	fi
-	export LD_LIBRARY_PATH
-elif [ $OS = "SunOS" ]; then
-	PLATFORM=`uname -p`
-	if	[ "${PLATFORM}" = "sparc" ] &&
-		[ -d "/usr/lib/sparcv9/" ] ; then
-		PLATFORM="sparcv9"
-	fi
-	if [ $PLATFORM = "sparc" ]; then
-		# 32-bit Solaris
-		LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib/dirsec:/usr/lib
-	elif [ $PLATFORM = "sparcv9" ]; then
-		# 64-bit Solaris
-		JAVA_OPTS="-d64"
-		export JAVA_OPTS
-		LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib/sparcv9/dirsec:/usr/lib/sparcv9:/usr/lib/dirsec:/usr/lib
-	fi
-	export LD_LIBRARY_PATH
-fi
diff --git a/pki/base/ocsp/shared/conf/tomcat6.conf b/pki/base/ocsp/shared/conf/tomcat6.conf
new file mode 100644
index 000000000..31385567d
--- /dev/null
+++ b/pki/base/ocsp/shared/conf/tomcat6.conf
@@ -0,0 +1,55 @@
+# Service-specific configuration file for tomcat6. This will be sourced by
+# the SysV init script after the global configuration file
+# /etc/tomcat6/tomcat6.conf, thus allowing values to be overridden in
+# a per-service manner.
+#
+# NEVER change the init script itself. To change values for all services make
+# your changes in /etc/tomcat6/tomcat6.conf
+#
+# To change values for a specific service make your edits here.
+# To create a new service create a link from /etc/init.d/<your new service> to
+# /etc/init.d/tomcat6 (do not copy the init script) and make a copy of the
+# /etc/sysconfig/tomcat6 file to /etc/sysconfig/<your new service> and change
+# the property values so the two services won't conflict. Register the new
+# service in the system as usual (see chkconfig and similars).
+#
+
+# Where your java installation lives
+#JAVA_HOME="/usr/lib/jvm/java"
+
+# Where your tomcat installation lives
+CATALINA_BASE="[PKI_INSTANCE_PATH]"
+#CATALINA_HOME="/usr/share/tomcat6"
+#JASPER_HOME="/usr/share/tomcat6"
+#CATALINA_TMPDIR="/var/cache/tomcat6/temp"
+
+# You can pass some parameters to java here if you wish to
+#JAVA_OPTS="-Xminf0.1 -Xmaxf0.3"
+
+# Use JAVA_OPTS to set java.library.path for libtcnative.so
+#JAVA_OPTS="-Djava.library.path=/usr/lib64"
+
+# What user should run tomcat
+TOMCAT_USER="[PKI_USER]"
+
+# You can change your tomcat locale here
+#LANG="en_US"
+
+# Run tomcat under the Java Security Manager
+#SECURITY_MANAGER="false"
+
+# Time to wait in seconds, before killing process
+#SHUTDOWN_WAIT="30"
+
+# Whether to annoy the user with "attempting to shut down" messages or not
+#SHUTDOWN_VERBOSE="false"
+
+# Set the TOMCAT_PID location
+CATALINA_PID="[TOMCAT_PIDFILE]"
+
+# Connector port is 8080 for this tomcat6 instance
+#CONNECTOR_PORT="8080"
+
+# If you wish to further customize your tomcat environment,
+# put your own definitions here
+# (i.e. LD_LIBRARY_PATH for some jdbc drivers)
diff --git a/pki/base/ocsp/shared/etc/init.d/pki-ocspd b/pki/base/ocsp/shared/etc/init.d/pki-ocspd
index 70520dc30..34172a2af 100755
--- a/pki/base/ocsp/shared/etc/init.d/pki-ocspd
+++ b/pki/base/ocsp/shared/etc/init.d/pki-ocspd
@@ -14,1816 +14,70 @@
 # with this program; if not, write to the Free Software Foundation, Inc.,
 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
-# Copyright (C) 2007 Red Hat, Inc.
+# Copyright (C) 2007-2010 Red Hat, Inc.
 # All rights reserved.
-# --- END COPYRIGHT BLOCK ### ---
+# --- END COPYRIGHT BLOCK ---
 #
-# pki-ocspd  Startup script for Tomcat 5.0 pki-ocsp, the Apache Servlet Engine
+# pki-ocspd  Startup script for pki-ocsp with tomcat6
 #
 # chkconfig:    - 83 17
-# description:  Online Certificate Status Protocol Manager \
-#               (Tomcat 5.0)
+# description:  Online Certificate Status Protocol Manager (Tomcat 6.0)
 # processname:  pki-ocspd
 # piddir:       /var/run/pki/ocsp
-# config:       ${PKI_INSTANCE_PATH}/conf/tomcat5.conf
-#
-# Gomez Henri <hgomez@users.sourceforge.net>
-# Keith Irwin <keith_irwin@non.hp.com>
-# Nicolas Mailhot <nicolas.mailhot@one2team.com>
-#
-# version 1.02 - Removed initlog support
-# version 1.03 - Removed config:
-# version 1.04 - tomcat will start before httpd and stop after httpd
-# version 1.05 - jdk hardcoded to link /usr/java/jdk and tomcat runs
-#                as "nobody"
-# version 1.06 - split up into script and config file
-# version 1.07 - Rework from Nicolas ideas
-# version 1.08 - Fix work dir permission at start time, switch to use tomcat4
-# version 1.09 - Fix pidfile and config tags
-# version 1.10 - Fallback to su direct use on systems without
-#                Redhat/Mandrake init.d functions
-# version 1.11 - Fix webapps dir permissions
-# version 1.12 - remove initial start/stop level for chkconfig (- 80 20)
-# version 1.13 - remove chown of logs/work/temp/webapps dir,
-#                owned by tomcat4 at install time
-# version 1.14 - correct the start/stop ugly hack by waiting
-#                all the threads stops
-# version 1.15 - ensure we're looking for TOMCAT_USER running catalina
-# version 1.16 - Add support for CATALINA_PID env var
-# version 1.17 - Remove run files only tomcat started correctl
-#                in start area, check that tomcat is not allready running
-# version 1.18 - Fix kill typo (thanks Kaj J. Niemi)
-# version 1.19 - Add jar relinking
-# version 1.20 - Check there is no stalling tomcat4.pid
-# version 1.20tc5 - Changed all instances of tomcat4 to
-#                   tomcat5 except TOMCAT_USER
-# version 1.20tc5rh - Changed TOMCAT_USER from tomcat4 to tomcat
 #
 
-PKI_INIT_SCRIPT=""
+PROG_NAME=`basename $0`
+SERVICE_NAME="pki-ocspd"
+SERVICE_PROG="/sbin/service"
 PKI_PATH="/usr/share/pki/ocsp"
-PKI_PIDDIR="/var/run/pki/ocsp"
-PKI_PROCESS="pki-ocspd"
 PKI_REGISTRY="/etc/sysconfig/pki/ocsp"
 PKI_TYPE="pki-ocsp"
-
-# PKI subsystem-level directory and file values for locks
-lockfile="/var/lock/subsys/pki-ocspd"
+PKI_TOTAL_PORTS=6
 
 # Disallow 'others' the ability to 'write' to new files
 umask 00002
 
-default_error=0
 command="$1"
 pki_instance="$2"
-case "${command}" in
-	start|stop|restart|condrestart|force-restart|try-restart)
-		# * 1 generic or unspecified error (current practice)
-		default_error=1
-		;;
-	reload)
-		default_error=3
-		;;
-	status)
-		# * 4 program or service status is unknown
-		default_error=4
-		;;
-	*)
-		# * 2 invalid argument(s)
-		default_error=2
-		;;
-esac
-
-# Check to insure that this script's original invocation directory
-# has not been deleted!
-CWD=`/bin/pwd > /dev/null 2>&1`
-if [ $? -ne 0 ] ; then
-	echo "Cannot invoke '$0' from non-existent directory!"
-	exit ${default_error}
-fi
-
-# Check to insure that this script's associated PKI
-# subsystem currently resides on this system.
-if [ ! -d ${PKI_PATH} ] ; then
-	echo "This machine is missing the '${PKI_TYPE}' subsystem!"
-	if [ "${command}" != "status" ]; then
-		# * 5 program is not installed
-		exit 5
-	else
-		exit ${default_error}
-	fi
-fi
-
-# Check to insure that this script's associated PKI
-# subsystem instance registry currently resides on this system.
-if [ ! -d ${PKI_REGISTRY} ] ; then
-	echo "This machine contains no registered '${PKI_TYPE}' subsystem instances!"
-	if [ "${command}" != "status" ]; then
-		# * 5 program is not installed
-		exit 5
-	else
-		exit ${default_error}
-	fi
-fi
-
-# Obtain the operating system upon which this script is being executed
-OS=`uname -s`
-ARCHITECTURE=""
-
-# This script must be run as root!
-RV=0
-if [ ${OS} = "Linux" ] ; then
-	PKI_INIT_SCRIPT="/sbin/service ${PKI_PROCESS}"
-	if [ `id -u` -ne 0 ] ; then
-		echo "Must be 'root' to execute '$0'!"
-		if [ "${command}" != "status" ]; then
-			# * 4 user had insufficient privilege
-			exit 4
-		else
-			# * 4 program or service status is unknown
-			exit 4
-		fi
-	fi
-	ARCHITECTURE=`uname -i`
-elif [ ${OS} = "SunOS" ] ; then
-	PKI_INIT_SCRIPT="/etc/init.d/${PKI_PROCESS}"
-	if [ `/usr/xpg4/bin/id -u` -ne 0 ] ; then
-		echo "Must be 'root' to execute '$0'!"
-		if [ "${command}" != "status" ]; then
-			# * 4 user had insufficient privilege
-			exit 4
-		else
-			# * 4 program or service status is unknown
-			exit 4
-		fi
-	fi
-	ARCHITECTURE=`uname -p`
-	if	[ "${ARCHITECTURE}" = "sparc" ] &&
-		[ -d "/usr/lib/sparcv9/" ] ; then
-		ARCHITECTURE="sparcv9"
-	fi
-else
-	echo "Unsupported OS '${OS}'!"
-	exit ${default_error}
-fi
 
 # Source function library.
-if [ -f /etc/init.d/functions ]; then
-	. /etc/init.d/functions
-else
-	# The checkpid() function is provided for platforms that do not
-	# contain the "/etc/init.d/functions" file (e. g. - Solaris) . . .
-
-	# Check if ${pid} (could be plural) are running (keep count)
-	checkpid()
-	{
-		rv=0
-		for i in $* ; do
-			ps -p $i > /dev/null 2>&1 ;
-			if [ $? -ne 0 ] ; then
-				rv=`expr ${rv} + 1`
-			else
-				rv=`expr ${rv} + 0`
-			fi
-		done
-		# echo "rv=${rv}"
-		return ${rv}
-	}
-
-	# Create the following directories on platforms
-	# where they do not exist (e. g. - Solaris) . . .
-	if [ ! -d "/var/lock" ] ; then
-		mkdir -p /var/lock
-		chown root:sys /var/lock
-		chmod 00755 /var/lock
-	fi
-	if [ ! -d "/var/lock/subsys" ] ; then
-		mkdir -p /var/lock/subsys
-		chown root:root /var/lock/subsys
-		chmod 00755 /var/lock/subsys
-	fi
-
-	#######################################################################
-	## NOTE:  The following code needs to eventually be moved into the   ##
-	##        template used to create the                                ##
-	##        "${PKI_INSTANCE_PATH}/conf/tomcat5.conf" file!             ##
-	#######################################################################
-
-	if [ ${OS} = "SunOS" ] ; then
-		DEFAULT_SOLARIS_JAVA_HOME="/usr/jdk/instances/jdk1.5.0/jre"
-		DEFAULT_LINUX_JAVA_HOME="/usr/lib/jvm/jre"
-		DEFAULT_LINUX_JAVA_HOME_PATH=`dirname ${DEFAULT_LINUX_JAVA_HOME}`
-
-		# ensure that the Sun JRE 1.5.0 exists at the default location
-		if [ -d ${DEFAULT_SOLARIS_JAVA_HOME} ] ; then
-			# create the directory in which the symlink resides (if necessary)
-			if [ ! -d ${DEFAULT_LINUX_JAVA_HOME_PATH} ] ; then
-				mkdir -p ${DEFAULT_LINUX_JAVA_HOME_PATH}
-			fi
-			# create the actual symlink (if necessary)
-			if [ ! -h ${DEFAULT_LINUX_JAVA_HOME} ] ; then
-				ln -s ${DEFAULT_SOLARIS_JAVA_HOME} ${DEFAULT_LINUX_JAVA_HOME}
-			fi
-		else
-			# for now, simply exit with an appropriate error message
-			echo -n "The Solaris 1.5.0 JRE must be installed "
-			echo -n "at \"${DEFAULT_SOLARIS_JAVA_HOME}\"!"
-			echo
-			echo
-			exit ${default_error}
-		fi
-	fi
-fi
-
-PKI_REGISTRY_ENTRIES=""
-TOTAL_PKI_REGISTRY_ENTRIES=0
-TOTAL_UNCONFIGURED_PKI_ENTRIES=0
-
-# Gather ALL registered instances of this PKI subsystem type
-for FILE in `/bin/ls -1 ${PKI_REGISTRY}/* 2>/dev/null`; do
-	if [ -f "$FILE" ] ; then
-		inst=`echo "$FILE"`
-		PKI_REGISTRY_ENTRIES="${PKI_REGISTRY_ENTRIES} $inst"
-		TOTAL_PKI_REGISTRY_ENTRIES=`expr ${TOTAL_PKI_REGISTRY_ENTRIES} + 1`
-	fi
-done
-
-if [ -n "${pki_instance}" ]; then
-	for I in ${PKI_REGISTRY_ENTRIES}; do
-		if [ "${PKI_REGISTRY}/${pki_instance}" = "$I" ]; then
-			PKI_REGISTRY_ENTRIES="${PKI_REGISTRY}/${pki_instance}"
-			TOTAL_PKI_REGISTRY_ENTRIES=1
-			break
-		fi
-	done
-fi
-
-usage()
-{
-	echo -n "Usage: ${PKI_INIT_SCRIPT} "
-	echo -n "{start"
-	echo -n "|stop"
-	echo -n "|restart"
-	echo -n "|condrestart"
-	echo -n "|force-restart"
-	echo -n "|try-restart"
-	echo -n "|reload"
-	echo -n "|status} "
-	echo -n "[instance-name]"
-	echo
-	echo
-}
-
-list_instances()
-{
-	echo
-	for FILE in `/bin/ls -1 ${PKI_REGISTRY}/* 2>/dev/null`; do
-		echo "    ${FILE}"
-	done
-	echo
-}
-
-# Check arguments
-if [ $# -lt 1 ] ; then
-	# * 3 unimplemented feature (for example, "reload")
-	#     [insufficient arguments]
-	echo "$0:  Insufficient arguments!"
-	echo
-	usage
-	echo "where valid instance names include:"
-	list_instances
-	exit 3
-elif [ ${default_error} -eq 2 ] ; then
-	# * 2 invalid argument
-	echo "$0:  Invalid arguments!"
-	echo
-	usage
-	echo "where valid instance names include:"
-	list_instances
-	exit 2
-elif [ $# -gt 2 ] ; then
-	echo "$0:  Excess arguments!"
-	echo
-	usage
-	echo "where valid instance names include:"
-	list_instances
-	if [ "${command}" != "status" ]; then
-		# * 2 excess arguments
-		exit 2
-	else
-		# * 4 program or service status is unknown
-		exit 4
-	fi
-fi
-
-# If an "instance" was supplied, check that it is a "valid" instance
-if [ -n "${pki_instance}" ]; then
-	if [ "${PKI_REGISTRY}/${pki_instance}" != "${PKI_REGISTRY_ENTRIES}" ]; then
-		echo -n "${pki_instance} is an invalid '${PKI_TYPE}' instance"
-		echo_failure
-		echo
-		if [ "${command}" != "status" ]; then
-			# * 5 program is not installed
-			exit 5
-		else
-			# * 4 program or service status is unknown
-			exit 4
-		fi
-	fi
-fi
-
-# On Solaris /var/run is in tmpfs and gets wiped out upon reboot
-# we have to recreate the ${PKI_PIDDIR} directory and make sure that
-# the directory is writable by the ${PKI_TYPE} server process.
-#
-# IMPORTANT:  ALL PKI subsystems installed on this machine MUST utilize
-#             the SAME values for ${PKI_GROUP} and ${PKI_USER}, since the
-#             "${PKI_PIDDIR}" will end up with the ownership permissions
-#             of the first instance that executes this function!
-#
-fix_pid_dir_ownership()
-{
-	if [ ! -d ${PKI_PIDDIR} ] ; then
-		mkdir -p ${PKI_PIDDIR}
-
-		chown root:root /var/run/pki
-		chmod 00755 /var/run/pki
-
-		chown root:root ${PKI_PIDDIR}
-		chmod 00755 ${PKI_PIDDIR}
-	fi
-}
-
-check_pki_configuration_status()
-{
-	rv=0
-
-	rv=`grep -c ^preop ${pki_instance_configuration_file}`
-
-	rv=`expr ${rv} + 0`
-
-	if [ ${rv} -ne 0 ] ; then
-		echo "    '${PKI_INSTANCE_ID}' must still be CONFIGURED!"
-		echo "    (see /var/log/${PKI_INSTANCE_ID}-install.log)"
-		if [ "${command}" != "status" ]; then
-			# * 6 program is not configured
-			rv=6
-		else
-			# * 4 program or service status is unknown
-			rv=4
-		fi
-		TOTAL_UNCONFIGURED_PKI_ENTRIES=`expr ${TOTAL_UNCONFIGURED_PKI_ENTRIES} + 1`
-	elif [ -f ${RESTART_SERVER} ] ; then
-		echo -n "    Although '${PKI_INSTANCE_ID}' has been CONFIGURED, "
-		echo -n "it must still be RESTARTED!"
-		echo
-		if [ "${command}" != "status" ]; then
-			# * 1 generic or unspecified error (current practice)
-			rv=1
-		else
-			# * 4 program or service status is unknown
-			rv=4
-		fi
-	fi
-
-	return ${rv}
-}
-
-get_pki_status_definitions()
-{
-	# establish well-known strings
-	begin_pki_status_comment="<!-- DO NOT REMOVE - Begin PKI Status Definitions -->"
-	end_pki_status_comment="<!-- DO NOT REMOVE - End PKI Status Definitions -->"
-	total_ports=0
-	unsecure_port_statement="Unsecure Port     = "
-	secure_agent_port_statement="Secure Agent Port = "
-	secure_ee_port_statement="Secure EE Port    = "
-	secure_admin_port_statement="Secure Admin Port = "
-	pki_console_port_statement="PKI Console Port  = "
-	tomcat_port_statement="Tomcat Port       = "
-
-	# initialize looping variables
-	pki_status_comment_found=0
-
-	# first check to see that an instance-specific "server.xml" file exists
-	if [ ! -f ${PKI_SERVER_XML_CONF} ] ; then
-		echo "File '${PKI_SERVER_XML_CONF}' does not exist!"
-		exit ${default_error}
-	fi
-
-	# read this instance-specific "server.xml" file line-by-line
-	# to obtain the current PKI Status Definitions
-	exec < ${PKI_SERVER_XML_CONF}
-	while read line; do
-		# first look for the well-known end PKI Status comment
-		# (to turn off processing)
-		if [ "$line" == "$end_pki_status_comment" ] ; then
-			pki_status_comment_found=0
-			break;
-		fi
-
-		# then look for the well-known begin PKI Status comment
-		# (to turn on processing)
-		if [ "$line" == "$begin_pki_status_comment" ] ; then
-			pki_status_comment_found=1
-		fi
-
-		# once the well-known begin PKI Status comment has been found,
-		# begin processing to obtain all of the PKI Status Definitions
-		if [ $pki_status_comment_found -eq 1 ] ; then
-			# look for a PKI Status Definition and print it
-			head=`echo "$line" | cut -b1-20`
-			if	[ "$head" == "$unsecure_port_statement"     ] ||
-				[ "$head" == "$secure_agent_port_statement" ] ||
-				[ "$head" == "$secure_ee_port_statement"    ] ||
-				[ "$head" == "$secure_admin_port_statement" ] ||
-				[ "$head" == "$pki_console_port_statement"  ] ||
-				[ "$head" == "$tomcat_port_statement"       ] ; then
-				echo "    $line"
-				total_ports=`expr ${total_ports} + 1`
-			fi
-		fi
-	done
-
-	if [ ${total_ports} -eq 6 ] ; then
-		return 0
-	else
-		return ${default_error}
-	fi
-}
-
-get_pki_configuration_definitions()
-{
-	# Obtain the PKI Subsystem Type
-	line=`grep ^cs.type= ${pki_instance_configuration_file}`
-	pki_subsystem=`echo "${line}" | cut -b9-`
-	if [ "${line}" != "" ] ; then
-		if	[ "${pki_subsystem}" != "CA"   ]  &&
-			[ "${pki_subsystem}" != "KRA"  ]  &&
-			[ "${pki_subsystem}" != "OCSP" ]  &&
-			[ "${pki_subsystem}" != "TKS"  ]  &&
-			[ "${pki_subsystem}" != "RA"   ]  &&
-			[ "${pki_subsystem}" != "TPS"  ]
-		then
-			return ${default_error}
-		fi
-		if	[ "${pki_subsystem}" == "KRA"   ] ; then
-			# Rename "KRA" to "DRM"
-			pki_subsystem="DRM"
-		fi
-	else
-		return ${default_error}
-	fi
-
-	# If "${pki_subsystem}" is a CA, DRM, OCSP, or TKS,
-	# check to see if "${pki_subsystem}" is a "Clone"
-	pki_clone=""
-	if	[ "${pki_subsystem}" == "CA"   ]  ||
-		[ "${pki_subsystem}" == "DRM"  ]  ||
-		[ "${pki_subsystem}" == "OCSP" ]  ||
-		[ "${pki_subsystem}" == "TKS"  ]
-	then
-		line=`grep ^subsystem.select= ${pki_instance_configuration_file}`
-		if [ "${line}" != "" ] ; then
-			pki_clone=`echo "${line}" | cut -b18-`
-			if [ "${pki_clone}" != "Clone" ] ; then
-				# Reset "${pki_clone}" to be empty
-				pki_clone=""
-			fi
-		else
-			return ${default_error}
-		fi
-	fi
-
-	# If "${pki_subsystem}" is a CA, and is NOT a "Clone", check to
-	# see "${pki_subsystem}" is a "Root" or a "Subordinate" CA
-	pki_hierarchy=""
-	if	[ "${pki_subsystem}" == "CA" ]  &&
-		[ "${pki_clone}" != "Clone"  ]
-	then
-		line=`grep ^hierarchy.select= ${pki_instance_configuration_file}`
-		if [ "${line}" != "" ] ; then
-			pki_hierarchy=`echo "${line}" | cut -b18-`
-		else
-			return ${default_error}
-		fi
-	fi
-
-	# If ${pki_subsystem} is a CA, check to
-	# see if it is also a Security Domain
-	pki_security_domain=""
-	if	[ "${pki_subsystem}" == "CA" ] ; then
-		line=`grep ^securitydomain.select= ${pki_instance_configuration_file}`
-		if [ "${line}" != "" ] ; then
-			pki_security_domain=`echo "${line}" | cut -b23-`
-			if [ "${pki_security_domain}" == "new" ] ; then
-				# Set a fixed value for "${pki_security_domain}"
-				pki_security_domain="(Security Domain)"
-			else
-				# Reset "${pki_security_domain}" to be empty
-				pki_security_domain=""
-			fi
-		else
-			return ${default_error}
-		fi
-	fi
-
-	# Always obtain this PKI instance's "registered"
-	# security domain information
-	pki_security_domain_name=""
-	pki_security_domain_hostname=""
-	pki_security_domain_https_admin_port=""
-
-	line=`grep ^securitydomain.name= ${pki_instance_configuration_file}`
-	if [ "${line}" != "" ] ; then
-		pki_security_domain_name=`echo "${line}" | cut -b21-`
-	else
-		return ${default_error}
-	fi
-
-	line=`grep ^securitydomain.host= ${pki_instance_configuration_file}`
-	if [ "${line}" != "" ] ; then
-		pki_security_domain_hostname=`echo "${line}" | cut -b21-`
-	else
-		return ${default_error}
-	fi
-
-	line=`grep ^securitydomain.httpsadminport= ${pki_instance_configuration_file}`
-	if [ "${line}" != "" ] ; then
-		pki_security_domain_https_admin_port=`echo "${line}" | cut -b31-`
-	else
-		return ${default_error}
-	fi
-
-	# Compose the "PKI Instance Name" Status Line
-	pki_instance_name="PKI Instance Name:   ${PKI_INSTANCE_ID}"
-
-	# Compose the "PKI Subsystem Type" Status Line
-	header="PKI Subsystem Type: "
-	if   [ "${pki_clone}" != "" ] ; then
-		if [ "${pki_security_domain}" != "" ]; then
-			# Possible Values:
-			#
-			#     "CA Clone (Security Domain)"
-			#
-			data="${pki_subsystem} ${pki_clone} ${pki_security_domain}"
-		else
-			# Possible Values:
-			#
-			#     "CA Clone"
-			#     "DRM Clone"
-			#     "OCSP Clone"
-			#     "TKS Clone"
-			#
-			data="${pki_subsystem} ${pki_clone}"
-		fi
-	elif [ "${pki_hierarchy}" != "" ] ; then
-		if [ "${pki_security_domain}" != "" ]; then
-			# Possible Values:
-			#
-			#     "Root CA (Security Domain)"
-			#     "Subordinate CA (Security Domain)"
-			#
-			data="${pki_hierarchy} ${pki_subsystem} ${pki_security_domain}"
-		else
-			# Possible Values:
-			#
-			#     "Root CA"
-			#     "Subordinate CA"
-			#
-			data="${pki_hierarchy} ${pki_subsystem}"
-		fi
-	else
-		# Possible Values:
-		#
-		#     "DRM"
-		#     "OCSP"
-		#     "RA"
-		#     "TKS"
-		#     "TPS"
-		#
-		data="${pki_subsystem}"
-	fi
-	pki_subsystem_type="${header} ${data}"
-
-	# Compose the "Registered PKI Security Domain Information" Status Line
-	header="Name: "
-	registered_pki_security_domain_name="${header} ${pki_security_domain_name}"
-
-	header="URL:  "
-	if	[ "${pki_security_domain_hostname}" != ""         ] &&
-		[ "${pki_security_domain_https_admin_port}" != "" ]
-	then
-		data="https://${pki_security_domain_hostname}:${pki_security_domain_https_admin_port}"
-	else
-		return ${default_error}
-	fi
-	registered_pki_security_domain_url="${header} ${data}"
-
-	# Print the "PKI Subsystem Type" Status Line
-	echo
-	echo "    ${pki_instance_name}"
-
-	# Print the "PKI Subsystem Type" Status Line
-	echo
-	echo "    ${pki_subsystem_type}"
-
-	# Print the "Registered PKI Security Domain Information" Status Line
-	echo
-	echo "    Registered PKI Security Domain Information:"
-	echo "    =========================================================================="
-	echo "    ${registered_pki_security_domain_name}"
-	echo "    ${registered_pki_security_domain_url}"
-	echo "    =========================================================================="
-
-	return 0
-}
-
-get_pki_secure_port()
-{
-	# establish well-known strings
-	begin_ssl_comment="<!-- DO NOT REMOVE - Begin define PKI secure port -->"
-	end_ssl_comment="<!-- DO NOT REMOVE - End define PKI secure port -->"
-	connector_statement="<Connector name=\""
-
-	# initialize looping variables
-	ssl_comment_found=0
-
-	# first check to see that an instance-specific "server.xml" file exists
-	if [ ! -f ${PKI_SERVER_XML_CONF} ] ; then
-		echo "File '${PKI_SERVER_XML_CONF}' does not exist!"
-		exit ${default_error}
-	fi
-
-	# read this instance-specific "server.xml" file line-by-line
-	# to obtain the current value of the PKI secure port
-	exec < ${PKI_SERVER_XML_CONF}
-	while read line; do
-		# first look for the well-known end SSL comment
-		# (to turn off processing)
-		if [ "$line" == "$end_ssl_comment" ] ; then
-			ssl_comment_found=0
-		fi
-
-		# then look for the well-known begin SSL comment
-		# (to turn on processing)
-		if [ "$line" == "$begin_ssl_comment" ] ; then
-			ssl_comment_found=1
-		fi
-
-		# once the well-known begin SSL comment has been found,
-		# begin processing to obtain the numeric port information
-		if [ $ssl_comment_found -eq 1 ] ; then
-			# look for the next Connector statement
-			head=`echo $line | cut -b1-17`
-			if [ "$head" == "$connector_statement" ] ; then
-				# once the Connector statement has been found,
-				tail=`echo $line | cut -b18-`
-				# extract the name of the connector
-				name=`echo $tail | cut -d\" -f1`
-				if	[ "$name" == "Agent"  ] ||
-					[ "$name" == "Secure" ] ; then
-					# extract the numeric port information
-					port=`echo $tail | cut -d\" -f3`
-					PKI_SECURE_PORT=$port
-					return 0
-				fi
-			fi
-		fi
-	done
-
-	return ${default_error}
-}
-
-display_instance_status()
-{
-	rv=0
-
-	if [ -f ${pidfile} ] ; then
-		pid=`cat ${pidfile}`
-		if [ "${pid}" == "" ] ; then
-			echo "${PKI_INSTANCE_ID} pid file exists but is empty"
-			if [ "${command}" != "status" ]; then
-				# * 1 generic or unspecified error (current practice)
-				rv=1
-			else
-				# * 4 program or service status is unknown
-				rv=4
-			fi
-		elif kill -0 ${pid} > /dev/null 2>&1 ; then
-			echo "${PKI_INSTANCE_ID} (pid ${pid}) is running ..."
-			echo
-			check_pki_configuration_status
-			rv=$?
-			if [ ${rv} -eq 0 ] ; then
-				get_pki_status_definitions
-				rv=$?
-				if [ ${rv} -ne 0 ] ; then
-					echo
-					echo "${PKI_INSTANCE_ID} Status Definitions not found"
-				else
-					get_pki_configuration_definitions
-					rv=$?
-					if [ ${rv} -ne 0 ] ; then
-						echo
-						echo "${PKI_INSTANCE_ID} Configuration Definitions not found"
-					fi
-				fi
-			else
-				# From the PKI point of view for a "non-status" action,
-				# a returned error code of "6" implies that the program
-				# is not "configured".  Similarly, an error code of "1"
-				# implies that the program was "configured" but must
-				# still be restarted.
-				#
-				# Similarly, from the PKI point of view for a "status"
-				# action, a returned error code of "4" implies that either
-				# the program is not "configured", or that the program
-				# was "configured" but must still be restarted.
-				#
-				# Regardless, it must still be considered that the instance
-				# is "running" from the viewpoint of other OS programs such
-				# as 'chkconfig'.
-				#
-				# For this reason, when returning from
-				# 'display_instance_status()', ignore non-zero return codes
-				# returned from 'check_pki_configuration_status()'.
-				#
-				if [ "${command}" != "status" ]; then
-					# * 0 action was successful
-					rv=0
-				else
-					# * 0 program is running or service is OK
-					rv=0
-				fi
-			fi
-			echo
-		else
-			echo "${PKI_INSTANCE_ID} is dead but pid file exists"
-			if [ "${command}" != "status" ]; then
-				# * 1 generic or unspecified error (current practice)
-				rv=1
-			else
-				# * 1 program is dead and /var/run pid file exists
-				rv=1
-			fi
-		fi
-	else
-		echo "${PKI_INSTANCE_ID} is stopped"
-		if [ "${command}" != "status" ]; then
-			# * 7 program is not running
-			rv=7
-		else
-			# * 3 program is not running
-			rv=3
-		fi
-	fi
-
-	return ${rv}
-}
-
-start_instance()
-{
-	rv=0
-
-	echo -n "Starting $TOMCAT_PROG: "
-
-	if [ -f ${RESTART_SERVER} ] ; then
-		rm -f ${RESTART_SERVER}
-	fi
-
-	if [ -f ${PKI_LOCKFILE} ] ; then
-		if [ -f ${pidfile} ]; then
-			read kpid < ${pidfile}
-			if checkpid $kpid 2>&1; then
-				echo
-				echo "${PKI_INSTANCE_ID} (pid ${kpid}) is already running ..."
-				echo
-				check_pki_configuration_status
-				rv=$?
-				if [ ${rv} != 0 ]; then
-					# From the PKI point of view for a "non-status" action,
-					# a returned error code of "6" implies that the program
-					# is not "configured".  Similarly, an error code of "1"
-					# implies that the program was "configured" but must
-					# still be restarted.
-					#
-					# Regardless, it must still be considered that the instance
-					# is "running" from the viewpoint of other OS programs such
-					# as 'chkconfig'.
-					#
-					# For "non-status" actions, ignore return codes of "1"
-					# from 'check_pki_configuration_status()'.
-					#
-					# However, for "non-status" actions that have a return
-					# code of "6", return this value unchanged to
-					# the calling routine so that the total number of
-					# configuration errors may be counted.
-					#
-
-					echo
-					if [ ${rv} = 1 ] ; then
-						# * 0 action was successful
-						return 0
-					elif [ ${rv} = 6 ] ; then
-						# * 6 program is not configured
-						return 6
-					else
-						# should never be reached
-						return ${rv}
-					fi
-				else
-					return 0
-				fi
-			else
-				echo
-				echo -n "lock file found but no process "
-				echo -n "running for pid $kpid, continuing"
-				echo
-				echo
-				rm -f ${PKI_LOCKFILE}
-			fi
-		fi
-	fi
-
-	fix_pid_dir_ownership
-
-	CATALINA_PID=${pidfile}
-	export CATALINA_PID
-	touch $CATALINA_PID
-	chown $TOMCAT_USER:$TOMCAT_GROUP $CATALINA_PID
-	chmod 00600 $CATALINA_PID
-	[ -x /sbin/restorecon ] && /sbin/restorecon  $CATALINA_PID
-
-	# restore context for ncipher hsm
-	[ -x /sbin/restorecon ] && [ -d /dev/nfast ] && /sbin/restorecon -R /dev/nfast
-
-	# Always initialize CLASSPATH to start looking
-	# in the local PKI classes directory . . .
-	CLASSPATH=/usr/share/pki/classes
-
-	if [ ${OS} = "Linux" ] ; then
-		$TOMCAT_RELINK_SCRIPT
-	elif [ ${OS} = "SunOS" ] ; then
-		# The following definitions are provided for Solaris
-		# platforms since they are unable to execute the
-		# "/usr/share/tomcat5/bin/relink",
-		# "/usr/bin/rebuild-jar-repository", and
-		# "/usr/share/java-utils/java-functions" files . . .
-
-		#######################################
-		##    /var/lib/tomcat5/common/lib:
-		#######################################
-
-		# Build the tomcat jar classpath . . .
-		CLASSPATH="$CLASSPATH":/usr/share/java/ant.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-collections.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-dbcp.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-el.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-logging-api.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-pool.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-ejb-2.1.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2ee-1.4.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2ee-connector-1.5.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2ee-deployment-1.1.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2ee-jacc-1.0.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2ee-management-1.0.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2eeschema-1.0.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-jms-1.1.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-jsp-2.0.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-jta-1.0.1B.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-servlet-2.4.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/jaf.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/jakarta-commons-collections.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/jakarta-commons-modeler.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/jasper5-compiler.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/jasper5-runtime.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/imap.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/mailapi.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/nntp.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/pop3.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/providers.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/smtp.jar
-
-		# BEGIN LINUX-SPECIFIC FILE
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jdtCompilerAdapter.jar
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jdtcore.jar
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jsp.jar
-		# END LINUX-SPECIFIC FILE
-
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-impl.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-jmx.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-remote.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-rimpl.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-rjmx.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-tools.jar
-
-		# BEGIN LINUX-SPECIFIC FILE
-		# CLASSPATH="$CLASSPATH":/usr/share/java/servlet.jar
-		# END LINUX-SPECIFIC FILE
-
-		CLASSPATH="$CLASSPATH":/usr/share/java/avalon-logkit.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/cmsutil.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-logging.jar
-		if [ "$ARCHITECTURE" = "sparc" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/java/dirsec/jss4.jar
-		elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/sparcv9/java/dirsec/jss4.jar
-		fi
-		CLASSPATH="$CLASSPATH":/usr/share/java/ldapjdk.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/common/lib/naming-factory.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/common/lib/naming-resources.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/nsutil.jar
-		if [ "$ARCHITECTURE" = "sparc" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/java/osutil.jar
-		elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/sparcv9/java/osutil.jar
-		fi
-		CLASSPATH="$CLASSPATH":/usr/share/java/rhino.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/servletapi5.jar
-		if [ "$ARCHITECTURE" = "sparc" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/java/symkey.jar
-		elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/sparcv9/java/symkey.jar
-		fi
-		CLASSPATH="$CLASSPATH":/usr/share/java/velocity.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/xalan-j2.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/xerces-j2.jar
-
-		# Relink tomcat jar repositories . . .
-		cd /var/lib/tomcat5/common/lib
-
-		if [ ! -e /var/lib/tomcat5/common/lib/\[ant\].jar ]; then
-			ln -s /usr/share/java/ant.jar [ant].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[commons\-collections\].jar ]; then
-			ln -s /usr/share/java/commons-collections.jar [commons-collections].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[commons\-dbcp\].jar ]; then
-			ln -s /usr/share/java/commons-dbcp.jar [commons-dbcp].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[commons\-el\].jar ]; then
-			ln -s /usr/share/java/commons-el.jar [commons-el].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[commons\-logging-api\].jar ]; then
-			ln -s /usr/share/java/commons-logging-api.jar [commons-logging-api].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[commons\-pool\].jar ]; then
-			ln -s /usr/share/java/commons-pool.jar [commons-pool].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-ejb\-2.1\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-ejb-2.1-rc2.jar [geronimo]spec-ejb-2.1-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-ejb\-2.1.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-ejb-2.1.jar [geronimo]spec-ejb-2.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-1.4\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-1.4-rc2.jar [geronimo]spec-j2ee-1.4-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-1.4.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-1.4.jar [geronimo]spec-j2ee-1.4.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-connector\-1.5\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-connector-1.5-rc2.jar [geronimo]spec-j2ee-connector-1.5-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-connector\-1.5.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-connector-1.5.jar [geronimo]spec-j2ee-connector-1.5.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-deployment\-1.1\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-deployment-1.1-rc2.jar [geronimo]spec-j2ee-deployment-1.1-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-deployment\-1.1.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-deployment-1.1.jar [geronimo]spec-j2ee-deployment-1.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-jacc\-1.0\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-jacc-1.0-rc2.jar [geronimo]spec-j2ee-jacc-1.0-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-jacc\-1.0.jar ]; then
-			ln -s  /usr/share/java/geronimo/spec-j2ee-jacc-1.0.jar [geronimo]spec-j2ee-jacc-1.0.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-management\-1.0\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-management-1.0-rc2.jar [geronimo]spec-j2ee-management-1.0-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-management\-1.0.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-management-1.0.jar [geronimo]spec-j2ee-management-1.0.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2eeschema\-1.0\-M2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2eeschema-1.0-M2.jar [geronimo]spec-j2eeschema-1.0-M2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2eeschema\-1.0.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2eeschema-1.0.jar [geronimo]spec-j2eeschema-1.0.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-jms\-1.1\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jms-1.1-rc2.jar [geronimo]spec-jms-1.1-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-jms\-1.1.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jms-1.1.jar [geronimo]spec-jms-1.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-jsp\-2.0\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jsp-2.0-rc2.jar [geronimo]spec-jsp-2.0-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-jsp\-2.0.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jsp-2.0.jar [geronimo]spec-jsp-2.0.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec-jta-1.0.1B-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jta-1.0.1B-rc2.jar [geronimo]spec-jta-1.0.1B-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-jta\-1.0.1B.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jta-1.0.1B.jar [geronimo]spec-jta-1.0.1B.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-servlet\-2.4\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-servlet-2.4-rc2.jar [geronimo]spec-servlet-2.4-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-servlet\-2.4.jar ]; then
-			ln -s  /usr/share/java/geronimo/spec-servlet-2.4.jar [geronimo]spec-servlet-2.4.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[jaf\].jar ]; then
-			ln -s /usr/share/java/jaf.jar [jaf].jar
-		fi
-
-		### BEGIN SOLARIS-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jakarta\-commons\-collections.jar\] ]; then
-		###     ln -s /usr/share/java/jakarta-commons-collections.jar [jakarta-commons-collections.jar]
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jakarta\-commons\-modeler.jar\] ]; then
-		###     ln -s /usr/share/java/jakarta-commons-modeler.jar [jakarta-commons-modeler.jar]
-		### fi
-		### END SOLARIS-SPECIFIC LINKS
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jasper5\-compiler\].jar ]; then
-		###     ln -s /usr/share/java/jasper5-compiler.jar [jasper5-compiler].jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jasper5\-runtime\].jar ]; then
-		###     ln -s /usr/share/java/jasper5-runtime.jar [jasper5-runtime].jar
-		### fi
-
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]imap\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/imap-1.3.1.jar [javamail]imap-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]imap.jar ]; then
-			ln -s /usr/share/java/javamail/imap.jar [javamail]imap.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]mailapi\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/mailapi-1.3.1.jar [javamail]mailapi-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]mailapi.jar ]; then
-			ln -s /usr/share/java/javamail/mailapi.jar [javamail]mailapi.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]nntp\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/nntp-1.3.1.jar [javamail]nntp-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]nntp.jar ]; then
-			ln -s /usr/share/java/javamail/nntp.jar [javamail]nntp.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]pop3\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/pop3-1.3.1.jar [javamail]pop3-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]pop3.jar ]; then
-			ln -s /usr/share/java/javamail/pop3.jar [javamail]pop3.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]providers\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/providers-1.3.1.jar [javamail]providers-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]providers.jar ]; then
-			ln -s /usr/share/java/javamail/providers.jar [javamail]providers.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]smtp\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/smtp-1.3.1.jar [javamail]smtp-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]smtp.jar ]; then
-			ln -s /usr/share/java/javamail/smtp.jar [javamail]smtp.jar
-		fi
-
-		### BEGIN LINUX-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jdtCompilerAdapter\].jar ]; then
-		###     ln -s /usr/share/java/jdtCompilerAdapter.jar [jdtCompilerAdapter].jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jdtcore\].jar ]; then
-		###     ln -s /usr/share/java/jdtcore.jar [jdtcore].jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jsp\].jar ]; then
-		###     ln -s /usr/share/java/jsp.jar [jsp].jar
-		### fi
-		### END LINUX-SPECIFIC LINKS
-
-		if [ ! -e /var/lib/tomcat5/common/lib/\[mx4j\]\[mx4j\].jar ]; then
-			ln -s /usr/share/java/mx4j/mx4j.jar [mx4j][mx4j].jar
-		fi
-
-		### BEGIN LINUX-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[servlet\].jar ]; then
-		###     ln -s /usr/share/java/servlet.jar [servlet].jar
-		### fi
-		### END LINUX-SPECIFIC LINKS
-
-		### BEGIN LINUX-SPECIFIC FILE BUT SOLARIS-SPECIFIC LINK
-		if [ ! -e /var/lib/tomcat5/common/lib/avalon\-logkit.jar ]; then
-			ln -s /usr/share/java/avalon-logkit.jar avalon-logkit.jar
-		fi
-		### END LINUX-SPECIFIC FILE BUT SOLARIS-SPECIFIC LINK
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/cmsutil.jar ]; then
-		###     ln -s /usr/share/java/rphki/cmsutil.jar cmsutil.jar
-		### fi
-
-		### BEGIN LINUX-SPECIFIC FILE BUT SOLARIS-SPECIFIC LINK
-		if [ ! -e /var/lib/tomcat5/common/lib/commons\-logging.jar ]; then
-			ln -s /usr/share/java/commons-logging.jar commons-logging.jar
-		fi
-		### END LINUX-SPECIFIC FILE BUT SOLARIS-SPECIFIC LINK
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/jss4.jar ]; then
-		###     if [ "$ARCHITECTURE" = "sparc" ] ; then
-		###         ln -s /usr/lib/java/dirsec/jss4.jar jss4.jar
-		###     elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-		###         ln -s /usr/lib/sparcv9/java/dirsec/jss4.jar jss4.jar
-		###     fi
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/ldapjdk.jar ]; then
-		###     ln -s /usr/share/java/ldapjdk.jar ldapjdk.jar
-		### fi
-
-		### naming-factory.jar
-		### naming-resources.jar
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/nsutil.jar ]; then
-		###     ln -s /usr/share/java/pki/nsutil.jar nsutil.jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/osutil.jar ]; then
-		###     if [ "$ARCHITECTURE" = "sparc" ] ; then
-		###         ln -s /usr/lib/java/osutil.jar osutil.jar
-		###     elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-		###         ln -s /usr/lib/sparcv9/java/osutil.jar osutil.jar
-		###     fi
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/rhino.jar ]; then
-		###     ln -s /usr/share/java/rhino.jar rhino.jar
-		### fi
-
-		### BEGIN SOLARIS-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[servletapi5.jar\] ]; then
-		###     ln -s /usr/share/java/servletapi5.jar [servletapi5.jar]
-		### fi
-		### END SOLARIS-SPECIFIC LINKS
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/symkey.jar ]; then
-		###     if [ "$ARCHITECTURE" = "sparc" ] ; then
-		###         ln -s /usr/lib/java/symkey.jar symkey.jar
-		###     elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-		###         ln -s /usr/lib/sparcv9/java/symkey.jar symkey.jar
-		###     fi
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/velocity.jar ]; then
-		###     ln -s /usr/share/java/velocity.jar velocity.jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/xalan\-j2.jar ]; then
-		###     ln -s /usr/share/java/xalan-j2.jar xalan-j2.jar
-		### fi
-
-		if [ ! -e /var/lib/tomcat5/common/lib/xerces\-j2\-2.6.2.jar ]; then
-			ln -s /usr/share/java/xerces-j2-2.6.2.jar xerces-j2-2.6.2.jar
-		fi
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/xerces\-j2.jar ]; then
-		###     ln -s /usr/share/java/xerces-j2.jar xerces-j2.jar
-		### fi
+. /etc/init.d/functions
 
-
-		#######################################
-		##    /var/lib/tomcat5/common/endorsed:
-		#######################################
-
-		# Build the tomcat jar classpath . . .
-		CLASSPATH="$CLASSPATH":/usr/share/java/xml-commons-apis.jar
-
-		# BEGIN LINUX-SPECIFIC FILE
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jaxp_parser_impl.jar
-		# END LINUX-SPECIFIC FILE
-
-
-		# Relink tomcat jar repositories . . .
-		cd /var/lib/tomcat5/common/endorsed
-
-		### BEGIN LINUX-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/common/endorsed/\[jaxp_parser_impl\].jar ]; then
-		###     ln -s /usr/share/java/jaxp_parser_impl.jar [jaxp_parser_impl].jar
-		### fi
-		### END LINUX-SPECIFIC LINKS
-
-		if [ ! -e /var/lib/tomcat5/common/endorsed/\[xml\-commons\-apis\].jar ]; then
-			ln -s /usr/share/java/xml-commons-apis.jar [xml-commons-apis].jar
-		fi
-
-
-		#######################################
-		##    /var/lib/tomcat5/server/lib:
-		#######################################
-
-		# Build the tomcat jar classpath . . .
-		CLASSPATH="$CLASSPATH":/usr/share/java/catalina-ant5.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-beanutils.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-digester.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-el.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-fileupload.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-logging.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-modeler.jar
-
-		# BEGIN LINUX-SPECIFIC FILE
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jdtCompilerAdapter.jar
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jdtcore.jar
-		# END LINUX-SPECIFIC FILE
-
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-impl.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-jmx.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-remote.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-rimpl.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-rjmx.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-tools.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/regexp.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/catalina-cluster.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/catalina-optional.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/catalina-storeconfig.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/catalina.jar
-		if [ "$ARCHITECTURE" = "sparc" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/java/dirsec/jss4.jar
-		elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/sparcv9/java/dirsec/jss4.jar
-		fi
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/servlets-cgi.renametojar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/servlets-default.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/servlets-invoker.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/servlets-ssi.renametojar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/servlets-webdav.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/tomcat-ajp.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/tomcat-coyote.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/tomcat-http.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/tomcat-util.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/tomcatjss.jar
-
-
-		# Relink tomcat jar repositories . . .
-		cd /var/lib/tomcat5/server/lib
-
-		if [ ! -e /var/lib/tomcat5/server/lib/\[catalina\-ant5\].jar ]; then
-			ln -s /usr/share/java/catalina-ant5.jar [catalina-ant5].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-beanutils\].jar ]; then
-			ln -s /usr/share/java/commons-beanutils.jar [commons-beanutils].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-digester\].jar ]; then
-			ln -s /usr/share/java/commons-digester.jar [commons-digester].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-el\].jar ]; then
-			ln -s /usr/share/java/commons-el.jar [commons-el].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-fileupload\].jar ]; then
-			ln -s /usr/share/java/commons-fileupload.jar [commons-fileupload].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-logging\].jar ]; then
-			ln -s /usr/share/java/commons-logging.jar [commons-logging].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-modeler\].jar ]; then
-			ln -s /usr/share/java/commons-modeler.jar [commons-modeler].jar
-		fi
-
-		### BEGIN LINUX-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/server/lib/\[jdtCompilerAdapter\].jar ]; then
-		###     ln -s /usr/share/java/jdtCompilerAdapter.jar [jdtCompilerAdapter].jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/server/lib/\[jdtcore\].jar ]; then
-		###     ln -s /usr/share/java/jdtcore.jar [jdtcore].jar
-		### fi
-		### END LINUX-SPECIFIC LINKS
-
-		if [ ! -e /var/lib/tomcat5/server/lib/\[mx4j\]\[mx4j\].jar ]; then
-			ln -s /usr/share/java/mx4j/mx4j.jar [mx4j][mx4j].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[regexp\].jar ]; then
-			ln -s /usr/share/java/regexp.jar [regexp].jar
-		fi
-
-		### catalina-cluster.jar
-		### catalina-optional.jar
-		### catalina-storeconfig.jar
-		### catalina.jar
-		### if [ ! -e /var/lib/tomcat5/server/lib/jss4.jar ]; then
-		###     if [ "$ARCHITECTURE" = "sparc" ] ; then
-		###         ln -s /usr/lib/java/dirsec/jss4.jar jss4.jar
-		###     elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-		###         ln -s /usr/lib/sparcv9/java/dirsec/jss4.jar jss4.jar
-		###     fi
-		### fi
-		### servlets-cgi.renametojar
-		### servlets-default.jar
-		### servlets-invoker.jar
-		### servlets-ssi.renametojar
-		### servlets-webdav.jar
-		### tomcat-ajp.jar
-		### tomcat-coyote.jar
-		### tomcat-http.jar
-		### tomcat-util.jar
-		### if [ ! -e /var/lib/tomcat5/server/lib/tomcatjss.jar ]; then
-		###     ln -s /usr/share/java/tomcatjss.jar tomcatjss.jar
-		### fi
-
-
-		#######################################
-		##    /var/lib/tomcat5/shared/lib:
-		#######################################
-
-		# Build the tomcat jar classpath . . .
-
-		export CLASSPATH
-
-
-		# Relink tomcat jar repositories . . .
-		cd /var/lib/tomcat5/shared/lib
-	fi
-
-	# daemon --user $TOMCAT_USER $TOMCAT_SCRIPT start
-	if [ ${OS} = "SunOS" ] ; then
-		su  $TOMCAT_USER -c "$TOMCAT_SCRIPT start" > /dev/null
-	else
-		runuser -s /bin/bash $TOMCAT_USER -c "$TOMCAT_SCRIPT start" > /dev/null
-	fi
-
-	rv=$?
-	if [ ${rv} = 0 ] ; then
-		touch ${PKI_LOCKFILE}
-		chown $TOMCAT_USER:$TOMCAT_GROUP $PKI_LOCKFILE
-		chmod 00600 $PKI_LOCKFILE
-	fi
-
-	if [ ${rv} = 0 ] ; then
-		count=0;
-
-		let swait=$STARTUP_WAIT
-		while	[ ! -s ${pidfile} ] &&
-				[ $count -lt $swait ]
-		do
-			echo -n "."
-			sleep 1
-			let count=$count+1;
-		done
-
-		if [ -f /etc/init.d/functions ]; then
-			if [ "$CONSOLETYPE" = "serial" ]; then
-				echo -n "         "
-			fi
-			echo_success
-			echo
-		else
-			echo "         [  OK  ]"
-		fi
-
-		get_pki_secure_port
-		if [ $? -ne 0 ] ; then
-			PKI_SECURE_PORT="<Port Undefined>"
-		fi
-
-                # Set permissions of log files
-                pki_logs_directory=${PKI_INSTANCE_PATH}/logs
-                pki_signedAudit="${pki_logs_directory}/signedAudit"
-                for file in ${pki_logs_directory}/*; do
-                    if  [  ! -d "${file}" ]; then
-                            chmod 00640 ${file}
-                            chgrp $TOMCAT_GROUP ${file}
-                            chown $TOMCAT_USER ${file}
-                    fi
-                done
-
-                # Set permissions of signedAudit log files
-                # do not set the group id, this will be set by the sgid on the directory
-                pki_signedAudit_files=`ls -1A ${pki_signedAudit} | wc -l`
-                if  [ ${pki_signedAudit_files} -gt 0 ]; then
-                    for file in ${pki_signedAudit}/*; do
-                        chmod 00640 ${file}
-                        chown $TOMCAT_USER ${file}
-                    done
-                fi
-
-		# ignore "status" return codes
-		echo
-		display_instance_status
-	else
-		if [ -f /etc/init.d/functions ]; then
-			if [ "$CONSOLETYPE" = "serial" ]; then
-				$0	echo -n "         "
-			fi
-			echo_failure
-			echo
-		else
-			echo "         [  FAILED  ]"
-		fi
-	fi
-
-	sleep 5
-	return ${rv}
-}
-
-stop_instance()
-{
-	rv=0
-
-	echo -n "Stopping $TOMCAT_PROG: "
-
-	if [ -f ${PKI_LOCKFILE} ] ; then
-		CATALINA_PID=${pidfile}
-		export CATALINA_PID
-
-		# daemon --user $TOMCAT_USER $TOMCAT_SCRIPT stop
-		if [ ${OS} = "SunOS" ] ; then
-			su  $TOMCAT_USER -c "$TOMCAT_SCRIPT stop" > /dev/null
-		else
-			runuser -s /bin/bash $TOMCAT_USER -c "$TOMCAT_SCRIPT stop" > /dev/null
-		fi
-
-		rv=$?
-
-		if [ ${rv} = 0 ]; then
-			count=0;
-
-			if [ -f ${pidfile} ]; then
-				read kpid < ${pidfile}
-				let kwait=$SHUTDOWN_WAIT
-
-				until	[ `ps -p $kpid | grep -c $kpid` = '0' ] ||
-						[ $count -gt $kwait ]
-				do
-					echo -n "."
-					sleep 1
-					let count=$count+1;
-				done
-
-				if [ $count -gt $kwait ]; then
-					kill -9 $kpid
-				fi
-			fi
-
-			rm -f ${PKI_LOCKFILE}
-			rm -f ${pidfile}
-
-			if [ -f /etc/init.d/functions ]; then
-				if [ "$CONSOLETYPE" = "serial" ]; then
-					echo -n "         "
-				fi
-				echo_success
-				echo
-			else
-				echo "         [  OK  ]"
-			fi
-		else
-			if [ -f /etc/init.d/functions ]; then
-				if [ "$CONSOLETYPE" = "serial" ]; then
-					echo -n "         "
-				fi
-				echo_failure
-				echo
-			else
-				echo "         [  FAILED  ]"
-			fi
-			rv=${default_error}
-		fi
-	else
-		echo
-		echo "process already stopped"
-		rv=0
-	fi
-
-	return ${rv}
-}
-
-start()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		config_errors=0
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "BEGIN STARTING '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Start every PKI instance of this type that isn't already running
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			start_instance
-
-			rv=$?
-			if [ ${rv} = 6 ] ; then
-				# Since at least ONE configuration error exists, then there
-				# is at least ONE unconfigured instance from the PKI point
-				# of view.
-				#
-				# However, it must still be considered that the
-				# instance is "running" from the point of view of other
-				# OS programs such as 'chkconfig'.
-				#
-				# Therefore, ignore non-zero return codes resulting
-				# from configuration errors.
-				#
-
-				config_errors=`expr $config_errors + 1`
-				rv=0
-			elif [ ${rv} != 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt ${errors} ] ; then
-			touch ${lockfile}
-			chmod 00600 ${lockfile}
-		fi
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			# NOTE:  "bad" return code(s) OVERRIDE configuration errors!
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "1 generic or unspecified error (current practice)"
-				rv=1
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances failed to start!"
-				echo
-			fi
-
-			if [ ${TOTAL_UNCONFIGURED_PKI_ENTRIES} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${TOTAL_UNCONFIGURED_PKI_ENTRIES} "
-				echo -n "of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances MUST be configured!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED STARTING '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances installed!"
-		rv=5
-	fi
-
-	return ${rv}
-}
-
-stop()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "BEGIN SHUTTING DOWN '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Shutdown every PKI instance of this type that is running
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			stop_instance
-
-			rv=$?
-			if [ ${rv} != 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		if [ ${errors} -eq 0 ] ; then
-			rm -f ${lockfile}
-		fi
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "1 generic or unspecified error (current practice)"
-				rv=1
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances were "
-				echo -n "unsuccessfully stopped!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED SHUTTING DOWN '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances installed!"
-		rv=5
-	fi
-
-	return ${rv}
-}
-
-restart()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	stop
-	sleep 2
-	echo
-	echo "============================================================"
-	echo
-	start
-
-	return $?
-}
-
-status()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 program is running or service is OK
-	#     * 1 program is dead and /var/run pid file exists
-	#     * 2 program is dead and /var/lock lock file exists
-	#     * 3 program is not running
-	#     * 4 program or service status is unknown
-	#     * 5-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "REPORT STATUS OF '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Obtain status of every PKI instance of this type
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			display_instance_status
-
-			rv=$?
-			if [ ${rv} -ne 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "4 - program or service status is unknown"
-				rv=4
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances reported status failures!"
-				echo
-			fi
-
-			if [ ${TOTAL_UNCONFIGURED_PKI_ENTRIES} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${TOTAL_UNCONFIGURED_PKI_ENTRIES} "
-				echo -n "of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances MUST be configured!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED REPORTING STATUS OF '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances installed!"
-		rv=4
-	fi
-
-	return ${rv}
-}
+# Source the PKI function library
+. /usr/share/pki/scripts/functions
 
 # See how we were called.
-case "${command}" in
-	start|stop|restart|status)
-		${command}
-		exit $?
-		;;
-	condrestart|force-restart|try-restart)
-		[ ! -f ${lockfile} ] || restart
-		exit $?
-		;;
-	reload)
-		echo "The 'reload' action is an unimplemented feature."
-		exit ${default_error}
-		;;
-	*)
-		# * 3 unimplemented feature (for example, "reload")
-		#     [invalid command - should never be reached]
-		echo
-		usage
-		echo "where valid instance names include:"
-		list_instances
-		exit 3
-		;;
+case $command in
+    status)
+	registry_status
+	exit $?
+	;;
+    start)
+	start
+	exit $?
+	;;
+    restart)
+	restart
+	exit $?
+	;;
+    stop)
+	stop
+	exit $?
+	;;
+    condrestart|force-restart|try-restart)
+        [ ! -f ${lockfile} ] || restart
+        exit $?
+        ;;
+    reload)
+        echo "The 'reload' action is an unimplemented feature."
+        exit ${default_error}
+        ;;
+    *)
+	echo "unknown action ($command)"
+        usage
+        echo "where valid instance names include:"
+        list_instances
+        exit ${default_error}
+        ;;
 esac
 
diff --git a/pki/base/ra/apache/apachectl b/pki/base/ra/apache/apachectl
deleted file mode 100755
index 7d9e24491..000000000
--- a/pki/base/ra/apache/apachectl
+++ /dev/null
@@ -1,184 +0,0 @@
-#!/bin/sh
-#
-# --- BEGIN COPYRIGHT BLOCK ---
-#
-# Copyright 2000-2004 The Apache Software Foundation
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# (C) 2007 Red Hat, Inc.
-# All rights reserved.
-# --- END COPYRIGHT BLOCK ---
-#
-
-# Initialize environment variables
-LD_LIBRARY_PATH=[SYSTEM_USER_LIBRARIES]:[SYSTEM_LIBRARIES]:${LD_LIBRARY_PATH}
-LD_LIBRARY_PATH=[SECURITY_LIBRARIES]:${LD_LIBRARY_PATH}
-export LD_LIBRARY_PATH
-
-# see if httpd is linked with the openldap libraries - we need to override them
-OS=`uname -s`
-if [ $OS = "Linux" ]; then
-   hasopenldap=0
-
-   /usr/bin/ldd $httpd 2>&1 | grep libldap- > /dev/null 2>&1 && hasopenldap=1
-
-   if [ $hasopenldap -eq 1 ] ; then
-       LD_PRELOAD="[SYSTEM_USER_LIBRARIES]/libldap50.so"
-       LD_PRELOAD="[SYSTEM_USER_LIBRARIES]/dirsec/libssl3.so ${LD_PRELOAD}"
-       export LD_PRELOAD
-   fi
-fi
-
-#
-# Apache control script designed to allow an easy command line interface
-# to controlling Apache.  Written by Marc Slemko, 1997/08/23
-# 
-# The exit codes returned are:
-#   XXX this doc is no longer correct now that the interesting
-#   XXX functions are handled by [INSTANCE_ID]
-#       0 - operation completed successfully
-#       1 - 
-#       2 - usage error
-#       3 - [INSTANCE_ID] could not be started
-#       4 - [INSTANCE_ID] could not be stopped
-#       5 - [INSTANCE_ID] could not be started during a restart
-#       6 - [INSTANCE_ID] could not be restarted during a restart
-#       7 - [INSTANCE_ID] could not be restarted during a graceful restart
-#       8 - configuration syntax error
-#
-# When multiple arguments are given, only the error from the _last_
-# one is reported.  Run "apachectl help" for usage info
-#
-ARGV="$@"
-#
-# |||||||||||||||||||| START CONFIGURATION SECTION  ||||||||||||||||||||
-# --------------------                              --------------------
-# 
-
-#
-# a command that outputs a formatted text version of the HTML at the
-# url given on the command line.  Designed for lynx, however other
-# programs may work.  
-if [ -x /usr/bin/links ]; then
-    LYNX="links -dump"
-elif [ -x /usr/bin/lynx ]; then
-    LYNX="lynx -dump"
-else
-    LYNX="none"
-fi
-
-#
-# the URL to your server's mod_status status page.  If you do not
-# have one, then status and fullstatus will not work.
-STATUSURL="http://localhost:80/server-status"
-#
-# Set this variable to a command that increases the maximum
-# number of file descriptors allowed per child process. This is
-# critical for configurations that use many file descriptors,
-# such as mass vhosting, or a multithreaded server.
-ULIMIT_MAX_FILES="ulimit -S -n `ulimit -H -n`"
-
-########################################################################
-#   This section contains modified content of "/etc/sysconfig/httpd"   #
-########################################################################
-# Configuration file for the [INSTANCE_ID] service.
-
-#
-# The default processing model (MPM) is the process-based
-# 'prefork' model.  A thread-based model, 'worker', is also
-# available, but does not work with some modules (such as PHP).
-# The service must be stopped before changing this variable.
-#
-HTTPD=/opt/fortitude/sbin/httpd.worker
-
-#
-# To pass additional options (for instance, -D definitions) to the
-# httpd binary at startup, set OPTIONS here.
-#
-OPTIONS="-f [HTTPD_CONF]"
-
-#
-# By default, the httpd process is started in the C locale; to 
-# change the locale in which the server runs, the HTTPD_LANG
-# variable can be set.
-#
-HTTPD_LANG=C
-########################################################################
-#                                                                      #
-########################################################################
-
-# Set the maximum number of file descriptors allowed per child process.
-if [ "x$ULIMIT_MAX_FILES" != "x" ] ; then
-    $ULIMIT_MAX_FILES
-fi
-
-ERROR=0
-if [ "x$ARGV" = "x" ] ; then 
-    ARGV="-h"
-fi
-
-function checklynx() {
-if [ "$LYNX" = "none" ]; then
-    echo "The 'links' package is required for this functionality."
-    exit 8
-fi
-}
-
-function testconfig() {
-# [INSTANCE_ID] is denied terminal access in SELinux, so run in the
-# current context to get stdout from $HTTPD -t.
-if test -x /usr/sbin/selinuxenabled && /usr/sbin/selinuxenabled; then
-    runcon -- `id -Z` $HTTPD $OPTIONS -t
-else
-    $HTTPD $OPTIONS -t
-fi
-ERROR=$?
-}
-
-case $ARGV in
-restart|graceful)
-    if $HTTPD -t >&/dev/null; then
-        $HTTPD $OPTIONS -k $ARGV
-        ERROR=$?
-    else
-        echo "apachectl: Configuration syntax error, will not run \"$ARGV\":"
-        testconfig
-    fi
-    ;;
-start|stop)
-    $HTTPD $OPTIONS -k $ARGV
-    ERROR=$?
-    ;;
-startssl|sslstart|start-SSL)
-    $HTTPD $OPTIONS -DSSL -k start
-    ERROR=$?
-    ;;
-configtest)
-    testconfig
-    ;;
-status)
-    checklynx
-    $LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } '
-    ;;
-fullstatus)
-    checklynx
-    $LYNX $STATUSURL
-    ;;
-*)
-    $HTTPD $OPTIONS $ARGV
-    ERROR=$?
-esac
-
-exit $ERROR
-
diff --git a/pki/base/ra/apache/conf/httpd.conf b/pki/base/ra/apache/conf/httpd.conf
index 1312f0822..9f81b646d 100644
--- a/pki/base/ra/apache/conf/httpd.conf
+++ b/pki/base/ra/apache/conf/httpd.conf
@@ -78,7 +78,7 @@ ServerRoot "[SERVER_ROOT]"
 # identification number when it starts.
 #
 <IfModule !mpm_netware.c>
-PidFile run/[INSTANCE_ID].pid
+PidFile run/[PKI_INSTANCE_ID].pid
 </IfModule>
 
 #
@@ -264,7 +264,7 @@ LoadModule cgi_module [FORTITUDE_LIB_DIR]/modules/mod_cgi.so
 </Location>
 
 #
-# Load config files from the config directory "/etc/[INSTANCE_ID]/conf.d".
+# Load config files from the config directory "/etc/[PKI_INSTANCE_ID]/conf.d".
 #
 #Include conf.d/*.conf
 Include [SERVER_ROOT]/conf/perl.conf
@@ -291,10 +291,10 @@ Include [SERVER_ROOT]/conf/perl.conf
 <IfModule !mpm_winnt.c>
 <IfModule !mpm_netware.c>
 #
-# If you wish [INSTANCE_ID] to run as a different user or group, you must run
-# [INSTANCE_ID] as root initially and it will switch.  
+# If you wish [PKI_INSTANCE_ID] to run as a different user or group, you must run
+# [PKI_INSTANCE_ID] as root initially and it will switch.  
 #
-# User/Group: The name (or #number) of the user/group to run [INSTANCE_ID] as.
+# User/Group: The name (or #number) of the user/group to run [PKI_INSTANCE_ID] as.
 #  . On SCO (ODT 3) use "User nouser" and "Group nogroup".
 #  . On HPUX you may not be able to use shared memory as nobody, and the
 #    suggested workaround is to create a user www and use that user.
@@ -302,8 +302,8 @@ Include [SERVER_ROOT]/conf/perl.conf
 #  when the value of (unsigned)Group is above 60000; 
 #  don't use Group #-1 on these systems!
 #
-User [USERID]
-Group [GROUPID]
+User [PKI_USER]
+Group [PKI_GROUP]
 #Group #-1
 </IfModule>
 </IfModule>
diff --git a/pki/base/ra/apache/conf/nss.conf b/pki/base/ra/apache/conf/nss.conf
index 668074e4c..a3e0621ab 100644
--- a/pki/base/ra/apache/conf/nss.conf
+++ b/pki/base/ra/apache/conf/nss.conf
@@ -100,7 +100,7 @@ NSSProtocol SSLv3,TLSv1
 
 #   SSL Certificate Nickname:
 #   The nickname of the server certificate you are going to use.
-NSSNickname "Server-Cert cert-[INSTANCE_ID]"
+NSSNickname "Server-Cert cert-[PKI_INSTANCE_ID]"
 
 #   Server Certificate Database:
 #   The NSS security database directory that holds the certificates and
@@ -195,7 +195,7 @@ NSSProtocol SSLv3,TLSv1
 
 #   SSL Certificate Nickname:
 #   The nickname of the server certificate you are going to use.
-NSSNickname "Server-Cert cert-[INSTANCE_ID]"
+NSSNickname "Server-Cert cert-[PKI_INSTANCE_ID]"
 
 #   Server Certificate Database:
 #   The NSS security database directory that holds the certificates and
diff --git a/pki/base/ra/build.xml b/pki/base/ra/build.xml
index 3a303fecc..a3a3a85a4 100644
--- a/pki/base/ra/build.xml
+++ b/pki/base/ra/build.xml
@@ -152,7 +152,12 @@
                 <include name="lib/**"/>
                 <include name="logs/**"/>
                 <include name="scripts/schema.sql"/>
-                <include name="setup/config.desktop"/>
+            </zipfileset>
+            <zipfileset dir="./setup"
+                        filemode="644"
+                        prefix="usr/share/${product.prefix}/${product}/setup">
+                <include name="config.desktop"/>
+                <include name="registry_instance"/>
             </zipfileset>
             <zipfileset dir="./etc/init.d"
                         filemode="755"
@@ -204,7 +209,12 @@
                 <include name="lib/**"/>
                 <include name="logs/**"/>
                 <include name="scripts/schema.sql"/>
-                <include name="setup/config.desktop"/>
+            </tarfileset>
+            <tarfileset dir="./setup"
+                        mode="644"
+                        prefix="${dist.name}/usr/share/${product.prefix}/${product}/setup">
+                <include name="config.desktop"/>
+                <include name="registry_instance"/>
             </tarfileset>
             <tarfileset dir="./etc/init.d"
                         mode="755"
diff --git a/pki/base/ra/doc/CS.cfg b/pki/base/ra/doc/CS.cfg
index 5f51a89d2..052d01f7e 100644
--- a/pki/base/ra/doc/CS.cfg
+++ b/pki/base/ra/doc/CS.cfg
@@ -16,15 +16,15 @@
 # All rights reserved.
 # --- END COPYRIGHT BLOCK ---
 #
-pkicreate.pki_instance_root=[INSTANCE_ROOT]
-pkicreate.pki_instance_name=[INSTANCE_ID]
-pkicreate.subsystem_type=[SUBSYSTEM_TYPE]
+pkicreate.pki_instance_root=[PKI_INSTANCE_ROOT]
+pkicreate.pki_instance_name=[PKI_INSTANCE_ID]
+pkicreate.subsystem_type=[PKI_SUBSYSTEM_TYPE]
 pkicreate.secure_port=[SECURE_PORT]
 pkicreate.non_clientauth_secure_port=[NON_CLIENTAUTH_SECURE_PORT]
 pkicreate.unsecure_port=[PORT]
-pkicreate.user=[USERID]
-pkicreate.group=[GROUPID]
-pkiremove.cert.subsystem.nickname=subsystemCert cert-[INSTANCE_ID]
+pkicreate.user=[PKI_USER]
+pkicreate.group=[PKI_GROUP]
+pkiremove.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_ID]
 request._000=#########################################
 request._001=# Request Queue Parameters
 request._002=#########################################
@@ -115,7 +115,7 @@ service.instanceDir=[SERVER_ROOT]
 service.securePort=[SECURE_PORT]
 service.non_clientauth_securePort=[NON_CLIENTAUTH_SECURE_PORT]
 service.unsecurePort=[PORT]
-service.instanceID=[INSTANCE_ID]
+service.instanceID=[PKI_INSTANCE_ID]
 logging._000=#########################################
 logging._001=# RA configuration File
 logging._002=#
@@ -212,22 +212,22 @@ preop.cert.list=sslserver,subsystem
 preop.cert.sslserver.enable=true
 preop.cert.subsystem.enable=true
 preop.cert.sslserver.defaultSigningAlgorithm=SHA1withRSA
-preop.cert.sslserver.dn=CN=[SERVER_NAME], OU=[INSTANCE_ID]
+preop.cert.sslserver.dn=CN=[SERVER_NAME], OU=[PKI_INSTANCE_ID]
 preop.cert.sslserver.keysize.customsize=2048
 preop.cert.sslserver.keysize.size=2048
 preop.cert.sslserver.keysize.select=custom
-preop.cert.sslserver.nickname=Server-Cert cert-[INSTANCE_ID]
+preop.cert.sslserver.nickname=Server-Cert cert-[PKI_INSTANCE_ID]
 preop.cert.sslserver.profile=caInternalAuthServerCert
 preop.cert.sslserver.subsystem=ra
 preop.cert._003=#preop.cert.sslserver.type=local
 preop.cert.sslserver.userfriendlyname=SSL Server Certificate
 preop.cert._004=#preop.cert.sslserver.cncomponent.override=false
 preop.cert.subsystem.defaultSigningAlgorithm=SHA1withRSA
-preop.cert.subsystem.dn=CN=RA Subsystem Certificate, OU=[INSTANCE_ID]
+preop.cert.subsystem.dn=CN=RA Subsystem Certificate, OU=[PKI_INSTANCE_ID]
 preop.cert.subsystem.keysize.customsize=2048
 preop.cert.subsystem.keysize.size=2048
 preop.cert.subsystem.keysize.select=custom
-preop.cert.subsystem.nickname=subsystemCert cert-[INSTANCE_ID]
+preop.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_ID]
 preop.cert.subsystem.profile=caInternalAuthSubsystemCert
 preop.cert.subsystem.subsystem=ra
 preop.cert._005=#preop.cert.subsystem.type=local
diff --git a/pki/base/ra/etc/init.d/pki-rad b/pki/base/ra/etc/init.d/pki-rad
index f1e2e9dee..b8ac3a0ac 100755
--- a/pki/base/ra/etc/init.d/pki-rad
+++ b/pki/base/ra/etc/init.d/pki-rad
@@ -14,1402 +14,70 @@
 # with this program; if not, write to the Free Software Foundation, Inc.,
 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
-# Copyright (C) 2007 Red Hat, Inc.
+# Copyright (C) 2007-2010 Red Hat, Inc.
 # All rights reserved.
 # --- END COPYRIGHT BLOCK ---
 #
 # pki-rad          Startup script for the Apache HTTP pki-ra Server
 #
 # chkconfig:    - 86 14
-# description:  Registration Authority \
-#               (Apache 2.2)
+# description:  Registration Authority (Apache)
 # processname:  pki-rad
 # piddir:       /var/run/pki/ra
 # config:       ${PKI_SERVER_ROOT}/conf/httpd.conf
 
-PKI_INIT_SCRIPT=""
+PROG_NAME=`basename $0`
+SERVICE_NAME="pki-rad"
+SERVICE_PROG="/sbin/service"
 PKI_PATH="/usr/share/pki/ra"
-PKI_PIDDIR="/var/run/pki/ra"
-PKI_PROCESS="pki-rad"
 PKI_REGISTRY="/etc/sysconfig/pki/ra"
-PKI_SELINUX_TYPE="pki_ra_t"
 PKI_TYPE="pki-ra"
-
-# PKI subsystem-level directory and file values for locks
-lockfile="/var/lock/subsys/pki-rad"
+PKI_TOTAL_PORTS=3
 
 # Disallow 'others' the ability to 'write' to new files
 umask 00002
 
-default_error=0
 command="$1"
 pki_instance="$2"
-case "${command}" in
-	start|stop|restart|condrestart|force-restart|try-restart)
-		# * 1 generic or unspecified error (current practice)
-		default_error=1
-		;;
-	reload)
-		default_error=3
-		;;
-	status)
-		# * 4 program or service status is unknown
-		default_error=4
-		;;
-	*)
-		# * 2 invalid argument(s)
-		default_error=2
-		;;
-esac
-
-# Check to insure that this script's original invocation directory
-# has not been deleted!
-CWD=`/bin/pwd > /dev/null 2>&1`
-if [ $? -ne 0 ] ; then
-	echo "Cannot invoke '$0' from non-existent directory!"
-	exit ${default_error}
-fi
-
-# Check to insure that this script's associated PKI
-# subsystem currently resides on this system.
-if [ ! -d ${PKI_PATH} ] ; then
-	echo "This machine is missing the '${PKI_TYPE}' subsystem!"
-	if [ "${command}" != "status" ]; then
-		# * 5 program is not installed
-		exit 5
-	else
-		exit ${default_error}
-	fi
-fi
-
-# Check to insure that this script's associated PKI
-# subsystem instance registry currently resides on this system.
-if [ ! -d ${PKI_REGISTRY} ] ; then
-	echo "This machine contains no registered '${PKI_TYPE}' subsystem instances!"
-	if [ "${command}" != "status" ]; then
-		# * 5 program is not installed
-		exit 5
-	else
-		exit ${default_error}
-	fi
-fi
-
-# Obtain the operating system upon which this script is being executed
-# and initialize environment variables
-OS=`uname -s`
-ARCHITECTURE=""
-LD_LIBRARY_PATH=""
-
-# Time to wait in seconds, before killing process
-#
-#     NOTE:  Defined in "tomcat5.conf" for PKI Java/Tomcat Subsystems.
-#
-STARTUP_WAIT=30
-SHUTDOWN_WAIT=30
-
-# This script must be run as root!
-RV=0
-if [ ${OS} = "Linux" ] ; then
-	PKI_INIT_SCRIPT="/sbin/service ${PKI_PROCESS}"
-	if [ `id -u` -ne 0 ] ; then
-		echo "Must be 'root' to execute '$0'!"
-		if [ "${command}" != "status" ]; then
-			# * 4 user had insufficient privilege
-			exit 4
-		else
-			# * 4 program or service status is unknown
-			exit 4
-		fi
-	fi
-	ARCHITECTURE=`uname -i`
-	if [ ${ARCHITECTURE} = "i386" ] ; then
-		LD_LIBRARY_PATH="/usr/lib:/lib:${LD_LIBRARY_PATH}"
-	elif [ ${ARCHITECTURE} = "x86_64" ] ; then
-		LD_LIBRARY_PATH="/usr/lib64:/lib64:${LD_LIBRARY_PATH}"
-	else
-		echo "Unsupported architecture '${ARCHITECTURE}'!"
-		exit ${default_error}
-	fi
-elif [ ${OS} = "SunOS" ] ; then
-	PKI_INIT_SCRIPT="/etc/init.d/${PKI_PROCESS}"
-	if [ `/usr/xpg4/bin/id -u` -ne 0 ] ; then
-		echo "Must be 'root' to execute '$0'!"
-		if [ "${command}" != "status" ]; then
-			# * 4 user had insufficient privilege
-			exit 4
-		else
-			# * 4 program or service status is unknown
-			exit 4
-		fi
-	fi
-	ARCHITECTURE=`uname -p`
-	if	[ "${ARCHITECTURE}" = "sparc" ] &&
-		[ -d "/usr/lib/sparcv9/" ] ; then
-		ARCHITECTURE="sparcv9"
-	fi
-	if [ ${ARCHITECTURE} = "sparcv9" ] ; then
-		LD_LIBRARY_PATH="/usr/lib/sparcv9:/lib/sparcv9:${LD_LIBRARY_PATH}"
-		LD_LIBRARY_PATH="/usr/lib/sparcv9/dirsec:${LD_LIBRARY_PATH}"
-	else
-		echo "Unsupported architecture '${ARCHITECTURE}'!"
-		exit ${default_error}
-	fi
-else
-	echo "Unsupported OS '${OS}'!"
-	exit ${default_error}
-fi
-export LD_LIBRARY_PATH
 
 # Source function library.
-if [ -f /etc/init.d/functions ]; then
-	. /etc/init.d/functions
-else
-	# The checkpid() function is provided for platforms that do not
-	# contain the "/etc/init.d/functions" file (e. g. - Solaris) . . .
-
-	# Check if ${pid} (could be plural) are running (keep count)
-	checkpid()
-	{
-		rv=0
-		for i in $* ; do
-			ps -p $i > /dev/null 2>&1 ;
-			if [ $? -ne 0 ] ; then
-				rv=`expr $rv + 1`
-			else
-				rv=`expr $rv + 0`
-			fi
-		done
-		# echo "rv=$rv"
-		return $rv
-	}
-
-	# Create the following directories on platforms
-	# where they do not exist (e. g. - Solaris) . . .
-	if [ ! -d "/var/lock" ] ; then
-		mkdir -p /var/lock
-		chown root:sys /var/lock
-		chmod 00755 /var/lock
-	fi
-	if [ ! -d "/var/lock/subsys" ] ; then
-		mkdir -p /var/lock/subsys
-		chown root:root /var/lock/subsys
-		chmod 00755 /var/lock/subsys
-	fi
-fi
-
-PKI_REGISTRY_ENTRIES=""
-TOTAL_PKI_REGISTRY_ENTRIES=0
-TOTAL_UNCONFIGURED_PKI_ENTRIES=0
-
-# Gather ALL registered instances of this PKI subsystem type
-for FILE in `/bin/ls -1 ${PKI_REGISTRY}/* 2>/dev/null`; do
-	if [ -f "$FILE" ] ; then
-		inst=`echo "$FILE"`
-		PKI_REGISTRY_ENTRIES="${PKI_REGISTRY_ENTRIES} $inst"
-		TOTAL_PKI_REGISTRY_ENTRIES=`expr ${TOTAL_PKI_REGISTRY_ENTRIES} + 1`
-	fi
-done
-
-if [ -n "${pki_instance}" ]; then
-	for I in ${PKI_REGISTRY_ENTRIES}; do
-		if [ "${PKI_REGISTRY}/${pki_instance}" = "$I" ]; then
-			PKI_REGISTRY_ENTRIES="${PKI_REGISTRY}/${pki_instance}"
-			TOTAL_PKI_REGISTRY_ENTRIES=1
-			break
-		fi
-	done
-fi
-
-usage()
-{
-	echo -n "Usage: ${PKI_INIT_SCRIPT} "
-	echo -n "{start"
-	echo -n "|stop"
-	echo -n "|restart"
-	echo -n "|condrestart"
-	echo -n "|force-restart"
-	echo -n "|try-restart"
-	echo -n "|reload"
-	echo -n "|status} "
-	echo -n "[instance-name]"
-	echo
-	echo
-}
-
-list_instances()
-{
-	echo
-	for FILE in `/bin/ls -1 ${PKI_REGISTRY}/* 2>/dev/null`; do
-		echo "    ${FILE}"
-	done
-	echo
-}
-
-# Check arguments
-if [ $# -lt 1 ] ; then
-	# * 3 unimplemented feature (for example, "reload")
-	#     [insufficient arguments]
-	echo "$0:  Insufficient arguments!"
-	echo
-	usage
-	echo "where valid instance names include:"
-	list_instances
-	exit 3
-elif [ ${default_error} -eq 2 ] ; then
-	# * 2 invalid argument
-	echo "$0:  Invalid arguments!"
-	echo
-	usage
-	echo "where valid instance names include:"
-	list_instances
-	exit 2
-elif [ $# -gt 2 ] ; then
-	echo "$0:  Excess arguments!"
-	echo
-	usage
-	echo "where valid instance names include:"
-	list_instances
-	if [ "${command}" != "status" ]; then
-		# * 2 excess arguments
-		exit 2
-	else
-		# * 4 program or service status is unknown
-		exit 4
-	fi
-fi
-
-# If an "instance" was supplied, check that it is a "valid" instance
-if [ -n "${pki_instance}" ]; then
-	if [ "${PKI_REGISTRY}/${pki_instance}" != "${PKI_REGISTRY_ENTRIES}" ]; then
-		echo -n "${pki_instance} is an invalid '${PKI_TYPE}' instance"
-		echo_failure
-		echo
-		if [ "${command}" != "status" ]; then
-			# * 5 program is not installed
-			exit 5
-		else
-			# * 4 program or service status is unknown
-			exit 4
-		fi
-	fi
-fi
-
-# On Solaris /var/run is in tmpfs and gets wiped out upon reboot
-# we have to recreate the ${PKI_PIDDIR} directory and make sure that
-# the directory is writable by the ${PKI_TYPE} server process.
-#
-# IMPORTANT:  ALL PKI subsystems installed on this machine MUST utilize
-#             the SAME values for ${PKI_GROUP} and ${PKI_USER}, since the
-#             "${PKI_PIDDIR}" will end up with the ownership permissions
-#             of the first instance that executes this function!
-#
-fix_pid_dir_ownership()
-{
-	if [ ! -d ${PKI_PIDDIR} ] ; then
-		mkdir -p ${PKI_PIDDIR}
-
-		chown root:root /var/run/pki
-		chmod 00755 /var/run/pki
-
-		chown root:root ${PKI_PIDDIR}
-		chmod 00755 ${PKI_PIDDIR}
-	fi
-}
-
-check_pki_configuration_status()
-{
-	rv=0
-
-	rv=`grep -c ^preop ${pki_instance_configuration_file}`
-
-	rv=`expr ${rv} + 0`
-
-	if [ ${rv} -ne 0 ] ; then
-		echo "    '${PKI_INSTANCE_ID}' must still be CONFIGURED!"
-		echo "    (see /var/log/${PKI_INSTANCE_ID}-install.log)"
-		if [ "${command}" != "status" ]; then
-			# * 6 program is not configured
-			rv=6
-		else
-			# * 4 program or service status is unknown
-			rv=4
-		fi
-		TOTAL_UNCONFIGURED_PKI_ENTRIES=`expr ${TOTAL_UNCONFIGURED_PKI_ENTRIES} + 1`
-	elif [ -f ${RESTART_SERVER} ] ; then
-		echo -n "    Although '${PKI_INSTANCE_ID}' has been CONFIGURED, "
-		echo -n "it must still be RESTARTED!"
-		echo
-		if [ "${command}" != "status" ]; then
-			# * 1 generic or unspecified error (current practice)
-			rv=1
-		else
-			# * 4 program or service status is unknown
-			rv=4
-		fi
-	fi
-
-	return ${rv}
-}
-
-get_pki_status_definitions()
-{
-	# establish well-known strings
-	listen_statement="Listen"
-	total_ports=0
-	UNSECURE_PORT=""
-	CLIENTAUTH_PORT=""
-	NON_CLIENTAUTH_PORT=""
-
-	# check to see that an instance-specific "httpd.conf" file exists
-	if [ ! -f ${PKI_HTTPD_CONF} ] ; then
-		echo "File '${PKI_HTTPD_CONF}' does not exist!"
-		exit ${default_error}
-	fi
-
-	# check to see that an instance-specific "nss.conf" file exists
-	if [ ! -f ${PKI_NSS_CONF} ] ; then
-		echo "File '${PKI_NSS_CONF}' does not exist!"
-		exit ${default_error}
-	fi
-
-	# read this instance-specific "httpd.conf" file line-by-line
-	# to obtain the current value of the PKI unsecure port
-
-	exec < ${PKI_HTTPD_CONF}
-	while read line; do
-		# look for the listen statement
-		head=`echo $line | cut -b1-6`
-		if [ "$head" == "$listen_statement" ] ; then
-			# once the 'unsecure' listen statement has been found,
-			# extract the numeric port information
-			port=`echo $line | cut -b8-`
-			UNSECURE_PORT=$port
-			echo "    Unsecure Port              = http://${PKI_SERVER_NAME}:${UNSECURE_PORT}"
-			total_ports=`expr ${total_ports} + 1`
-			break;
-		fi
-	done
-
-	# read this instance-specific "nss.conf" file line-by-line
-	# to obtain the current value of the "clientauth" PKI secure port
-	# AND the current value of the "non-clientauth" PKI secure port
-
-	exec < ${PKI_NSS_CONF}
-	while read line; do
-		# look for the listen statement
-		head=`echo $line | cut -b1-6`
-		if	[ "$head" == "$listen_statement" ] &&
-			[ ${total_ports} -eq 2           ] ; then
-			# once the 'non-clientauth' listen statement has been found,
-			# extract the numeric port information
-			non_clientauth_port=`echo $line | cut -b8-`
-			NON_CLIENTAUTH_PORT=$non_clientauth_port
-			echo "    Secure Non-Clientauth Port = https://${PKI_SERVER_NAME}:${NON_CLIENTAUTH_PORT}"
-			total_ports=`expr ${total_ports} + 1`
-			break
-		fi
-		if	[ "$head" == "$listen_statement" ] &&
-			[ ${total_ports} -eq 1           ] ; then
-			# once the 'clientauth' listen statement has been found,
-			# extract the numeric port information
-			clientauth_port=`echo $line | cut -b8-`
-			CLIENTAUTH_PORT=$clientauth_port
-			echo "    Secure Clientauth Port     = https://${PKI_SERVER_NAME}:${CLIENTAUTH_PORT}"
-			total_ports=`expr ${total_ports} + 1`
-		fi
-	done
-
-	if [ ${total_ports} -eq 3 ] ; then
-		return 0
-	else
-		return ${default_error}
-	fi
-}
-
-get_pki_configuration_definitions()
-{
-	# Obtain the PKI Subsystem Type
-	line=`grep ^cs.type= ${pki_instance_configuration_file}`
-	pki_subsystem=`echo "${line}" | cut -b9-`
-	if [ "${line}" != "" ] ; then
-		if	[ "${pki_subsystem}" != "CA"   ]  &&
-			[ "${pki_subsystem}" != "KRA"  ]  &&
-			[ "${pki_subsystem}" != "OCSP" ]  &&
-			[ "${pki_subsystem}" != "TKS"  ]  &&
-			[ "${pki_subsystem}" != "RA"   ]  &&
-			[ "${pki_subsystem}" != "TPS"  ]
-		then
-			return ${default_error}
-		fi
-		if	[ "${pki_subsystem}" == "KRA"   ] ; then
-			# Rename "KRA" to "DRM"
-			pki_subsystem="DRM"
-		fi
-	else
-		return ${default_error}
-	fi
-
-	# If "${pki_subsystem}" is a CA, DRM, OCSP, or TKS,
-	# check to see if "${pki_subsystem}" is a "Clone"
-	pki_clone=""
-	if	[ "${pki_subsystem}" == "CA"   ]  ||
-		[ "${pki_subsystem}" == "DRM"  ]  ||
-		[ "${pki_subsystem}" == "OCSP" ]  ||
-		[ "${pki_subsystem}" == "TKS"  ]
-	then
-		line=`grep ^subsystem.select= ${pki_instance_configuration_file}`
-		if [ "${line}" != "" ] ; then
-			pki_clone=`echo "${line}" | cut -b18-`
-			if [ "${pki_clone}" != "Clone" ] ; then
-				# Reset "${pki_clone}" to be empty
-				pki_clone=""
-			fi
-		else
-			return ${default_error}
-		fi
-	fi
-
-	# If "${pki_subsystem}" is a CA, and is NOT a "Clone", check to
-	# see "${pki_subsystem}" is a "Root" or a "Subordinate" CA
-	pki_hierarchy=""
-	if	[ "${pki_subsystem}" == "CA" ]  &&
-		[ "${pki_clone}" != "Clone"  ]
-	then
-		line=`grep ^hierarchy.select= ${pki_instance_configuration_file}`
-		if [ "${line}" != "" ] ; then
-			pki_hierarchy=`echo "${line}" | cut -b18-`
-		else
-			return ${default_error}
-		fi
-	fi
-
-	# If ${pki_subsystem} is a CA, check to
-	# see if it is also a Security Domain
-	pki_security_domain=""
-	if	[ "${pki_subsystem}" == "CA" ] ; then
-		line=`grep ^securitydomain.select= ${pki_instance_configuration_file}`
-		if [ "${line}" != "" ] ; then
-			pki_security_domain=`echo "${line}" | cut -b23-`
-			if [ "${pki_security_domain}" == "new" ] ; then
-				# Set a fixed value for "${pki_security_domain}"
-				pki_security_domain="(Security Domain)"
-			else
-				# Reset "${pki_security_domain}" to be empty
-				pki_security_domain=""
-			fi
-		else
-			return ${default_error}
-		fi
-	fi
-
-	# Always obtain this PKI instance's "registered"
-	# security domain information
-	pki_security_domain_name=""
-	pki_security_domain_hostname=""
-	pki_security_domain_https_admin_port=""
-
-	line=`grep ^securitydomain.name= ${pki_instance_configuration_file}`
-	if [ "${line}" != "" ] ; then
-		pki_security_domain_name=`echo "${line}" | cut -b21-`
-	else
-		return ${default_error}
-	fi
-
-	line=`grep ^securitydomain.host= ${pki_instance_configuration_file}`
-	if [ "${line}" != "" ] ; then
-		pki_security_domain_hostname=`echo "${line}" | cut -b21-`
-	else
-		return ${default_error}
-	fi
-
-	line=`grep ^securitydomain.httpsadminport= ${pki_instance_configuration_file}`
-	if [ "${line}" != "" ] ; then
-		pki_security_domain_https_admin_port=`echo "${line}" | cut -b31-`
-	else
-		return ${default_error}
-	fi
-
-	# Compose the "PKI Instance Name" Status Line
-	pki_instance_name="PKI Instance Name:   ${PKI_INSTANCE_ID}"
-
-	# Compose the "PKI Subsystem Type" Status Line
-	header="PKI Subsystem Type: "
-	if   [ "${pki_clone}" != "" ] ; then
-		if [ "${pki_security_domain}" != "" ]; then
-			# Possible Values:
-			#
-			#     "CA Clone (Security Domain)"
-			#
-			data="${pki_subsystem} ${pki_clone} ${pki_security_domain}"
-		else
-			# Possible Values:
-			#
-			#     "CA Clone"
-			#     "DRM Clone"
-			#     "OCSP Clone"
-			#     "TKS Clone"
-			#
-			data="${pki_subsystem} ${pki_clone}"
-		fi
-	elif [ "${pki_hierarchy}" != "" ] ; then
-		if [ "${pki_security_domain}" != "" ]; then
-			# Possible Values:
-			#
-			#     "Root CA (Security Domain)"
-			#     "Subordinate CA (Security Domain)"
-			#
-			data="${pki_hierarchy} ${pki_subsystem} ${pki_security_domain}"
-		else
-			# Possible Values:
-			#
-			#     "Root CA"
-			#     "Subordinate CA"
-			#
-			data="${pki_hierarchy} ${pki_subsystem}"
-		fi
-	else
-		# Possible Values:
-		#
-		#     "DRM"
-		#     "OCSP"
-		#     "RA"
-		#     "TKS"
-		#     "TPS"
-		#
-		data="${pki_subsystem}"
-	fi
-	pki_subsystem_type="${header} ${data}"
-
-	# Compose the "Registered PKI Security Domain Information" Status Line
-	header="Name: "
-	registered_pki_security_domain_name="${header} ${pki_security_domain_name}"
-
-	header="URL:  "
-	if	[ "${pki_security_domain_hostname}" != ""         ] &&
-		[ "${pki_security_domain_https_admin_port}" != "" ]
-	then
-		data="https://${pki_security_domain_hostname}:${pki_security_domain_https_admin_port}"
-	else
-		return ${default_error}
-	fi
-	registered_pki_security_domain_url="${header} ${data}"
-
-	# Print the "PKI Subsystem Type" Status Line
-	echo
-	echo "    ${pki_instance_name}"
-
-	# Print the "PKI Subsystem Type" Status Line
-	echo
-	echo "    ${pki_subsystem_type}"
-
-	# Print the "Registered PKI Security Domain Information" Status Line
-	echo
-	echo "    Registered PKI Security Domain Information:"
-	echo "    =========================================================================="
-	echo "    ${registered_pki_security_domain_name}"
-	echo "    ${registered_pki_security_domain_url}"
-	echo "    =========================================================================="
-
-	return 0
-}
-
-get_pki_secure_port()
-{
-	# establish well-known strings
-	listen_statement="Listen"
-
-	# first check to see that an instance-specific "nss.conf" file exists
-	if [ ! -f ${PKI_NSS_CONF} ] ; then
-		echo "File '${PKI_NSS_CONF}' does not exist!"
-		exit ${default_error}
-	fi
-
-	# read this instance-specific "nss.conf" file line-by-line
-	# to obtain the current value of the "clientauth" PKI secure port
-	exec < ${PKI_NSS_CONF}
-	while read line; do
-		# look for the listen statement
-		head=`echo $line | cut -b1-6`
-		if [ "$head" == "$listen_statement" ] ; then
-			# once the 'clientauth' listen statement has been found,
-			# extract the numeric port information
-			port=`echo $line | cut -b8-`
-			SECURE_PORT=$port
-			return 0
-		fi
-	done
-
-	return ${default_error}
-}
-
-display_instance_status()
-{
-	rv=0
-
-	if [ -f ${pidfile} ] ; then
-		pid=`cat ${pidfile}`
-		if [ "${pid}" == "" ] ; then
-			echo "${PKI_INSTANCE_ID} pid file exists but is empty"
-			if [ "${command}" != "status" ]; then
-				# * 1 generic or unspecified error (current practice)
-				rv=1
-			else
-				# * 4 program or service status is unknown
-				rv=4
-			fi
-		elif kill -0 ${pid} > /dev/null 2>&1 ; then
-			echo "${PKI_INSTANCE_ID} (pid ${pid}) is running ..."
-			echo
-			check_pki_configuration_status
-			rv=$?
-			if [ ${rv} -eq 0 ] ; then
-				get_pki_status_definitions
-				rv=$?
-				if [ ${rv} -ne 0 ] ; then
-					echo
-					echo "${PKI_INSTANCE_ID} Status Definitions not found"
-				else
-					get_pki_configuration_definitions
-					rv=$?
-					if [ ${rv} -ne 0 ] ; then
-						echo
-						echo "${PKI_INSTANCE_ID} Configuration Definitions not found"
-					fi
-				fi
-			else
-				# From the PKI point of view for a "non-status" action,
-				# a returned error code of "6" implies that the program
-				# is not "configured".  Similarly, an error code of "1"
-				# implies that the program was "configured" but must
-				# still be restarted.
-				#
-				# Similarly, from the PKI point of view for a "status"
-				# action, a returned error code of "4" implies that either
-				# the program is not "configured", or that the program
-				# was "configured" but must still be restarted.
-				#
-				# Regardless, it must still be considered that the instance
-				# is "running" from the viewpoint of other OS programs such
-				# as 'chkconfig'.
-				#
-				# For this reason, when returning from
-				# 'display_instance_status()', ignore non-zero return codes
-				# returned from 'check_pki_configuration_status()'.
-				#
-				if [ "${command}" != "status" ]; then
-					# * 0 action was successful
-					rv=0
-				else
-					# * 0 program is running or service is OK
-					rv=0
-				fi
-			fi
-			echo
-		else
-			echo "${PKI_INSTANCE_ID} is dead but pid file exists"
-			if [ "${command}" != "status" ]; then
-				# * 1 generic or unspecified error (current practice)
-				rv=1
-			else
-				# * 1 program is dead and /var/run pid file exists
-				rv=1
-			fi
-		fi
-	else
-		echo "${PKI_INSTANCE_ID} is stopped"
-		if [ "${command}" != "status" ]; then
-			# * 7 program is not running
-			rv=7
-		else
-			# * 3 program is not running
-			rv=3
-		fi
-	fi
-
-	return ${rv}
-}
-
-start_instance()
-{
-	rv=0
-
-	echo -n $"Starting ${prog}: "
-
-	if [ -f ${RESTART_SERVER} ] ; then
-		rm -f ${RESTART_SERVER}
-	fi
-
-	if [ -f ${PKI_LOCKFILE} ] ; then
-		if [ -f ${pidfile} ]; then
-			read kpid < ${pidfile}
-			if checkpid $kpid 2>&1; then
-				echo
-				echo "${PKI_INSTANCE_ID} (pid ${kpid}) is already running ..."
-				echo
-				check_pki_configuration_status
-				rv=$?
-				if [ ${rv} != 0 ]; then
-					# From the PKI point of view for a "non-status" action,
-					# a returned error code of "6" implies that the program
-					# is not "configured".  Similarly, an error code of "1"
-					# implies that the program was "configured" but must
-					# still be restarted.
-					#
-					# Regardless, it must still be considered that the instance
-					# is "running" from the viewpoint of other OS programs such
-					# as 'chkconfig'.
-					#
-					# For "non-status" actions, ignore return codes of "1"
-					# from 'check_pki_configuration_status()'.
-					#
-					# However, for "non-status" actions that have a return
-					# code of "6", return this value unchanged to
-					# the calling routine so that the total number of
-					# configuration errors may be counted.
-					#
-
-					echo
-					if [ ${rv} = 1 ] ; then
-						# * 0 action was successful
-						return 0
-					elif [ ${rv} = 6 ] ; then
-						# * 6 program is not configured
-						return 6
-					else
-						# should never be reached
-						return ${rv}
-					fi
-				else
-					return 0
-				fi
-			else
-				echo
-				echo -n "lock file found but no process "
-				echo -n "running for pid $kpid, continuing"
-				echo
-				echo
-				rm -f ${PKI_LOCKFILE}
-			fi
-		fi
-	fi
-
-	fix_pid_dir_ownership
-
-	touch ${pidfile}
-	chown ${PKI_USER}:${PKI_GROUP} ${pidfile}
-	chmod 00600 ${pidfile}
-	[ -x /sbin/restorecon ] && /sbin/restorecon  ${pidfile}
-
-	# restore context for ncipher hsm
-	[ -x /sbin/restorecon ] && [ -d /dev/nfast ] && /sbin/restorecon -R /dev/nfast
-
-	if [ -f /etc/init.d/functions ]; then
-		/usr/sbin/selinuxenabled
-		rv=$?
-		if [ ${rv} = 0 ] ; then	
-			if [ ${ARCHITECTURE} = "i386" ] ; then
-				LANG=${PKI_HTTPD_LANG} daemon runcon -t ${PKI_SELINUX_TYPE} -- ${httpd} ${PKI_OPTIONS}
-				# overwrite output from "daemon"
-				echo -n $"Starting ${prog}: "
-			elif [ ${ARCHITECTURE} = "x86_64" ] ; then
-				# NOTE:  "daemon" is incompatible with "httpd"
-				#        on 64-bit architectures
-				LANG=${PKI_HTTPD_LANG} runcon -t ${PKI_SELINUX_TYPE} -- ${httpd} ${PKI_OPTIONS}
-			fi
-		else
-			LANG=${PKI_HTTPD_LANG} daemon ${httpd} ${PKI_OPTIONS}
-			# overwrite output from "daemon"
-			echo -n $"Starting ${prog}: "
-		fi
-	else
-		LANG=${PKI_HTTPD_LANG} ${httpd} ${PKI_OPTIONS} -k start
-	fi
-
-	rv=$?
-	if [ ${rv} = 0 ] ; then
-		touch ${PKI_LOCKFILE}
-		chown ${PKI_USER}:${PKI_GROUP} ${PKI_LOCKFILE}
-		chmod 00600 ${PKI_LOCKFILE}
-	fi
-
-	if [ ${rv} = 0 ] ; then
-		count=0;
-
-		let swait=$STARTUP_WAIT
-		until	[ -s ${pidfile} ] ||
-				[ $count -gt $swait ]
-		do
-			echo -n "."
-			sleep 1
-			let count=$count+1;
-		done
-
-		if [ -f /etc/init.d/functions ]; then
-			if [ "$CONSOLETYPE" = "serial" ]; then
-				echo -n "                                       "
-			fi
-			echo_success
-			echo
-		else
-			echo "                                       [  OK  ]"
-		fi
-
-		get_pki_secure_port
-		if [ $? -ne 0 ] ; then
-			SECURE_PORT="<Port Undefined>"
-		fi
-
-		# Set permissions of log files
-		for file in ${pki_logs_directory}/*; do
-			chown ${PKI_USER}:${PKI_GROUP} ${file}
-			chmod 00640 ${file}
-		done
-
-		# ignore "status" return codes
-		echo
-		display_instance_status
-	else
-		if [ -f /etc/init.d/functions ]; then
-			if [ "$CONSOLETYPE" = "serial" ]; then
-				$0	echo -n "                                       "
-			fi
-			echo_failure
-			echo
-		else
-			echo "                                       [  FAILED  ]"
-		fi
-	fi
-
-	if [ ${OS} = "Linux" ] ; then
-		sleep 10
-	elif [ ${OS} = "SunOS" ] ; then
-		sleep 20
-	fi
-	return ${rv}
-}
-
-stop_instance()
-{
-	rv=0
+. /etc/init.d/functions
 
-	echo -n "Stopping ${prog}: "
-
-	if [ -f ${PKI_LOCKFILE} ] ; then
-		${httpd} ${PKI_OPTIONS} -k stop
-
-		rv=$?
-
-		if [ ${rv} = 0 ]; then
-			count=0;
-
-			if [ -f ${pidfile} ]; then
-				read kpid < ${pidfile}
-				let kwait=$SHUTDOWN_WAIT
-
-				until	[ `ps -p $kpid | grep -c $kpid` = '0' ] ||
-						[ $count -gt $kwait ]
-				do
-					echo -n "."
-					sleep 1
-					let count=$count+1;
-				done
-
-				if [ $count -gt $kwait ]; then
-					kill -9 $kpid
-				fi
-			fi
-
-			rm -f ${PKI_LOCKFILE}
-			rm -f ${pidfile}
-
-			if [ -f /etc/init.d/functions ]; then
-				if [ "$CONSOLETYPE" = "serial" ]; then
-					echo -n "                                       "
-				fi
-				echo_success
-				echo
-			else
-				echo "                                       [  OK  ]"
-			fi
-		else
-			if [ -f /etc/init.d/functions ]; then
-				if [ "$CONSOLETYPE" = "serial" ]; then
-					echo -n "                                       "
-				fi
-				echo_failure
-				echo
-			else
-				echo "                                       [  FAILED  ]"
-			fi
-			rv=${default_error}
-		fi
-	else
-		echo
-		echo "process already stopped"
-		rv=0
-	fi
-
-	return ${rv}
-}
-
-reload_instance()
-{
-	rv=0
-
-	echo -n $"Reloading ${prog}: "
-
-	if ! LANG=${PKI_HTTPD_LANG} ${httpd} ${PKI_OPTIONS} -t >&/dev/null; then
-		rv=$?
-		echo $"not reloading due to configuration syntax error"
-		if [ -f /etc/init.d/functions ]; then
-			failure $"not reloading ${httpd} due to configuration syntax error"
-		else
-			echo $"not reloading ${httpd} due to configuration syntax error"
-		fi
-	else
-		if [ -f /etc/init.d/functions ]; then
-			killproc -p ${pidfile} ${httpd} -HUP
-			rv=$?
-		else
-			if [ -f ${PKI_LOCKFILE} ] ; then
-				if [ -f ${pidfile} ]; then
-					read kpid < ${pidfile}
-					if checkpid $kpid 2>&1; then
-						kill -HUP $kpid
-						rv=$?
-						if [ ${rv} != 0 ]; then
-							rv=${default_error}
-						fi
-					fi
-				else
-					# * 7 program is not running
-					rv=7
-					echo
-					echo -n "lock file found but no process "
-					echo -n "running for pid $kpid, continuing"
-					echo
-					echo
-					rm -f ${PKI_LOCKFILE}
-				fi
-			fi
-		fi
-	fi
-	echo
-
-	return ${rv}
-}
-
-# The semantics of the 'start()' function differs from the way 'apachectl'
-# does things -- attempting to start while running is a failure.
-# So we just do it the way init scripts are expected to behave here.
-start()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		config_errors=0
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "BEGIN STARTING '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Start every PKI instance of this type that isn't already running
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			start_instance
-
-			rv=$?
-			if [ ${rv} = 6 ] ; then
-				# Since at least ONE configuration error exists, then there
-				# is at least ONE unconfigured instance from the PKI point
-				# of view.
-				#
-				# However, it must still be considered that the
-				# instance is "running" from the point of view of other
-				# OS programs such as 'chkconfig'.
-				#
-				# Therefore, ignore non-zero return codes resulting
-				# from configuration errors.
-				#
-
-				config_errors=`expr $config_errors + 1`
-				rv=0
-			elif [ ${rv} != 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt ${errors} ] ; then
-			touch ${lockfile}
-			chmod 00600 ${lockfile}
-		fi
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			# NOTE:  "bad" return code(s) OVERRIDE configuration errors!
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "1 generic or unspecified error (current practice)"
-				rv=1
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances failed to start!"
-				echo
-			fi
-
-			if [ ${TOTAL_UNCONFIGURED_PKI_ENTRIES} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${TOTAL_UNCONFIGURED_PKI_ENTRIES} "
-				echo -n "of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances MUST be configured!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED STARTING '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances installed!"
-		rv=5
-	fi
-
-	return ${rv}
-}
-
-# The semantics of the 'stop()' function differs from the way 'apachectl'
-# does things -- attempting to shutdown when not running is a failure.
-# So we just do it the way init scripts are expected to behave here.
-stop()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "BEGIN SHUTTING DOWN '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Shutdown every PKI instance of this type that is running
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			stop_instance
-
-			rv=$?
-			if [ ${rv} != 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		if [ ${errors} -eq 0 ] ; then
-			rm -f ${lockfile}
-		fi
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "1 generic or unspecified error (current practice)"
-				rv=1
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances were "
-				echo -n "unsuccessfully stopped!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED SHUTTING DOWN '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances installed!"
-		rv=5
-	fi
-
-	return ${rv}
-}
-
-restart()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	stop
-	sleep 2
-	echo
-	echo "============================================================"
-	echo
-	start
-
-	return $?
-}
-
-reload()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "BEGIN RELOADING '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Reload every PKI instance of this type that is running
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			reload_instance
-
-			rv=$?
-			if [ ${rv} != 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "1 generic or unspecified error (current practice)"
-				rv=1
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances were "
-				echo -n "unsuccessfully reloaded!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED RELOADING '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances reloaded!"
-		rv=5
-	fi
-
-	return ${rv}
-}
-
-status()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 program is running or service is OK
-	#     * 1 program is dead and /var/run pid file exists
-	#     * 2 program is dead and /var/lock lock file exists
-	#     * 3 program is not running
-	#     * 4 program or service status is unknown
-	#     * 5-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "REPORT STATUS OF '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Obtain status of every PKI instance of this type
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			display_instance_status
-
-			rv=$?
-			if [ ${rv} -ne 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "4 - program or service status is unknown"
-				rv=4
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances reported status failures!"
-				echo
-			fi
-
-			if [ ${TOTAL_UNCONFIGURED_PKI_ENTRIES} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${TOTAL_UNCONFIGURED_PKI_ENTRIES} "
-				echo -n "of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances MUST be configured!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED REPORTING STATUS OF '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances installed!"
-		rv=4
-	fi
-
-	return ${rv}
-}
+# Source the PKI function library
+. /usr/share/pki/scripts/functions
 
 # See how we were called.
-case "${command}" in
-	start|stop|restart|reload|status)
-		${command}
-		exit $?
-		;;
-	condrestart|force-restart|try-restart)
-		[ ! -f ${lockfile} ] || restart
-		exit $?
-		;;
-	*)
-		# * 3 unimplemented feature (for example, "reload")
-		#     [invalid command - should never be reached]
-		echo
-		usage
-		echo "where valid instance names include:"
-		list_instances
-		exit 3
-		;;
+case $command in
+    status)
+	registry_status
+	exit $?
+	;;
+    start)
+	start
+	exit $?
+	;;
+    restart)
+	restart
+	exit $?
+	;;
+    stop)
+	stop
+	exit $?
+	;;
+    condrestart|force-restart|try-restart)
+        [ ! -f ${lockfile} ] || restart
+        exit $?
+        ;;
+    reload)
+        echo "The 'reload' action is an unimplemented feature."
+        exit ${default_error}
+        ;;
+    *)
+	echo "unknown action ($command)"
+        usage
+        echo "where valid instance names include:"
+        list_instances
+        exit ${default_error}
+        ;;
 esac
 
diff --git a/pki/base/ra/setup/config.desktop b/pki/base/ra/setup/config.desktop
index 15dbad3b7..30935ef83 100644
--- a/pki/base/ra/setup/config.desktop
+++ b/pki/base/ra/setup/config.desktop
@@ -19,7 +19,7 @@
 [Desktop Entry]
 Version=1.0.0
 Encoding=UTF-8
-Name=Registration Authority Configuration - [INSTANCE_ID]
+Name=Registration Authority Configuration - [PKI_INSTANCE_ID]
 GenericName=Registration Authority Configuration
 Comment=Configure Registration Authority 
 Exec=firefox https://[SERVER_NAME]:[SECURE_PORT]/ra/admin/console/config/login?pin=[PKI_RANDOM_NUMBER]
diff --git a/pki/base/ra/setup/registry_instance b/pki/base/ra/setup/registry_instance
new file mode 100644
index 000000000..09ec620cb
--- /dev/null
+++ b/pki/base/ra/setup/registry_instance
@@ -0,0 +1,117 @@
+# Establish PKI Variable "Slot" Substitutions
+
+PKI_FLAVOR=[PKI_FLAVOR]
+export PKI_FLAVOR
+
+PKI_SUBSYSTEM_TYPE=[PKI_SUBSYSTEM_TYPE]
+export PKI_SUBSYSTEM_TYPE
+
+PKI_USER=[PKI_USER]
+export PKI_USER
+
+PKI_GROUP=[PKI_GROUP]
+export PKI_GROUP
+
+PKI_INSTANCE_ID=[PKI_INSTANCE_ID]
+export PKI_INSTANCE_ID
+
+PKI_INSTANCE_INITSCRIPT=[PKI_INSTANCE_INITSCRIPT]
+export PKI_INSTANCE_INITSCRIPT
+
+PKI_HTTPD_CONF=[HTTPD_CONF]
+export PKI_HTTPD_CONF
+
+PKI_SERVER_ROOT=[SERVER_ROOT]
+export PKI_SERVER_ROOT
+
+PKI_SYSTEM_USER_LIBRARIES=[SYSTEM_USER_LIBRARIES]
+export PKI_SYSTEM_USER_LIBRARIES
+
+PKI_FORTITUDE_DIR=[FORTITUDE_DIR]
+export PKI_FORTITUDE_DIR
+
+PKI_NSS_CONF=[NSS_CONF]
+export PKI_NSS_CONF
+
+PKI_SERVER_NAME=[SERVER_NAME]
+export PKI_SERVER_NAME
+
+PKI_LOCK_FILE="[PKI_LOCKDIR]/${PKI_INSTANCE_ID}.pid"
+export PKI_LOCK_FILE
+
+PKI_PID_FILE="[PKI_PIDDIR]/${PKI_INSTANCE_ID}.pid"
+export PKI_PID_FILE
+
+PKI_SELINUX_TYPE="pki_ra_t"
+export PKI_SELINUX_TYPE
+
+pki_instance_configuration_file=${PKI_SERVER_ROOT}/conf/CS.cfg
+export pki_instance_configuration_file
+
+RESTART_SERVER=${PKI_SERVER_ROOT}/conf/restart_server_after_configuration
+export RESTART_SERVER
+
+########################################################################
+#   This section contains modified content of "/etc/sysconfig/httpd"   #
+########################################################################
+# Configuration file for the ${PKI_INSTANCE_ID} service.
+
+#
+# The default processing model (MPM) is the process-based
+# 'prefork' model.  A thread-based model, 'worker', is also
+# available, but does not work with some modules (such as PHP).
+# The service must be stopped before changing this variable.
+#
+PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd.worker
+export PKI_HTTPD
+
+#
+# To pass additional options (for instance, -D definitions) to the
+# httpd binary at startup, set PKI_OPTIONS here.
+#
+PKI_OPTIONS="-f ${PKI_HTTPD_CONF}"
+export PKI_OPTIONS
+
+#
+# By default, the httpd process is started in the C locale; to
+# change the locale in which the server runs, the PKI_HTTPD_LANG
+# variable can be set.
+#
+PKI_HTTPD_LANG=C
+export PKI_HTTPD_LANG
+########################################################################
+#                                                                      #
+########################################################################
+
+# This will prevent initlog from swallowing up a pass-phrase prompt if
+# mod_ssl needs a pass-phrase from the user.
+PKI_INITLOG_ARGS=""
+export PKI_INITLOG_ARGS
+
+# Set PKI_HTTPD=/usr/sbin/httpd.worker in /etc/sysconfig/httpd to use a server
+# with the thread-based "worker" MPM; BE WARNED that some modules may not
+# work correctly with a thread-based MPM; notably PHP will refuse to start.
+
+# Path to the server binary and short-form for messages.
+httpd=${PKI_HTTPD}
+export httpd
+
+pki_logs_directory=${PKI_SERVER_ROOT}/logs
+export pki_logs_directory
+
+# see if httpd is linked with the openldap libraries - we need to override them
+if [ ${OS} = "Linux" ]; then
+    hasopenldap=0
+
+    /usr/bin/ldd ${httpd} 2>&1 | grep libldap- > /dev/null 2>&1 && hasopenldap=1
+
+    if [ ${hasopenldap} -eq 1 ] ; then
+        LD_PRELOAD="${PKI_SYSTEM_USER_LIBRARIES}/libldap60.so"
+        LD_PRELOAD="${PKI_SYSTEM_USER_LIBRARIES}/libssl3.so:${LD_PRELOAD}"
+        export LD_PRELOAD
+    fi
+elif [ ${OS} = "SunOS" ]; then
+    LD_PRELOAD_64="${PKI_SYSTEM_USER_LIBRARIES}/libldap60.so"
+    LD_PRELOAD_64="${PKI_SYSTEM_USER_LIBRARIES}/dirsec/libssl3.so:${LD_PRELOAD_64}"
+    export LD_PRELOAD_64
+fi
diff --git a/pki/base/setup/pkicommon b/pki/base/setup/pkicommon
index 725a84358..d408459f3 100755
--- a/pki/base/setup/pkicommon
+++ b/pki/base/setup/pkicommon
@@ -29,7 +29,7 @@ our @EXPORT = qw(
  $lib_prefix $obj_ext $path_sep $tmp_dir $logfile
  $pki_flavor $pki_registry_path
  $verbose $dry_run $hostname $default_hardware_platform
- $default_system_binaries $default_system_libraries $default_system_user_binaries
+ $default_system_binaries $default_lockdir $default_system_libraries $default_system_user_binaries
  $default_system_user_libraries $default_system_jni_java_path
  $default_security_libraries $default_certutil_command
  $default_ldapmodify_command $default_modutil_command
@@ -69,7 +69,7 @@ our @EXPORT = qw(
  directory_exists is_directory_empty create_directory copy_directory remove_directory
  set_owner_group_on_directory_contents
  symlink_exists create_symlink remove_symlink set_owner_group_on_symlink
- run_command get_registry_initscript_name 
+ run_command get_cs_cfg get_registry_initscript_name 
  register_pki_instance_with_chkconfig deregister_pki_instance_with_chkconfig
  );
 
@@ -165,6 +165,7 @@ our $pki_registry_path             = undef;
 
 our $default_hardware_platform     = undef;
 our $default_system_binaries       = undef;
+our $default_lockdir               = undef;
 our $default_system_libraries      = undef;
 our $default_system_user_binaries  = undef;
 our $default_system_user_libraries = undef;
@@ -191,6 +192,7 @@ if ($^O eq "linux") {
     $default_registry_path = "/etc/sysconfig";
     $pki_registry_path = "$default_registry_path/$pki_flavor";
     $default_initscripts_path = "/etc/rc.d/init.d";
+    $default_lockdir = "/var/lock/$pki_flavor";
     $default_hardware_platform = `uname -i`;
     $default_hardware_platform =~ s/\s+$//g;
     chomp($default_hardware_platform);
@@ -3209,6 +3211,90 @@ sub run_command
 # Generic PKI Subroutines
 ##############################################################
 
+# Get parameter value(s) from CS.cfg file
+#
+# get_cs_cfg(config_path, search)
+#
+# There are 3 ways the parameters can be returned, as a string, as a
+# set of variables, or as a hash table depending on the search
+# parameter type.
+#
+# If search is string then the parameter value is returned as a string
+# if it was found, otherwise if it wasn't found then undef is
+# returned.
+#
+# If search is a reference to a hash then each key in the hash will be
+# searched for and the key's value will be used as a reference to
+# assign the value of the parameter to. If the key was not found then
+# the reference will be assigned the value of undef.
+#
+# If search is reference to an array then every parameter in the
+# array will be searched for and a hash will be returned with a key
+# for every parameter found, the key's value is the parameter value.
+#
+# Examples:
+#  
+# my ($subsystem_type, $uri, $table);
+#
+# # Get a single string: $subsystem_type is assigned the string "CA"
+# $subsystem_type = get_cs_cfg("/etc/pki-ca/CS.cfg", "cs.type");
+#
+# # Assign a set of variables: $subsystem_type and $uri are assigned
+# get_cs_cfg($config_path, {"cs.type" => \$subsystem_type,
+#                           "ee.interface.uri" => \$uri});
+# 
+# # Get a lookup table:
+# $table = get_cs_cfg("/etc/pki-ca/CS.cfg", ["cs.type", "ee.interface.uri"]);
+# # returns the hash:
+# # {"cs.type"          => "CA",
+# #  "ee.interface.uri" => "ca/ee/ca"}
+#
+sub get_cs_cfg
+{
+    my ($config_path, $search) = @_;
+    my ($text, $key, $value, $num_found);
+
+    $text = read_file($config_path);
+
+    if (ref($search) eq "HASH") {
+        my $num_found = 0;
+        while (my ($key, $ref) = each(%$search)) {
+            if ($text =~ /^\s*\Q$key\E\s*=\s*(.*)/m) {
+                $value = $1;
+                $$ref = $value;
+                $num_found += 1;
+            } else {
+                $$ref = undef;
+            }
+        }
+        return $num_found;
+    } elsif (ref($search) eq "ARRAY") {
+        my $result = {};
+        my $keys = $search;
+
+        foreach $key (@$keys) {
+            if ($text =~ /^\s*\Q$key\E\s*=\s*(.*)/m) {
+                $value = $1;
+                $result->{$key} = $value;
+            }
+        }
+
+        return $result;
+
+    } else {
+        my $result = undef;
+        $key = $search;
+
+        if ($text =~ /^\s*\Q$key\E\s*=\s*(.*)/m) {
+            $value = $1;
+            $result = $value;
+        }
+
+        return $result;
+
+    }
+}
+
 sub get_registry_initscript_name
 {
     my ($subsystem_type) = @_;
diff --git a/pki/base/setup/pkicreate b/pki/base/setup/pkicreate
index f8d723eb8..aeb7a311e 100755
--- a/pki/base/setup/pkicreate
+++ b/pki/base/setup/pkicreate
@@ -174,7 +174,6 @@ my $addAgents_ldif_base_name     = "addAgents.ldif";       # TPS
 my $addIndexes_ldif_base_name    = "addIndexes.ldif";      # TPS
 my $addTokens_ldif_base_name     = "addTokens.ldif";       # TPS
 my $addVLVIndexes_ldif_base_name = "addVLVIndexes.ldif";   # TPS
-my $apachectl_base_name          = "apachectl";            # TPS
 my $nss_pcache_base_name         = "nss_pcache";           # RA, TPS
 my $certsrv_jar_base_name        = "certsrv.jar";          # CA, KRA, OCSP, TKS
 my $nsutil_jar_base_name         = "nsutil.jar";           # CA, KRA, OCSP, TKS
@@ -220,6 +219,7 @@ my $web_xml_base_name             = "web.xml";                # CA, KRA, OCSP, T
 my $profile_select_base_name      = "ProfileSelect.template"; # CA
 
 my $registry_template_base_name   = "registry_instance";      # CA, KRA, OCSP, TKS, RA, TPS
+my $pki_apache_initscript_base_name = "pki_apache_initscript"; # RA, TPS
 
 # Subdirectory names
 my $perl_base_instance_symlink      = "perl";        # RA, TPS
@@ -247,10 +247,7 @@ my $db_password_low  = 100000000000;
 my $db_password_high = 999999999999;
 
 # Template slot constants (RA, TPS)
-my $GROUPID                    = "GROUPID";
 my $HTTPD_CONF                 = "HTTPD_CONF";
-my $INSTANCE_ID                = "INSTANCE_ID";
-my $INSTANCE_ROOT              = "INSTANCE_ROOT";
 my $LIB_PREFIX                 = "LIB_PREFIX";
 my $NSS_CONF                   = "NSS_CONF";
 my $OBJ_EXT                    = "OBJ_EXT";
@@ -261,12 +258,10 @@ my $NON_CLIENTAUTH_SECURE_PORT = "NON_CLIENTAUTH_SECURE_PORT";
 my $SECURITY_LIBRARIES         = "SECURITY_LIBRARIES";
 my $SERVER_NAME                = "SERVER_NAME";
 my $SERVER_ROOT                = "SERVER_ROOT";
-my $SUBSYSTEM_TYPE             = "SUBSYSTEM_TYPE";
 my $SYSTEM_LIBRARIES           = "SYSTEM_LIBRARIES";
 my $SYSTEM_USER_LIBRARIES      = "SYSTEM_USER_LIBRARIES";
 my $TMP_DIR                    = "TMP_DIR";
 my $TPS_DIR                    = "TPS_DIR";
-my $USERID                     = "USERID";
 my $FORTITUDE_APACHE           = "FORTITUDE_APACHE";
 my $FORTITUDE_DIR              = "FORTITUDE_DIR";
 my $FORTITUDE_MODULE           = "FORTITUDE_MODULE";
@@ -274,6 +269,12 @@ my $FORTITUDE_LIB_DIR          = "FORTITUDE_LIB_DIR";
 my $FORTITUDE_AUTH_MODULES     = "FORTITUDE_AUTH_MODULES";
 my $FORTITUDE_NSS_MODULES      = "FORTITUDE_NSS_MODULES";
 my $REQUIRE_CFG_PL             = "REQUIRE_CFG_PL";
+my $PKI_PIDDIR                 = "PKI_PIDDIR";
+my $PKI_LOCKDIR                = "PKI_LOCKDIR";
+
+# Template slot constants (CA, KRA, OCSP, TKS, RA, TPS)
+my $PKI_INSTANCE_ID_SLOT       = "PKI_INSTANCE_ID";
+my $PKI_REGISTRY_FILE_SLOT     = "PKI_REGISTRY_FILE";
 
 # Template slot constants (CA, KRA, OCSP, TKS)
 my $INSTALL_TIME                        = "INSTALL_TIME";
@@ -281,7 +282,6 @@ my $PKI_AGENT_CLIENTAUTH_SLOT           = "PKI_AGENT_CLIENTAUTH";
 my $PKI_CERT_DB_PASSWORD_SLOT           = "PKI_CERT_DB_PASSWORD";
 my $PKI_CFG_PATH_NAME_SLOT              = "PKI_CFG_PATH_NAME";
 my $PKI_GROUP_SLOT                      = "PKI_GROUP";
-my $PKI_INSTANCE_ID_SLOT                = "PKI_INSTANCE_ID";
 my $PKI_INSTANCE_PATH_SLOT              = "PKI_INSTANCE_PATH";
 my $PKI_INSTANCE_ROOT_SLOT              = "PKI_INSTANCE_ROOT";
 my $PKI_MACHINE_NAME_SLOT               = "PKI_MACHINE_NAME";
@@ -397,7 +397,7 @@ my $scripts_subsystem_path   = undef;  # RA, TPS
 my $shared_subsystem_path    = undef;  # CA, KRA, OCSP, TKS (Tomcat)
 my $temp_subsystem_path      = undef;  # CA, KRA, OCSP, TKS (Tomcat)
 my $webapps_subsystem_path   = undef;  # CA, KRA, OCSP, TKS
-my $common_ui_subsystem_path = undef; # CA, KRA, OCSP, TKS, RA, TPS
+my $common_ui_subsystem_path = undef;  # CA, KRA, OCSP, TKS, RA, TPS
 my $ui_subsystem_path        = undef;  # CA, KRA, OCSP, TKS, RA, TPS
 my $work_subsystem_path      = undef;  # CA, KRA, OCSP, TKS (Tomcat)
 
@@ -420,6 +420,8 @@ my $temp_instance_path              = undef;  # CA, KRA, OCSP, TKS (Tomcat)
 my $webapps_instance_path           = undef;  # CA, KRA, OCSP, TKS
 my $webapps_subsystem_instance_path = undef;  # CA, KRA, OCSP, TKS
 my $work_instance_path              = undef;  # CA, KRA, OCSP, TKS (Tomcat)
+my $pki_piddir_path                 = undef;  # RA, TPS
+my $pki_lockdir_path                = undef;  # RA, TPS
 
 # Base instance symbolic link paths
 my $conf_instance_symlink_path    = undef;  # CA, KRA, OCSP, TKS, RA, TPS
@@ -448,8 +450,6 @@ my $addTokens_ldif_instance_file_path            = undef;  # TPS
 my $addTokens_ldif_subsystem_file_path           = undef;  # TPS
 my $addVLVIndexes_ldif_instance_file_path        = undef;  # TPS
 my $addVLVIndexes_ldif_subsystem_file_path       = undef;  # TPS
-my $apachectl_instance_file_path                 = undef;  # TPS
-my $apachectl_subsystem_file_path                = undef;  # TPS
 my $jakarta_commons_collections_jar_file_path    = undef;  # CA, KRA, OCSP, TKS
 my $jakarta_commons_collections_jar_symlink_path = undef;  # CA, KRA, OCSP, TKS
 my $jakarta_commons_logging_jar_file_path        = undef;  # CA, KRA, OCSP, TKS
@@ -499,8 +499,9 @@ my $perl_instance_symlink_path                   = undef;  # RA, TPS
 my $perl_subsystem_path                          = undef;  # RA, TPS
 my $pfile_instance_file_path                     = undef;  # CA, KRA, OCSP, TKS, RA, TPS
 my $pwcache_conf_instance_file_path              = undef;  # RA, TPS
-my $pki_cfg_instance_file_path                   = undef;  # CA, KRA, OCSP, TKS, RA, TPS
 my $pki_cfg_subsystem_file_path                  = undef;  # CA, KRA, OCSP, TKS, RA, TPS
+my $pki_cfg_instance_file_path                   = undef;  # CA, KRA, OCSP, TKS, RA, TPS
+my $pki_apache_initscript_file_path              = undef;  # RA, TPS
 my $schemaMods_ldif_instance_file_path           = undef;  # RA, TPS
 my $schemaMods_ldif_subsystem_file_path          = undef;  # RA, TPS
 my $server_xml_instance_file_path                = undef;  # CA, KRA, OCSP, TKS
@@ -1561,14 +1562,19 @@ sub initialize_subdirectory_paths
     }
 
     ## Initialize subdirectory paths (RA, TPS subsystems)
+    if ($subsystem_type eq $TPS) {
+            $cgi_sow_subsystem_file_path           = $cgibin_subsystem_path
+                                                   . "/"
+                                                   . $cgi_sow_dir_name;
+            $cgi_sow_instance_cfg_pl_path          = $cgibin_instance_path
+                                                   . "/"
+                                                   . $cgi_sow_cfg_pl_name;
+    }
+
     if ($subsystem_type eq $RA  || $subsystem_type eq $TPS) {
 
         if ($subsystem_type eq $TPS) {
 
-            $apachectl_instance_file_path          = $bin_instance_path
-                                                   . "/" . $apachectl_base_name;
-            $apachectl_subsystem_file_path         = $bin_subsystem_path
-                                                   . "/" . $apachectl_base_name;
             $cgi_home_instance_file_path           = $cgibin_instance_path
                                                    . "/"
                                                    . $cgi_home_base_name;
@@ -1596,12 +1602,6 @@ sub initialize_subdirectory_paths
             $cgi_sow_instance_file_path            = $cgibin_instance_path
                                                    . "/"
                                                    . $cgi_sow_dir_name;
-            $cgi_sow_subsystem_file_path           = $cgibin_subsystem_path
-                                                   . "/"
-                                                   . $cgi_sow_dir_name;
-            $cgi_sow_instance_cfg_pl_path          = $cgibin_instance_path
-                                                   . "/"
-                                                   . $cgi_sow_cfg_pl_name;
             $addAgents_ldif_instance_file_path     = $scripts_instance_path
                                                    . "/"
                                                    . $addAgents_ldif_base_name;
@@ -1634,6 +1634,13 @@ sub initialize_subdirectory_paths
                                                    . $schemaMods_ldif_base_name;
         }
 
+        $pki_piddir_path                        = $default_apache_pids_path
+                                                . "/" . $subsystem_type;
+        $pki_lockdir_path                       = $default_lockdir
+                                                . "/" . $subsystem_type;
+        $pki_apache_initscript_file_path        = $pki_subsystem_common_area
+                                                . "/" . $scripts_base_subsystem_dir
+                                                . "/" . $pki_apache_initscript_base_name;
         $nss_pcache_instance_file_path          = $scripts_instance_path
                                                 . "/"
                                                 . $nss_pcache_base_name;
@@ -1834,10 +1841,10 @@ sub process_pki_directories
 
             # only copy selected files
             return 0 if !copy_file($magic_subsystem_file_path, $magic_instance_file_path,
-                                   $default_file_permissions);
+                                   $default_file_permissions, $pki_user, $pki_group);
 
             return 0 if !copy_file($mime_types_subsystem_file_path, $mime_types_instance_file_path,
-                                   $default_file_permissions);
+                                   $default_file_permissions, $pki_user, $pki_group);
 
         } else {
             $server_xml_instance_file_path   = $conf_instance_path
@@ -1883,10 +1890,10 @@ sub process_pki_directories
 
             # only copy selected files
             return 0 if !copy_file($magic_subsystem_file_path, $magic_instance_file_path,
-                $default_file_permissions);
+                                   $default_file_permissions, $pki_user, $pki_group);
 
             return 0 if !copy_file($mime_types_subsystem_file_path, $mime_types_instance_file_path,
-                                   $default_file_permissions);
+                                   $default_file_permissions, $pki_user, $pki_group);
 
         } else {
             $server_xml_instance_file_path   = $redirected_conf_path
@@ -2017,10 +2024,6 @@ sub process_pki_directories
                 set_permissions("${cgibin_instance_path}/sow/*.html",  $default_file_permissions);
                 set_permissions("${cgibin_instance_path}/sow/*.pl",    $default_exe_permissions);
             }
-
-            # Apache Specific
-            set_permissions("${docroot_instance_path}/GenericAuth.html", $default_file_permissions);
-            set_permissions("${docroot_instance_path}/style.css",        $default_file_permissions);
         }
     } else {
         ## Populate instance directory paths (CA, KRA, OCSP, TKS instances)
@@ -2098,7 +2101,9 @@ sub process_file_template
     my $buf = "";
     my $num_subs = 0;
     my $total_subs = 0;
-
+    my @keys;
+    my $key;
+    my $value;
     emit("    Template ($template_name) \"${src_path}\" ==> \"${dst_path}\" ...\n");
 
     # Check for a valid source file
@@ -2118,7 +2123,9 @@ sub process_file_template
 
     # Process each line substituting each [KEY]
     # with its corresponding slot hash value
-    while(my ($key, $value) = each(%$substitutions)) {
+    @keys = sort(keys %$substitutions);
+    foreach $key (@keys) {
+        $value = $substitutions->{$key};
         # Perform global substitution on buffer and
         # get count of how many substitutions were actually performed.
         $num_subs = $buf =~ s/\[$key\]/$value/g;
@@ -2138,10 +2145,16 @@ sub process_file_template
 
     emit("    $total_subs substitutions were made in '$dst_path'\n");
 
+    # Sanity check, are there any strings left in the buffer which look
+    # like a substitution.
+    foreach my $match ($buf =~ /\[[A-Z_]+\]/g) {
+        emit("WARNING: Possible missed substitution \"$match\" in $src_path");
+    }
+
     # Record that we've installed this file.
     add_install_info($dst_path, 'file');
 
-    if ($verbose > 2) {
+    if ($verbose >= 2) {
         # For debugging, emit the contents after substitution.
         emit(sprintf(">> $dst_path\n%s<< $dst_path\n", $buf));
     }
@@ -2171,12 +2184,21 @@ sub process_pki_templates
 
     emit("Processing PKI templates for '$pki_instance_path' ...\n");
 
+    $slot_hash{$PKI_SUBSYSTEM_TYPE_SLOT}   = $subsystem_type;
+    $slot_hash{$PKI_INSTANCE_ID_SLOT}      = $pki_instance_name;
+    $slot_hash{$PKI_INSTANCE_ROOT_SLOT}    = $pki_instance_root;
+    $slot_hash{$PKI_INSTANCE_INITSCRIPT}   = $pki_instance_initscript_path;
+    $slot_hash{$PKI_REGISTRY_FILE_SLOT}    = $pki_registry_instance_file_path;
+    $slot_hash{$PKI_USER_SLOT}             = $pki_user;
+    $slot_hash{$PKI_GROUP_SLOT}            = $pki_group;
+
+    if ($subsystem_type eq $TPS) {
+        $slot_hash{$REQUIRE_CFG_PL}        = "require \"${cgi_sow_instance_cfg_pl_path}\";";
+    }
+
     if ($subsystem_type eq $RA || $subsystem_type eq $TPS) {
         # Setup templates (RA, TPS)
-        $slot_hash{$GROUPID}               = $pki_group;
         $slot_hash{$HTTPD_CONF}            = $httpd_conf_instance_file_path;
-        $slot_hash{$INSTANCE_ID}           = $pki_instance_name;
-        $slot_hash{$INSTANCE_ROOT}         = $pki_instance_root;
         $slot_hash{$LIB_PREFIX}            = $lib_prefix;
         $slot_hash{$NSS_CONF}              = $nss_conf_instance_file_path;
         $slot_hash{$OBJ_EXT}               = $obj_ext;
@@ -2187,15 +2209,14 @@ sub process_pki_templates
         $slot_hash{$SECURITY_LIBRARIES}    = $default_security_libraries;
         $slot_hash{$SERVER_NAME}           = $host;
         $slot_hash{$SERVER_ROOT}           = $pki_instance_path;
-        $slot_hash{$SUBSYSTEM_TYPE}        = $subsystem_type;
         $slot_hash{$SYSTEM_LIBRARIES}      = $default_system_libraries;
         $slot_hash{$SYSTEM_USER_LIBRARIES} = $default_system_user_libraries;
         $slot_hash{$TMP_DIR}               = $tmp_dir;
         $slot_hash{$TPS_DIR}               = $pki_subsystem_path;
-        $slot_hash{$USERID}                = $pki_user;
         $slot_hash{$PKI_FLAVOR_SLOT}       = $pki_flavor;
         $slot_hash{$PKI_RANDOM_NUMBER_SLOT} = $random;
-        $slot_hash{$REQUIRE_CFG_PL}        = "require \"${cgi_sow_instance_cfg_pl_path}\";";
+        $slot_hash{$PKI_PIDDIR}            = $pki_piddir_path;
+        $slot_hash{$PKI_LOCKDIR}           = $pki_lockdir_path;
         if (is_Fedora() || (is_RHEL() && (! is_RHEL4()))) {
             $slot_hash{$FORTITUDE_APACHE}  = "Apache2";
             $slot_hash{$FORTITUDE_DIR}     = "/usr";
@@ -2234,19 +2255,14 @@ LoadModule nss_module  /opt/fortitude/modules.local/libmodnss.so
         $slot_hash{$INSTALL_TIME}              = localtime;
         $slot_hash{$PKI_CERT_DB_PASSWORD_SLOT} = $db_password;
         $slot_hash{$PKI_CFG_PATH_NAME_SLOT}    = $pki_cfg_instance_file_path;
-        $slot_hash{$PKI_GROUP_SLOT}            = $pki_group;
-        $slot_hash{$PKI_INSTANCE_ID_SLOT}      = $pki_instance_name;
         $slot_hash{$PKI_INSTANCE_PATH_SLOT}    = $pki_instance_path;
-        $slot_hash{$PKI_INSTANCE_ROOT_SLOT}    = $pki_instance_root;
         $slot_hash{$PKI_MACHINE_NAME_SLOT}     = $host;
         $slot_hash{$PKI_RANDOM_NUMBER_SLOT}    = $random;
         $slot_hash{$PKI_SERVER_XML_CONF}       = $server_xml_instance_file_path;
-        $slot_hash{$PKI_SUBSYSTEM_TYPE_SLOT}   = $subsystem_type;
         $slot_hash{$PKI_UNSECURE_PORT_SLOT}    = $unsecure_port;
 
         # Define "Port Separation" (default) versus "Shared Ports" (legacy)
-        if ($use_port_separation) 
-        {
+        if ($use_port_separation) {
             # Establish "Port Separation" Connector Names
             $slot_hash{$PKI_UNSECURE_PORT_CONNECTOR_NAME_SLOT}     = $PKI_UNSECURE_PORT_NAME;
             $slot_hash{$PKI_SECURE_PORT_CONNECTOR_NAME_SLOT}       = $PKI_AGENT_SECURE_PORT_NAME;
@@ -2314,7 +2330,6 @@ LoadModule nss_module  /opt/fortitude/modules.local/libmodnss.so
         } 
 
         $slot_hash{$PKI_WEBAPPS_NAME}          = $webapps_base_subsystem_dir; 
-        $slot_hash{$PKI_USER_SLOT}             = $pki_user;
         $slot_hash{$PKI_FLAVOR_SLOT}           = $pki_flavor;
         $slot_hash{$TOMCAT_SERVER_PORT_SLOT}   = $tomcat_server_port;
         $slot_hash{$TOMCAT_PIDFILE}            = $tomcat6_instance_pid_file_path;
@@ -2338,7 +2353,6 @@ LoadModule nss_module  /opt/fortitude/modules.local/libmodnss.so
                                           . "-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,"
                                           . "-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA";
         $slot_hash{$TOMCAT_INSTANCE_COMMON_LIB} = "$tomcat_instance_common_lib_path/*.jar";
-        $slot_hash{$PKI_INSTANCE_INITSCRIPT}    = $pki_instance_initscript_path;
     }
 
     ## Process templates (instance independent)
@@ -2349,8 +2363,8 @@ LoadModule nss_module  /opt/fortitude/modules.local/libmodnss.so
     # process "CS.cfg" template
     return 0 if !process_file_template("pki_cfg",
                                        $pki_cfg_subsystem_file_path,
-                                     $pki_cfg_instance_file_path,
-                                     \%slot_hash);
+                                       $pki_cfg_instance_file_path,
+                                       \%slot_hash);
     return 0 if !set_file_props($pki_cfg_instance_file_path,
                                 $default_file_permissions, $pki_user, $pki_group);
 
@@ -2386,14 +2400,6 @@ LoadModule nss_module  /opt/fortitude/modules.local/libmodnss.so
 
         if ($subsystem_type eq $TPS) {
 
-          # process "apachectl" template
-          return 0 if !process_file_template("apachectl",
-                                             $apachectl_subsystem_file_path,
-                                             $apachectl_instance_file_path,
-                                             \%slot_hash);
-          set_permissions($apachectl_instance_file_path, $default_exe_permissions);
-
-
           # process "cgi" template
           return 0 if !process_file_template("cgi_home",
                                              $cgi_home_subsystem_file_path,
@@ -2500,6 +2506,15 @@ LoadModule nss_module  /opt/fortitude/modules.local/libmodnss.so
         return 0 if !set_permissions($nss_pcache_instance_file_path,
                                      $default_exe_permissions);
 
+        # process "pki_apache_initscript" template
+        return 0 if !process_file_template("pki_apache_initscript",
+                                           $pki_apache_initscript_file_path,
+                                           $pki_instance_initscript_path,
+                                           \%slot_hash);
+
+        return 0 if !set_permissions($pki_instance_initscript_path,
+                                     $default_exe_permissions);
+
 
     } else {
         ## Process templates (CA, KRA, OCSP, TKS instances)
diff --git a/pki/base/setup/pkiremove b/pki/base/setup/pkiremove
index 272384cb2..bf347e28c 100755
--- a/pki/base/setup/pkiremove
+++ b/pki/base/setup/pkiremove
@@ -105,6 +105,7 @@ my $pki_instance_root               = undef;
 my $pki_instance_name               = undef;
 my $force                           = 0;
 
+my $conf_file                       = undef;
 my $pki_instance_path               = undef;
 my $subsystem_type                  = undef;
 
@@ -163,7 +164,6 @@ EOF
 
 sub update_domain
 {
-    my $conf_file = $pki_instance_path . "/conf/CS.cfg";
     my $sport;
     my $ncsport;
     my $sechost;
@@ -175,32 +175,23 @@ sub update_domain
     my $agentsport;
     my $secselect;
     my $subsystemnick;
-    my $typeval;
     my $machinename;
     my $subsytemnick;
     my $url;
     
-    open(DAT, $conf_file) or die "Could not open CS.cfg file to update security domain";
-    my @conf_data=<DAT>;
-    foreach my $line (@conf_data) {
-        chomp($line);
-        (my $varname, my $valname) = split(/=/, $line);
-
-        if ($varname eq "cs.type") { $typeval = $valname; }
-        if ($varname eq "service.machineName") { $machinename = $valname; }
-        if ($varname eq "service.securityDomainPort") { $sport = $valname; }
-        if ($varname eq "service.non_clientauth_securePort") { $ncsport = $valname; }
-        if ($varname eq "securitydomain.host") { $sechost = $valname; }
-        if ($varname eq "securitydomain.httpport") { $httpport = $valname; }
-        if ($varname eq "securitydomain.httpseeport") { $seceeport = $valname; }
-        if ($varname eq "securitydomain.httpsagentport") { $secagentport = $valname; }
-        if ($varname eq "securitydomain.httpsadminport") { $secadminport = $valname; }
-        if ($varname eq "securitydomain.select") { $secselect = $valname; }
-        if ($varname eq "pkiremove.cert.subsystem.nickname") { $subsystemnick = $valname; }
-        if ($varname eq "pkicreate.admin_secure_port") { $adminsport = $valname; }
-        if ($varname eq "pkicreate.agent_secure_port") { $agentsport = $valname; }
-    }
-    close(DAT);
+    get_cs_cfg($conf_file, {"service.machineName"               => \$machinename,
+                            "service.securityDomainPort"        => \$sport,
+                            "service.non_clientauth_securePort" => \$ncsport,
+                            "securitydomain.host"               => \$sechost,
+                            "securitydomain.httpport"           => \$httpport,
+                            "securitydomain.httpseeport"        => \$seceeport,
+                            "securitydomain.httpsagentport"     => \$secagentport,
+                            "securitydomain.httpsadminport"     => \$secadminport,
+                            "securitydomain.select"             => \$secselect,
+                            "pkiremove.cert.subsystem.nickname" => \$subsystemnick,
+                            "pkicreate.admin_secure_port"       => \$adminsport,
+                            "pkicreate.agent_secure_port"       => \$agentsport});
+
 
     # NOTE:  Don't check for the existence of $httpport, as this will
     #        be undefined for a Security Domain that has been migrated!
@@ -216,7 +207,7 @@ sub update_domain
     if ($secselect ne "new") {
         # This is not a domain master, so we need to update the master
         print(STDOUT "Contacting the security domain master to update the security domain\n");
-        my $listval = $typeval . "List";
+        my $listval = $subsystem_type . "List";
         my $urlheader = "https://" . $sechost . ":" . $seceeport; 
         my $urlagentheader = "https://" . $sechost . ":" . $secagentport; 
         my $urladminheader = "https://" . $sechost . ":" . $secadminport; 
@@ -235,10 +226,11 @@ sub update_domain
         my @pw_data=<DAT>;
         foreach my $line (@pw_data) {
             chomp($line);
-            if (($typeval eq "CA")   ||
-                ($typeval eq "KRA")  ||
-                ($typeval eq "OCSP") ||
-                ($typeval eq "TKS")) {
+
+            if (($subsystem_type eq $CA)   ||
+                ($subsystem_type eq $KRA)  ||
+                ($subsystem_type eq $OCSP) ||
+                ($subsystem_type eq $TKS)) {
                 (my $varname, my $valname) = split(/=/, $line);
                 if ($varname eq "internal") { $intpw = $valname; }
             } else {  # TPS, RA
@@ -269,7 +261,7 @@ sub update_domain
         my $response = $browser->post($url, 
             [
                 'name'       => $pki_instance_name,
-                'type'       => $typeval,
+                'type'       => $subsystem_type,
                 'list'       => $listval,
                 'host'       => $machinename,
                 'sport'      => $sport,
@@ -317,8 +309,10 @@ sub remove_selinux_fcontexts
     my $ftype;
     my $java_component        = 0;
 
-    if (($subsystem_type eq "ca") || ($subsystem_type eq "kra") || ($subsystem_type eq "ocsp")
-        || ($subsystem_type eq "tks")) {
+    if (($subsystem_type eq $CA)   ||
+        ($subsystem_type eq $KRA)  ||
+        ($subsystem_type eq $OCSP) ||
+        ($subsystem_type eq $TKS)) {
         $java_component=1;
     }
 
@@ -373,30 +367,19 @@ sub remove_selinux_ports
 {
     my $status;
     my $semanage = "/usr/sbin/semanage";
-    my $conf_file = $pki_instance_path . "/conf/CS.cfg";
-    my $typeval;
     my $secure_port;
     my $non_clientauth_secure_port;
     my $unsecure_port;
     my @ports = ();
 
-    # get cs type
-    open(DAT, $conf_file) or die "Could not open CS.cfg file.";
-    my @conf_data=<DAT>;
-    foreach my $line (@conf_data) {
-        chomp($line);
-        (my $varname, my $valname) = split(/=/, $line);
-        if ($varname eq "cs.type") { $typeval = $valname; }
-        if ($varname eq "service.securePort") { $secure_port = $valname; }
-        if ($varname eq "service.non_clientauth_securePort") { $non_clientauth_secure_port = $valname; }
-        if ($varname eq "service.unsecurePort") { $unsecure_port = $valname; }
-    }
-    close(DAT);
+    get_cs_cfg($conf_file, {"service.securePort"                => \$secure_port,
+                            "service.non_clientauth_securePort" => \$non_clientauth_secure_port,
+                            "service.unsecurePort"              => \$unsecure_port});
 
-    # for use in other routines
-    $subsystem_type =  lc($typeval);
-
-    if (($typeval eq "CA") || ($typeval eq "KRA") || ($typeval eq "OCSP") || ($typeval eq "TKS")) {
+    if (($subsystem_type eq $CA)   ||
+        ($subsystem_type eq $KRA)  ||
+        ($subsystem_type eq $OCSP) ||
+        ($subsystem_type eq $TKS)) {
         use XML::LibXML;
         my $parser = XML::LibXML->new();
         my $config = $parser->parse_file($pki_instance_path . "/conf/server.xml") 
@@ -427,7 +410,7 @@ sub remove_selinux_ports
 
     print(STDOUT "\n");
     foreach my $port (@ports) {
-        my $setype = "pki_" . lc($typeval) . "_port_t";
+        my $setype = "pki_" . $subsystem_type . "_port_t";
         my $errs;
         print STDOUT "Removing port $port from selinux policy.\n";
 	next if $dry_run;
@@ -548,11 +531,11 @@ sub main
     }
 
     # Parse command-line arguments.
-    $result = GetOptions("pki_instance_root=s"  => \$pki_instance_root,
-                          "pki_instance_name=s" => \$pki_instance_name,
-                          "verbose+"            => \$verbose,
-                          "dry_run"             => \$dry_run,
-                          "force"               => \$force);
+    $result = GetOptions("pki_instance_root=s" => \$pki_instance_root,
+                         "pki_instance_name=s" => \$pki_instance_name,
+                         "verbose+"            => \$verbose,
+                         "dry_run"             => \$dry_run,
+                         "force"               => \$force);
 
     # Always disallow root to be the pki_instance_root.
     if ($pki_instance_root eq "/") {
@@ -608,6 +591,14 @@ sub main
     emit("    pki_instance_name   $pki_instance_name\n");
     emit("    pki_instance_path   $pki_instance_path\n");
 
+    $conf_file = $pki_instance_path . "/conf/CS.cfg";
+    $subsystem_type = get_cs_cfg($conf_file, "cs.type");
+    if (!defined($subsystem_type)) {
+        emit("Could not determine the subsystem type from the file \"$conf_file\"\n", "error");
+        exit 1;
+    }
+    $subsystem_type =  lc($subsystem_type);
+
     # Remove the specified instance
     $result = remove_instance();
     if ($result != 1) {
diff --git a/pki/base/tks/build.xml b/pki/base/tks/build.xml
index 6ff2de31e..21ec940b6 100644
--- a/pki/base/tks/build.xml
+++ b/pki/base/tks/build.xml
@@ -191,6 +191,7 @@
                         filemode="644"
                         prefix="usr/share/${product.prefix}/${product}/setup">
                 <include name="config.desktop"/>
+                <include name="registry_instance"/>
             </zipfileset>
             <zipfileset dir="./shared/etc/init.d"
                         filemode="755"
@@ -198,15 +199,9 @@
                 <include name="pki-tksd"/>
             </zipfileset>
             <zipfileset dir="./shared"
-                        filemode="755"
-                        prefix="usr/share/${product.prefix}/${product}">
-                <include name="conf/dtomcat5"/>
-            </zipfileset>
-            <zipfileset dir="./shared"
                         filemode="644"
                         prefix="usr/share/${product.prefix}/${product}">
                 <include name="**"/>
-                <exclude name="conf/dtomcat5"/>
                 <exclude name="etc/init.d/pki-tksd"/>
             </zipfileset>
             <zipfileset dir="."
@@ -230,6 +225,7 @@
                         mode="644"
                         prefix="${dist.name}/usr/share/${product.prefix}/${product}/setup">
                 <include name="config.desktop"/>
+                <include name="registry_instance"/>
             </tarfileset>
             <tarfileset dir="./shared/etc/init.d"
                         mode="755"
@@ -237,15 +233,9 @@
                 <include name="pki-tksd"/>                 
             </tarfileset>
             <tarfileset dir="./shared"
-                        mode="755"
-                        prefix="${dist.name}/usr/share/${product.prefix}/${product}">
-                <include name="conf/dtomcat5"/>
-            </tarfileset>
-            <tarfileset dir="./shared"
                         mode="644"
                         prefix="${dist.name}/usr/share/${product.prefix}/${product}">
                 <include name="**"/>
-                <exclude name="conf/dtomcat5"/>
                 <exclude name="etc/init.d/pki-tksd"/>
             </tarfileset>
             <tarfileset dir="."
diff --git a/pki/base/tks/setup/registry_instance b/pki/base/tks/setup/registry_instance
new file mode 100644
index 000000000..7f0e592a1
--- /dev/null
+++ b/pki/base/tks/setup/registry_instance
@@ -0,0 +1,54 @@
+# Establish PKI Variable "Slot" Substitutions
+
+PKI_FLAVOR=[PKI_FLAVOR]
+export PKI_FLAVOR
+
+PKI_SUBSYSTEM_TYPE=[PKI_SUBSYSTEM_TYPE]
+export PKI_SUBSYSTEM_TYPE
+
+PKI_USER=[PKI_USER]
+export PKI_USER
+
+PKI_GROUP=[PKI_GROUP]
+export PKI_GROUP
+
+PKI_INSTANCE_ID=[PKI_INSTANCE_ID]
+export PKI_INSTANCE_ID
+
+PKI_INSTANCE_PATH=[PKI_INSTANCE_PATH]
+export PKI_INSTANCE_PATH
+
+PKI_INSTANCE_INITSCRIPT=[PKI_INSTANCE_INITSCRIPT]
+export PKI_INSTANCE_INITSCRIPT
+
+PKI_SERVER_XML_CONF=[PKI_SERVER_XML_CONF]
+export PKI_SERVER_XML_CONF
+
+# Use CATALINA_BASE
+
+CATALINA_BASE=$PKI_INSTANCE_PATH
+export CATALINA_BASE
+
+TOMCAT_PROG=$PKI_INSTANCE_ID
+export TOMCAT_PROG
+
+TOMCAT_USER=$PKI_USER
+export TOMCAT_USER
+
+TOMCAT_GROUP=$PKI_GROUP
+export TOMCAT_GROUP
+
+PKI_LOCKDIR="/var/lock/${PKI_FLAVOR}/${PKI_SUBSYSTEM_TYPE}"
+export PKI_LOCKDIR
+
+PKI_LOCKFILE="${PKI_LOCKDIR}/${PKI_INSTANCE_ID}.pid"
+export PKI_LOCKFILE
+
+TOMCAT_PIDFILE=[TOMCAT_PIDFILE]
+export TOMCAT_PIDFILE
+
+pki_instance_configuration_file=${PKI_INSTANCE_PATH}/conf/CS.cfg
+export pki_instance_configuration_file
+
+RESTART_SERVER=${PKI_INSTANCE_PATH}/conf/restart_server_after_configuration
+export RESTART_SERVER
diff --git a/pki/base/tks/shared/conf/catalina.policy b/pki/base/tks/shared/conf/catalina.policy
index 8f481e333..cf8302cd0 100644
--- a/pki/base/tks/shared/conf/catalina.policy
+++ b/pki/base/tks/shared/conf/catalina.policy
@@ -1,5 +1,26 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// Copyright (C) 2006-2010 Red Hat, Inc.
+// All rights reserved.
+// Modifications: configuration parameters
+// --- END COPYRIGHT BLOCK ---
+
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 // ============================================================================
-// catalina.corepolicy - Security Policy Permissions for Tomcat 5
+// catalina.corepolicy - Security Policy Permissions for Tomcat 6
 //
 // This file contains a default set of security policies to be enforced (by the
 // JVM) when Catalina is executed with the "-security" option.  In addition
@@ -40,35 +61,16 @@ grant codeBase "file:${java.home}/lib/ext/-" {
 // ========== CATALINA CODE PERMISSIONS =======================================
 
 
-// These permissions apply to the launcher code
-grant codeBase "file:${catalina.home}/bin/commons-launcher.jar" {
-        permission java.security.AllPermission;
-};
-
 // These permissions apply to the daemon code
 grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {
         permission java.security.AllPermission;
 };
 
-// These permissions apply to the commons-logging API
-grant codeBase "file:${catalina.home}/bin/commons-logging-api.jar" {
-        permission java.security.AllPermission;
-};
-
-// These permissions apply to the server startup code
-grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
-        permission java.security.AllPermission;
-};
-
-// These permissions apply to the JMX server
-grant codeBase "file:${catalina.home}/bin/jmx.jar" {
-        permission java.security.AllPermission;
-};
-
-// These permissions apply to JULI
+// These permissions apply to the logging API
 grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
         permission java.util.PropertyPermission "java.util.logging.config.class", "read";
         permission java.util.PropertyPermission "java.util.logging.config.file", "read";
+        permission java.io.FilePermission "${java.home}${file.separator}lib${file.separator}logging.properties", "read"; 
         permission java.lang.RuntimePermission "shutdownHooks";
         permission java.io.FilePermission "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read";
         permission java.util.PropertyPermission "catalina.base", "read";
@@ -82,24 +84,19 @@ grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
         // permission java.io.FilePermission "${catalina.base}${file.separator}webapps${file.separator}examples${file.separator}WEB-INF${file.separator}classes${file.separator}logging.properties", "read";
 };
 
-// These permissions apply to the servlet API classes
-// and those that are shared across all class loaders
-// located in the "common" directory
-grant codeBase "file:${catalina.home}/common/-" {
+// These permissions apply to the server startup code
+grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
         permission java.security.AllPermission;
 };
 
-// These permissions apply to the container's core code, plus any additional
-// libraries installed in the "server" directory
-grant codeBase "file:${catalina.home}/server/-" {
+// These permissions apply to the servlet API classes
+// and those that are shared across all class loaders
+// located in the "lib" directory
+grant codeBase "file:${catalina.home}/lib/-" {
         permission java.security.AllPermission;
 };
 
-// The permissions granted to the balancer WEB-INF/classes and WEB-INF/lib directory
-grant codeBase "file:${catalina.home}/webapps/balancer/-" {
-        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.util.digester";
-        permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.util.digester.*";
-};
+
 // ========== WEB APPLICATION PERMISSIONS =====================================
 
 
@@ -147,6 +144,9 @@ grant {
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime";
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime.*";
     
+    // Precompiled JSPs need access to this system property.
+    permission java.util.PropertyPermission "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read";
+
 };
 
 
@@ -182,58 +182,3 @@ grant {
 //      permission java.net.SocketPermission "*.noaa.gov:80", "connect";
 // };
 
-
-
-// These permissions apply to Tomcat5 java
-grant codeBase "file:/usr/share/java/tomcat5/-" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/jakarta-commons-modeler.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/jasper5-compiler.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/jasper5-runtime.jar" {
-        permission java.security.AllPermission;
-};
-
-
-
-// These permissions apply to PKI configuration
-grant codeBase "file:/usr/share/java/velocity.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/tomcat5-servlet-2.4-api.jar" {
-        permission java.security.AllPermission;
-};
-
-
-
-
-// These permissions apply to PKI support
-grant codeBase "file:/usr/share/java/ldapjdk.jar" {
-        permission java.security.AllPermission;
-};
-
-
-
-// These permissions apply to PKI
-grant codeBase "file:/usr/lib/java/jss4.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/tomcatjss.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/lib/java/osutil.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/lib/java/symkey.jar" {
-        permission java.security.AllPermission;
-};
-grant codeBase "file:/usr/share/java/pki/-" {
-        permission java.security.AllPermission;
-};
-
-
-
diff --git a/pki/base/tks/shared/conf/catalina.properties b/pki/base/tks/shared/conf/catalina.properties
index 3778ce4f6..70cb7c05e 100644
--- a/pki/base/tks/shared/conf/catalina.properties
+++ b/pki/base/tks/shared/conf/catalina.properties
@@ -1,8 +1,24 @@
 # --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2006 Red Hat, Inc.
+# Copyright (C) 2006-2010 Red Hat, Inc.
 # All rights reserved.
+# Modifications: configuration parameters
 # --- END COPYRIGHT BLOCK ---
+
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
 #
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 #
 # List of comma-separated packages that start with or equal this string
 # will cause a security exception to be thrown when
@@ -34,7 +50,7 @@ package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,org.apache
 #     "foo/*.jar": Add all the JARs of the specified folder as class 
 #                  repositories
 #     "foo/bar.jar": Add bar.jar as a class repository
-common.loader=${catalina.home}/common/classes,${catalina.home}/common/i18n/*.jar,${catalina.home}/common/endorsed/*.jar,${catalina.home}/common/lib/*.jar
+common.loader=${catalina.home}/lib,${catalina.home}/lib/*.jar,[TOMCAT_INSTANCE_COMMON_LIB]
 
 #
 # List of comma-separated paths defining the contents of the "server" 
@@ -47,7 +63,7 @@ common.loader=${catalina.home}/common/classes,${catalina.home}/common/i18n/*.jar
 #     "foo/*.jar": Add all the JARs of the specified folder as class 
 #                  repositories
 #     "foo/bar.jar": Add bar.jar as a class repository
-server.loader=${catalina.home}/server/classes,${catalina.home}/server/lib/*.jar
+server.loader=
 
 #
 # List of comma-separated paths defining the contents of the "shared" 
@@ -59,7 +75,9 @@ server.loader=${catalina.home}/server/classes,${catalina.home}/server/lib/*.jar
 #     "foo/*.jar": Add all the JARs of the specified folder as class 
 #                  repositories
 #     "foo/bar.jar": Add bar.jar as a class repository 
-shared.loader=${catalina.base}/shared/classes,${catalina.base}/shared/lib/*.jar
+# Please note that for single jars, e.g. bar.jar, you need the URL form
+# starting with file:.
+shared.loader=
 
 #
 # String cache configuration.
diff --git a/pki/base/tks/shared/conf/context.xml b/pki/base/tks/shared/conf/context.xml
index 60878b74b..8b6fe4905 100644
--- a/pki/base/tks/shared/conf/context.xml
+++ b/pki/base/tks/shared/conf/context.xml
@@ -1,9 +1,27 @@
+<?xml version='1.0' encoding='utf-8'?>
 <!-- BEGIN COPYRIGHT BLOCK
-     Copyright (C) 2006 Red Hat, Inc.
+     Copyright (C) 2006-2010 Red Hat, Inc.
      All rights reserved.
+     Modifications: configuration parameters
      END COPYRIGHT BLOCK -->
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
 <!-- The contents of this file will be loaded for each web application -->
-<Context crossContext="true">
+<Context crossContext="true" allowLinking="true">
 
     <!-- Default set of monitored resources -->
     <WatchedResource>WEB-INF/web.xml</WatchedResource>
@@ -13,4 +31,10 @@
     <Manager pathname="" />
     -->
 
+    <!-- Uncomment this to enable Comet connection tacking (provides events
+         on session expiration as well as webapp lifecycle) -->
+    <!--
+    <Valve className="org.apache.catalina.valves.CometConnectionManagerValve" />
+    -->
+
 </Context>
diff --git a/pki/base/tks/shared/conf/dtomcat5 b/pki/base/tks/shared/conf/dtomcat5
deleted file mode 100755
index 2eeb889e6..000000000
--- a/pki/base/tks/shared/conf/dtomcat5
+++ /dev/null
@@ -1,476 +0,0 @@
-#!/bin/bash
-#
-# --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2006 Red Hat, Inc.
-# All rights reserved.
-# --- END COPYRIGHT BLOCK ---
-#
-# -----------------------------------------------------------------------------
-# Start/Stop Script for the CATALINA Server
-#
-# Environment Variable Prequisites
-#
-#   CATALINA_HOME   May point at your Catalina "build" directory.
-#
-#   CATALINA_BASE   (Optional) Base directory for resolving dynamic portions
-#                   of a Catalina installation.  If not present, resolves to
-#                   the same directory that CATALINA_HOME points to.
-#
-#   CATALINA_OPTS   (Optional) Java runtime options used when the "start",
-#                   "stop", or "run" command is executed.
-#
-#   CATALINA_TMPDIR (Optional) Directory path location of temporary directory
-#                   the JVM should use (java.io.tmpdir).  Defaults to
-#                   $CATALINA_BASE/temp.
-#
-#   JAVA_HOME       Must point at your Java Development Kit installation.
-#                   Required to run the with the "debug" or "javac" argument.
-#
-#   JRE_HOME        Must point at your Java Development Kit installation.
-#                   Defaults to JAVA_HOME if empty.
-#
-#   JAVA_OPTS       (Optional) Java runtime options used when the "start",
-#                   "stop", or "run" command is executed.
-#
-#   JPDA_TRANSPORT  (Optional) JPDA transport used when the "jpda start"
-#                   command is executed. The default is "dt_socket".
-#
-#   JPDA_ADDRESS    (Optional) Java runtime options used when the "jpda start"
-#                   command is executed. The default is 8000.
-#
-#   JSSE_HOME       (Optional) May point at your Java Secure Sockets Extension
-#                   (JSSE) installation, whose JAR files will be added to the
-#                   system class path used to start Tomcat.
-#
-#   CATALINA_PID    (Optional) Path of the file which should contains the pid
-#                   of catalina startup java process, when start (fork) is used
-#
-# $Id$
-# -----------------------------------------------------------------------------
-
-# Disallow 'others' the ability to 'write' to new files
-umask 00002
-
-# Check to insure that this script's original invocation directory
-# has not been deleted!
-CWD=`/bin/pwd > /dev/null 2>&1`
-if [ $? -ne 0 ] ; then
-	echo "Cannot invoke '$0' from non-existent directory!"
-	exit 255
-fi
-
-# Check to insure that this script's associated PKI
-# subsystem currently resides on this system.
-PKI_SUBSYSTEM_TYPE=[PKI_SUBSYSTEM_TYPE]
-if [ ! -d /usr/share/pki/${PKI_SUBSYSTEM_TYPE} ] ; then
-	echo "This machine is missing the '${PKI_SUBSYSTEM_TYPE}' subsystem!"
-	exit 255
-fi
-
-# OS specific support.  $var _must_ be set to either true or false.
-OS=`uname -s`
-cygwin=false
-os400=false
-case "${OS}" in
-CYGWIN*) cygwin=true;;
-OS400*) os400=true;;
-esac
-
-TOMCAT_CFG=[PKI_INSTANCE_PATH]/conf/tomcat5.conf
-JAVADIR="/usr/share/java"
-
-# resolve links - $0 may be a softlink
-PRG="$0"
-
-while [ -h "$PRG" ]; do
-  ls=`ls -ld "$PRG"`
-  link=`expr "$ls" : '.*-> \(.*\)$'`
-  if expr "$link" : '.*/.*' > /dev/null; then
-    PRG="$link"
-  else
-    PRG=`dirname "$PRG"`/"$link"
-  fi
-done
-
-# Get standard environment variables
-PRGDIR=`dirname "$PRG"`
-
-# Only set CATALINA_HOME if not already set
-[ -z "$CATALINA_HOME" ] && CATALINA_HOME=`cd "$PRGDIR/.." ; pwd`
-
-if [ -r "$CATALINA_HOME"/bin/setenv.sh ]; then
-  . "$CATALINA_HOME"/bin/setenv.sh
-fi
-
-# For Cygwin, ensure paths are in UNIX format before anything is touched
-if $cygwin; then
-  [ -n "$JAVA_HOME" ] && JAVA_HOME=`cygpath --unix "$JAVA_HOME"`
-  [ -n "$JRE_HOME" ] && JRE_HOME=`cygpath --unix "$JRE_HOME"`
-  [ -n "$CATALINA_HOME" ] && CATALINA_HOME=`cygpath --unix "$CATALINA_HOME"`
-  [ -n "$CATALINA_BASE" ] && CATALINA_BASE=`cygpath --unix "$CATALINA_BASE"`
-  [ -n "$CLASSPATH" ] && CLASSPATH=`cygpath --path --unix "$CLASSPATH"`
-  [ -n "$JSSE_HOME" ] && JSSE_HOME=`cygpath --absolute --unix "$JSSE_HOME"`
-fi
-
-# For OS400
-if $os400; then
-  # Set job priority to standard for interactive (interactive - 6) by using
-  # the interactive priority - 6, the helper threads that respond to requests
-  # will be running at the same priority as interactive jobs.
-  COMMAND='chgjob job('$JOBNAME') runpty(6)'
-  system $COMMAND
-
-  # Enable multi threading
-  export QIBM_MULTI_THREADED=Y
-fi
-
-[ -r "$TOMCAT_CFG" ] && . "${TOMCAT_CFG}"
-
-### Set up defaults if they were omitted in TOMCAT_CFG
-###  JVM lookup
-if [ -z "$JAVA_HOME" ]; then
-    # Search for java in PATH
-    JAVA=`which java`
-    if [ -z "$JAVA" ] ; then
-        JAVA_BINDIR=`dirname ${JAVA}`
-        JAVA_HOME="${JAVA_BINDIR}/.."
-    fi
-    # Default clean JAVA_HOME
-    [ -z "$JAVA_HOME" -a -d "/usr/lib/java" ] && JAVA_HOME="/usr/lib/java"
-    # Default IBM JAVA_HOME
-    [ -z "$JAVA_HOME" -a -d "/opt/IBMJava2-13" ] && \
-        JAVA_HOME="/opt/IBMJava2-13"
-    [ -z "$JAVA_HOME" -a -d "/opt/IBMJava2-131" ] && \
-        JAVA_HOME="/opt/IBMJava2-131"
-    [ -z "$JAVA_HOME" -a -d "/opt/IBMJava2-14" ] && \
-        JAVA_HOME="/opt/IBMJava2-14"
-    [ -z "$JAVA_HOME" -a -d "/opt/IBMJava2-141" ] && \
-        JAVA_HOME="/opt/IBMJava2-141"
-    # Another solution
-    [ -z "$JAVA_HOME" -a -d "/usr/java/jdk" ] && \
-        JAVA_HOME="/usr/java/jdk"
-    # madeinlinux JAVA_HOME
-    [ -z "$JAVA_HOME" -a -d "/usr/local/jdk1.2.2" ] && \
-        JAVA_HOME="/usr/local/jdk1.2.2"
-    # Kondara JAVA_HOME
-    [ -z "$JAVA_HOME"  -a -d "/usr/lib/java/jdk1.2.2" ] && \
-        JAVA_HOME="/usr/lib/java/jdk1.2.2"
-    # Other commonly found JAVA_HOMEs
-    [ -z "$JAVA_HOME"  -a -d "/usr/jdk1.2" ] && JAVA_HOME="/usr/jdk1.2"
-    # Default Caldera JAVA_HOME
-    [ -z "$JAVA_HOME"  -a -d "/opt/java-1.3" ] && \
-        JAVA_HOME="/opt/java-1.3"
-    # Add other locations here
-    if [ -z "$JAVA_HOME" ]; then
-        echo "No JAVA_HOME specified in ${TOMCAT_CFG} and no java found"
-        exit 1
-    else
-        echo "Found JAVA_HOME: ${JAVA_HOME}"
-        echo "Please complete your ${TOMCAT_CFG} so we won't have to look for it next time"
-    fi
-fi
-
-# Set juli LogManager if it is present
-if [ -r "$CATALINA_HOME"/bin/tomcat-juli.jar ]; then
-  JAVA_OPTS="$JAVA_OPTS "-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
-fi
-
-# Set standard commands for invoking Java.
-_RUNJAVA="$JAVA_HOME"/bin/java
-_RUNJAVAC="$JAVA_HOME"/bin/javac
-_RUNJDB="$JAVA_HOME"/bin/jdb
-
-# Set standard CLASSPATH
-# (always inherit any preset values from the PKI start script)
-if [ ${OS} = "Linux" ] ; then
-	# Checking for OpenJDK JVM
-	OPENJDK_JVM="`java -version 2>&1 | tail -1 | awk '{print $1};'`"
-	if	[ "${OPENJDK_JVM}" = "OpenJDK" ] ||
-		[ "${OPENJDK_JVM}" = "IcedTea" ]; then
-		# using OpenJDK
-		CLASSPATH="$CLASSPATH":"$JAVA_HOME"/lib/rt.jar
-
-		# add required classes to the CLASSPATH for OpenJDK
-		CLASSPATH="$CLASSPATH":"$JAVADIR"/commons-collections.jar
-	else
-		# NOT using OpenJDK
-		CLASSPATH="$CLASSPATH":"$JAVA_HOME"/lib/tools.jar
-	fi
-elif [ ${OS} = "SunOS" ] ; then
-	CLASSPATH="$CLASSPATH":"$JAVA_HOME"/lib/rt.jar
-fi
-
-# Add on extra jar files to CLASSPATH
-if [ -n "$JSSE_HOME" ]; then
-  CLASSPATH="$CLASSPATH":"$JSSE_HOME"/lib/jcert.jar:"$JSSE_HOME"/lib/jnet.jar:"$JSSE_HOME"/lib/jsse.jar
-fi
-
-# JPackage JSSE location check
-if [ -r "$JAVADIR/jsse/jcert.jar" ]; then
-  CLASSPATH="$CLASSPATH":"$JAVADIR"/jsse/jcert.jar:"$JAVADIR"/jsse/jnet.jar:"$JAVADIR"/jsse/jsse.jar
-fi
-
-if [ ${OS} = "Linux" ] ; then
-	CLASSPATH="$CLASSPATH":"$CATALINA_HOME"/bin/bootstrap.jar:"$CATALINA_HOME"/bin/commons-logging-api.jar:`/usr/bin/build-classpath mx4j/mx4j-impl`:`/usr/bin/build-classpath mx4j/mx4j-jmx`
-
-        # add jars in required components for velocity >= 1.6 (just in case)
-        VELOCITY=`rpm -q velocity|sed 's/velocity-\([0-9]*\)\.\([0-9]*\).*/\1\2/'`
-        if [ "$VELOCITY" -ge 16 ]; then 
-            CLASSPATH="$CLASSPATH":`/usr/bin/build-classpath bcel hsqldb commons-collections commons-lang commons-logging commons-logging-api jdom junit oro servletapi5 werken.xpath`
-        fi
-
-elif [ ${OS} = "SunOS" ] ; then
-	# The following definitions are provided for Solaris
-	# platforms since they are unable to execute the
-	# "/usr/bin/build-classpath" and
-	# "/usr/share/java-utils/java-functions" files . . .
-
-	CLASSPATH="$CLASSPATH":"$CATALINA_HOME"/bin/bootstrap.jar
-	CLASSPATH="$CLASSPATH":"$CATALINA_HOME"/bin/commons-logging-api.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-impl.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-jmx.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/base.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/certsrv.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cms.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cms72.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cms72_en.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cmsbundle.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cmscore.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/cmsutil.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/mcc70.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/mcc70_en.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/nmclf70.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/nmclf70_en.jar
-	CLASSPATH="$CLASSPATH":/usr/share/java/pki/nsutil.jar
-
-	if [ -f /usr/share/java/pkitools.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pkitools.jar
-	elif [ -f /usr/share/java/cstools.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/cstools.jar
-	elif [ -f /usr/share/java/pki/cstools.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/cstools.jar
-	fi
-
-	if [ -f /usr/share/java/ca.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/ca.jar
-	elif [ -f /usr/share/java/pki/ca/ca.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/ca/ca.jar
-	fi
-	if [ -f /usr/share/java/kra.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/kra.jar
-	elif [ -f /usr/share/java/pki/kra/kra.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/kra/kra.jar
-	fi
-	if [ -f /usr/share/java/ocsp.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/ocsp.jar
-	elif [ -f /usr/share/java/pki/ocsp/ocsp.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/ocsp/ocsp.jar
-	fi
-	if [ -f /usr/share/java/tks.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/tks.jar
-	elif [ -f /usr/share/java/pki/tks/tks.jar ]; then
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/tks/tks.jar
-	fi
-
-        # add jars for velocity 1.6 (just in case) 
-        CLASSPATH="$CLASSPATH":/usr/share/java/bcel.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/hsqldb.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/commons-collections.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/commons-lang.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/commons-logging.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/commons-logging-api.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/jdom.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/junit.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/oro.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/servletapi5.jar
-        CLASSPATH="$CLASSPATH":/usr/share/java/werken.xpath.jar
-
-fi
-
-if [ -z "$CATALINA_BASE" ] ; then
-  CATALINA_BASE="$CATALINA_HOME"
-fi
-
-if [ -z "$CATALINA_TMPDIR" ] ; then
-  # Define the java.io.tmpdir to use for Catalina
-  CATALINA_TMPDIR="$CATALINA_BASE"/temp
-fi
-
-if [ -z "$CATALINA_PID" ] ; then
-    export CATALINA_PID=/var/run/tomcat5.pid
-fi
-
-# For Cygwin, switch paths to Windows format before running java
-if $cygwin; then
-  JAVA_HOME=`cygpath --absolute --windows "$JAVA_HOME"`
-  JRE_HOME=`cygpath --absolute --windows "$JRE_HOME"`
-  CATALINA_HOME=`cygpath --absolute --windows "$CATALINA_HOME"`
-  CATALINA_BASE=`cygpath --absolute --windows "$CATALINA_BASE"`
-  CATALINA_TMPDIR=`cygpath --absolute --windows "$CATALINA_TMPDIR"`
-  CLASSPATH=`cygpath --path --windows "$CLASSPATH"`
-  [ -n "$JSSE_HOME" ] && JSSE_HOME=`cygpath --absolute --windows "$JSSE_HOME"`
-  JAVA_ENDORSED_DIRS=`cygpath --path --windows "$JAVA_ENDORSED_DIRS"`
-fi
-
-# ----- Execute The Requested Command -----------------------------------------
-echo "Using CATALINA_PID $CATALINA_PID"
-echo "Using CATALINA_BASE:   $CATALINA_BASE"
-echo "Using CATALINA_HOME:   $CATALINA_HOME"
-echo "Using CATALINA_TMPDIR: $CATALINA_TMPDIR"
-if [ "$1" = "debug" -o "$1" = "javac" ] ; then
-  echo "Using JAVA_HOME:       $JAVA_HOME"
-else
-  echo "Using JRE_HOME:       $JRE_HOME"
-fi
-
-if [ "$1" = "jpda" ] ; then
-  if [ -z "$JPDA_TRANSPORT" ]; then
-    JPDA_TRANSPORT="dt_socket"
-  fi
-  if [ -z "$JPDA_ADDRESS" ]; then
-    JPDA_ADDRESS="8000"
-  fi
-  if [ -z "$JPDA_OPTS" ]; then
-    JPDA_OPTS="-Xdebug -Xrunjdwp:transport=$JPDA_TRANSPORT,address=$JPDA_ADDRESS,server=y,suspend=n"
-  fi
-  CATALINA_OPTS="$CATALINA_OPTS $JPDA_OPTS"
-  shift
-fi
-
-if [ "$1" = "debug" ] ; then
-  if $os400; then
-    echo "Debug command not available on OS400"
-    exit 1
-  else
-    shift
-    if [ "$1" = "-security" ] ; then
-      echo "Using Security Manager"
-      shift
-      exec "$_RUNJDB" $JAVA_OPTS $CATALINA_OPTS \
-        -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-        -sourcepath "$CATALINA_HOME"/../../jakarta-tomcat-catalina/catalina/src/share \
-        -Djava.security.manager \
-        -Djava.security.policy=="$CATALINA_BASE"/conf/catalina.policy \
-        -Dcatalina.base="$CATALINA_BASE" \
-        -Dcatalina.home="$CATALINA_HOME" \
-        -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-        org.apache.catalina.startup.Bootstrap "$@" start
-    else
-      exec "$_RUNJDB" $JAVA_OPTS $CATALINA_OPTS \
-        -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-        -sourcepath "$CATALINA_HOME"/../../jakarta-tomcat-catalina/catalina/src/share \
-        -Dcatalina.base="$CATALINA_BASE" \
-        -Dcatalina.home="$CATALINA_HOME" \
-        -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-        org.apache.catalina.startup.Bootstrap "$@" start
-    fi
-  fi
-
-elif [ "$1" = "run" ]; then
-
-  shift
-  if [ "$1" = "-security" ] ; then
-    echo "Using Security Manager"
-    shift
-    exec "$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \
-      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-      -Djava.security.manager \
-      -Djava.security.policy=="$CATALINA_BASE"/conf/catalina.policy \
-      -Dcatalina.base="$CATALINA_BASE" \
-      -Dcatalina.home="$CATALINA_HOME" \
-      -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-      org.apache.catalina.startup.Bootstrap "$@" start
-  else
-    exec "$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \
-      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-      -Dcatalina.base="$CATALINA_BASE" \
-      -Dcatalina.home="$CATALINA_HOME" \
-      -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-      org.apache.catalina.startup.Bootstrap "$@" start
-  fi
-
-elif [ "$1" = "start" ] ; then
-
-  shift
-  touch "$CATALINA_BASE"/logs/catalina.out
-  if [ "$1" = "-security" ] ; then
-    echo "Using Security Manager"
-    shift
-    "$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \
-      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-      -Djava.security.manager \
-      -Djava.security.policy=="$CATALINA_BASE"/conf/catalina.policy \
-      -Dcatalina.base="$CATALINA_BASE" \
-      -Dcatalina.home="$CATALINA_HOME" \
-      -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-      org.apache.catalina.startup.Bootstrap "$@" start \
-      >> "$CATALINA_BASE"/logs/catalina.out 2>&1 &
-
-      if [ ! -z "$CATALINA_PID" ]; then
-        echo $! > $CATALINA_PID
-      fi
-  else
-    "$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \
-      -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-      -Dcatalina.base="$CATALINA_BASE" \
-      -Dcatalina.home="$CATALINA_HOME" \
-      -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-      org.apache.catalina.startup.Bootstrap "$@" start \
-      >> "$CATALINA_BASE"/logs/catalina.out 2>&1 &
-
-      if [ ! -z "$CATALINA_PID" ]; then
-        echo $! > $CATALINA_PID
-      fi
-  fi
-
-elif [ "$1" = "stop" ] ; then
-
-  shift
-  FORCE=0
-  if [ "$1" = "-force" ]; then
-    shift
-    FORCE=1
-  fi
-
-  "$_RUNJAVA" $JAVA_OPTS $CATALINA_OPTS \
-    -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" -classpath "$CLASSPATH" \
-    -Dcatalina.base="$CATALINA_BASE" \
-    -Dcatalina.home="$CATALINA_HOME" \
-    -Djava.io.tmpdir="$CATALINA_TMPDIR" \
-    org.apache.catalina.startup.Bootstrap "$@" stop
-
-  if [ $FORCE -eq 1 ]; then
-    if [ ! -z "$CATALINA_PID" ]; then
-       echo "Killing: `cat $CATALINA_PID`"
-       kill -9 `cat $CATALINA_PID`
-    fi
-  fi
-
-elif [ "$1" = "version" ] ; then
-
-    "$_RUNJAVA"   \
-      -classpath "$CATALINA_HOME/server/lib/catalina.jar" \
-      org.apache.catalina.util.ServerInfo
-
-else
-
-  echo "Usage: dtomcat5 ( commands ... )"
-  echo "commands:"
-  if $os400; then
-    echo "  debug             Start Catalina in a debugger (not available on OS400)"
-    echo "  debug -security   Debug Catalina with a security manager (not available on OS400)"
-  else
-    echo "  debug             Start Catalina in a debugger"
-    echo "  debug -security   Debug Catalina with a security manager"
-  fi
-  echo "  jpda start        Start Catalina under JPDA debugger"
-  echo "  run               Start Catalina in the current window"
-  echo "  run -security     Start in the current window with security manager"
-  echo "  start             Start Catalina in a separate window"
-  echo "  start -security   Start in a separate window with security manager"
-  echo "  stop              Stop Catalina"
-  echo "  stop -force       Stop Catalina (followed by kill -KILL)"
-  echo "  version           What version of tomcat are you running?"
-  exit 1
-
-fi
diff --git a/pki/base/tks/shared/conf/logging.properties b/pki/base/tks/shared/conf/logging.properties
new file mode 100644
index 000000000..796cfc071
--- /dev/null
+++ b/pki/base/tks/shared/conf/logging.properties
@@ -0,0 +1,70 @@
+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2006-2010 Red Hat, Inc.
+# All rights reserved.
+# Modifications: configuration parameters
+# --- END COPYRIGHT BLOCK ---
+
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+handlers = 1catalina.org.apache.juli.FileHandler, 2localhost.org.apache.juli.FileHandler, 3manager.org.apache.juli.FileHandler, 4host-manager.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler
+
+.handlers = 1catalina.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler
+
+############################################################
+# Handler specific properties.
+# Describes specific configuration info for Handlers.
+############################################################
+
+1catalina.org.apache.juli.FileHandler.level = FINE
+1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
+1catalina.org.apache.juli.FileHandler.prefix = catalina.
+
+2localhost.org.apache.juli.FileHandler.level = FINE
+2localhost.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
+2localhost.org.apache.juli.FileHandler.prefix = localhost.
+
+3manager.org.apache.juli.FileHandler.level = FINE
+3manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
+3manager.org.apache.juli.FileHandler.prefix = manager.
+
+4host-manager.org.apache.juli.FileHandler.level = FINE
+4host-manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
+4host-manager.org.apache.juli.FileHandler.prefix = host-manager.
+
+java.util.logging.ConsoleHandler.level = FINE
+java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
+
+
+############################################################
+# Facility specific properties.
+# Provides extra control for each logger.
+############################################################
+
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = INFO
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = 2localhost.org.apache.juli.FileHandler
+
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].level = INFO
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = 3manager.org.apache.juli.FileHandler
+
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].level = INFO
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = 4host-manager.org.apache.juli.FileHandler
+
+# For example, set the com.xyz.foo logger to only log SEVERE
+# messages:
+#org.apache.catalina.startup.ContextConfig.level = FINE
+#org.apache.catalina.startup.HostConfig.level = FINE
+#org.apache.catalina.session.ManagerBase.level = FINE
+#org.apache.catalina.core.AprLifecycleListener.level=FINE
diff --git a/pki/base/tks/shared/conf/server.xml b/pki/base/tks/shared/conf/server.xml
index 71b433bef..9a24cfa44 100644
--- a/pki/base/tks/shared/conf/server.xml
+++ b/pki/base/tks/shared/conf/server.xml
@@ -1,208 +1,196 @@
-<!-- Example Server Configuration File -->
-<!-- Note that component elements are nested corresponding to their
-     parent-child relationships with each other -->
-
-<!-- A "Server" is a singleton element that represents the entire JVM,
-     which may contain one or more "Service" instances.  The Server
-     listens for a shutdown command on the indicated port.
-
-     Note:  A "Server" is not itself a "Container", so you may not
-     define subcomponents such as "Valves" or "Loggers" at this level.
+<?xml version='1.0' encoding='utf-8'?>
+<!-- BEGIN COPYRIGHT BLOCK
+     Copyright (C) 2006-2010 Red Hat, Inc.
+     All rights reserved.
+     Modifications: configuration parameters
+     END COPYRIGHT BLOCK -->
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<!-- Note:  A "Server" is not itself a "Container", so you may not
+     define subcomponents such as "Valves" at this level.
+     Documentation at /docs/config/server.html
  -->
 
 <!-- DO NOT REMOVE - Begin PKI Status Definitions -->
 <!--
-Unsecure Port     = http://[PKI_MACHINE_NAME]:[PKI_UNSECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/ee/[PKI_SUBSYSTEM_TYPE]
-Secure Agent Port = https://[PKI_MACHINE_NAME]:[PKI_AGENT_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/agent/[PKI_SUBSYSTEM_TYPE]
-Secure EE Port    = https://[PKI_MACHINE_NAME]:[PKI_EE_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/ee/[PKI_SUBSYSTEM_TYPE]
-Secure Admin Port = https://[PKI_MACHINE_NAME]:[PKI_ADMIN_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/services
-PKI Console Port  = pkiconsole https://[PKI_MACHINE_NAME]:[PKI_ADMIN_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]
-Tomcat Port       = [TOMCAT_SERVER_PORT] (for shutdown)
+Unsecure Port       = http://[PKI_MACHINE_NAME]:[PKI_UNSECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/ee/[PKI_SUBSYSTEM_TYPE]
+Secure Agent Port   = https://[PKI_MACHINE_NAME]:[PKI_AGENT_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/agent/[PKI_SUBSYSTEM_TYPE]
+Secure EE Port      = https://[PKI_MACHINE_NAME]:[PKI_EE_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/ee/[PKI_SUBSYSTEM_TYPE]
+Secure Admin Port   = https://[PKI_MACHINE_NAME]:[PKI_ADMIN_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/services
+PKI Console Port    = pkiconsole https://[PKI_MACHINE_NAME]:[PKI_ADMIN_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]
+Tomcat Port         = [TOMCAT_SERVER_PORT] (for shutdown)
 -->
 <!-- DO NOT REMOVE - End PKI Status Definitions -->
 
 <Server port="[TOMCAT_SERVER_PORT]" shutdown="SHUTDOWN">
 
-  <!-- Comment these entries out to disable JMX MBeans support used for the 
-       administration web application -->
+  <!--APR library loader. Documentation at /docs/apr.html -->
+  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
+  <!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html -->
+  <Listener className="org.apache.catalina.core.JasperListener" />
+  <!-- JMX Support for the Tomcat server. Documentation at /docs/non-existent.html -->
   <Listener className="org.apache.catalina.mbeans.ServerLifecycleListener" />
   <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
-  <Listener className="org.apache.catalina.storeconfig.StoreConfigLifecycleListener"/>
 
-  <!-- Global JNDI resources -->
+  <!-- Global JNDI resources
+       Documentation at /docs/jndi-resources-howto.html
+  -->
   <GlobalNamingResources>
-
-    <!-- Test entry for demonstration purposes -->
-    <Environment name="simpleValue" type="java.lang.Integer" value="30"/>
-
     <!-- Editable user database that can also be used by
-         UserDatabaseRealm to authenticate users -->
+         UserDatabaseRealm to authenticate users
+    -->
     <Resource name="UserDatabase" auth="Container"
               type="org.apache.catalina.UserDatabase"
-       description="User database that can be updated and saved"
-           factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
-          pathname="conf/tomcat-users.xml" />
-
+              description="User database that can be updated and saved"
+              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
+              pathname="conf/tomcat-users.xml" />
   </GlobalNamingResources>
 
   <!-- A "Service" is a collection of one or more "Connectors" that share
-       a single "Container" (and therefore the web applications visible
-       within that Container).  Normally, that Container is an "Engine",
-       but this is not required.
-
-       Note:  A "Service" is not itself a "Container", so you may not
-       define subcomponents such as "Valves" or "Loggers" at this level.
+       a single "Container" Note:  A "Service" is not itself a "Container", 
+       so you may not define subcomponents such as "Valves" at this level.
+       Documentation at /docs/config/service.html
    -->
-
-  <!-- Define the Tomcat Stand-Alone Service -->
   <Service name="Catalina">
-
+  
+    <!--The connectors can use a shared executor, you can define one or more named thread pools-->
+    <!--
+    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-" 
+        maxThreads="150" minSpareThreads="4"/>
+    -->
+    
+    
     <!-- A "Connector" represents an endpoint by which requests are received
-         and responses are returned.  Each Connector passes requests on to the
-         associated "Container" (normally an Engine) for processing.
-
-         By default, a non-SSL HTTP/1.1 Connector is established on port 8080.
-         You can also enable an SSL HTTP/1.1 Connector on port 8443 by
-         following the instructions below and uncommenting the second Connector
-         entry.  SSL support requires the following steps (see the SSL Config
-         HOWTO in the Tomcat 5 documentation bundle for more detailed
-         instructions):
-         * If your JDK version 1.3 or prior, download and install JSSE 1.0.2 or
-           later, and put the JAR files into "$JAVA_HOME/jre/lib/ext".
-         * Execute:
-             %JAVA_HOME%\bin\keytool -genkey -alias tomcat -keyalg RSA (Windows)
-             $JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA  (Unix)
-           with a password value of "changeit" for both the certificate and
-           the keystore itself.
-
-         By default, DNS lookups are enabled when a web application calls
-         request.getRemoteHost().  This can have an adverse impact on
-         performance, so you can disable it by setting the
-         "enableLookups" attribute to "false".  When DNS lookups are disabled,
-         request.getRemoteHost() will return the String version of the
-         IP address of the remote client.
+         and responses are returned. Documentation at :
+         Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
+         Java AJP  Connector: /docs/config/ajp.html
+         APR (HTTP/AJP) Connector: /docs/apr.html
+         Define a non-SSL HTTP/1.1 Connector on port 8080
     -->
 
-<!-- Define a non-SSL HTTP/1.1 Connector on port 8080 -->
-[PKI_UNSECURE_PORT_SERVER_COMMENT]
-<Connector name="[PKI_UNSECURE_PORT_CONNECTOR_NAME]" port="[PKI_UNSECURE_PORT]" maxHttpHeaderSize="8192"
-        maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
-        enableLookups="false" redirectPort="8443" acceptCount="100"
-        connectionTimeout="20000" disableUploadTimeout="true"/>
-
-
-<!-- Define a SSL HTTP/1.1 Connector on port 8443 -->
-[PKI_SECURE_PORT_SERVER_COMMENT]
-<!-- DO NOT REMOVE - Begin define PKI secure port -->
-<Connector name="[PKI_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_SECURE_PORT]" maxHttpHeaderSize="8192"
-        maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
-        enableLookups="false" disableUploadTimeout="true"
-        acceptCount="100" scheme="https" secure="true"
-        clientAuth="[PKI_AGENT_CLIENTAUTH]" sslProtocol="SSL"
-        sslOptions="ssl2=false,ssl3=true,tls=true"
-        ssl2Ciphers="-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL2_DES_64_CBC_WITH_MD5,-SSL2_DES_192_EDE3_CBC_WITH_MD5"
-        ssl3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        tls3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
-        serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
-        passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
-        passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
-        certdbDir="[PKI_INSTANCE_PATH]/alias"/>
-<!-- DO NOT REMOVE - End define PKI secure port -->
-
-[PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_ADMIN_SECURE_PORT_SERVER_COMMENT]
-<Connector name="[PKI_ADMIN_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_ADMIN_SECURE_PORT]" maxHttpHeaderSize="8192"
-        maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
-        enableLookups="false" disableUploadTimeout="true"
-        acceptCount="100" scheme="https" secure="true"
-        clientAuth="false" sslProtocol="SSL"
-        sslOptions="ssl2=false,ssl3=true,tls=true"
-        ssl2Ciphers="-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL2_DES_64_CBC_WITH_MD5,-SSL2_DES_192_EDE3_CBC_WITH_MD5"
-        ssl3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        tls3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
-        serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
-        passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
-        passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
-        certdbDir="[PKI_INSTANCE_PATH]/alias"/>
-[PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT]
-
-[PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_EE_SECURE_PORT_SERVER_COMMENT]
-<Connector name="[PKI_EE_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_EE_SECURE_PORT]" maxHttpHeaderSize="8192"
-        maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
-        enableLookups="false" disableUploadTimeout="true"
-        acceptCount="100" scheme="https" secure="true"
-        clientAuth="false" sslProtocol="SSL"
-        sslOptions="ssl2=false,ssl3=true,tls=true"
-        ssl2Ciphers="-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL2_DES_64_CBC_WITH_MD5,-SSL2_DES_192_EDE3_CBC_WITH_MD5"
-        ssl3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        tls3Ciphers="-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,+SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-        SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
-        serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
-        passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
-        passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
-        certdbDir="[PKI_INSTANCE_PATH]/alias"/>
-[PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT]
-
-    <!-- Note : To disable connection timeouts, set connectionTimeout value
-     to 0 -->
-	
-	<!-- Note : To use gzip compression you could set the following properties :
-	
-			   compression="on" 
-			   compressionMinSize="2048" 
-			   noCompressionUserAgents="gozilla, traviata" 
-			   compressableMimeType="text/html,text/xml"
-	-->
-
+    [PKI_UNSECURE_PORT_SERVER_COMMENT]
+    <Connector name="[PKI_UNSECURE_PORT_CONNECTOR_NAME]" port="[PKI_UNSECURE_PORT]" protocol="HTTP/1.1" redirectPort="8443" 
+	       maxHttpHeaderSize="8192"
+	       acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
+	       enableLookups="false" connectionTimeout="20000" disableUploadTimeout="true"
+	       />
+
+    <!-- Define a SSL HTTP/1.1 Connector on port 8443 -->
+    [PKI_SECURE_PORT_SERVER_COMMENT]
+    <!-- DO NOT REMOVE - Begin define PKI secure port -->
+    <Connector name="[PKI_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_SECURE_PORT]" protocol="HTTP/1.1" SSLEnabled="true" sslProtocol="SSL" scheme="https" secure="true"
+	       maxHttpHeaderSize="8192"
+	       acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
+	       enableLookups="false" connectionTimeout="20000" disableUploadTimeout="true"
+	       SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
+	       clientAuth="[PKI_AGENT_CLIENTAUTH]"
+	       sslOptions="[TOMCAT_SSL_OPTIONS]"
+	       ssl2Ciphers="[TOMCAT_SSL2_CIPHERS]"
+	       ssl3Ciphers="[TOMCAT_SSL3_CIPHERS]"
+	       tls3Ciphers="[TOMCAT_TLS3_CIPHERS]"
+	       serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
+	       passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
+	       passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
+	       certdbDir="[PKI_INSTANCE_PATH]/alias"
+	       />
+    <!-- DO NOT REMOVE - End define PKI secure port -->
+
+    [PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_ADMIN_SECURE_PORT_SERVER_COMMENT]
+    <Connector name="[PKI_ADMIN_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_ADMIN_SECURE_PORT]" SSLEnabled="true" sslProtocol="SSL" scheme="https" secure="true"
+	       maxHttpHeaderSize="8192"
+	       acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
+	       enableLookups="false" disableUploadTimeout="true"
+	       SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
+	       clientAuth="false"
+	       sslOptions="[TOMCAT_SSL_OPTIONS]"
+	       ssl2Ciphers="[TOMCAT_SSL2_CIPHERS]"
+	       ssl3Ciphers="[TOMCAT_SSL3_CIPHERS]"
+	       tls3Ciphers="[TOMCAT_TLS3_CIPHERS]"
+	       serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
+	       passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
+	       passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
+	       certdbDir="[PKI_INSTANCE_PATH]/alias"/>
+    [PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT]
+
+    [PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_EE_SECURE_PORT_SERVER_COMMENT]
+    <Connector name="[PKI_EE_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_EE_SECURE_PORT]" SSLEnabled="true" sslProtocol="SSL" scheme="https" secure="true"
+	       maxHttpHeaderSize="8192"
+	       acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
+	       enableLookups="false" connectionTimeout="20000" disableUploadTimeout="true"
+	       SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation"
+	       clientAuth="false"
+	       sslOptions="[TOMCAT_SSL_OPTIONS]"
+	       ssl2Ciphers="[TOMCAT_SSL2_CIPHERS]"
+	       ssl3Ciphers="[TOMCAT_SSL3_CIPHERS]"
+	       tls3Ciphers="[TOMCAT_TLS3_CIPHERS]"
+	       serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf"
+	       passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf"
+	       passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile"
+	       certdbDir="[PKI_INSTANCE_PATH]/alias"/>
+    [PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT]
+
+    <!-- A "Connector" using the shared thread pool-->
+    <!--
+    <Connector executor="tomcatThreadPool"
+               port="8080" protocol="HTTP/1.1" 
+               connectionTimeout="20000" 
+               redirectPort="8443" />
+    -->           
+    <!-- Define a SSL HTTP/1.1 Connector on port 8443
+         This connector uses the JSSE configuration, when using APR, the 
+         connector should be using the OpenSSL style configuration
+         described in the APR documentation -->
+    <!--
+    <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
+               maxThreads="150" scheme="https" secure="true"
+               clientAuth="false" sslProtocol="TLS" />
+    -->
 
     <!-- Define an AJP 1.3 Connector on port 8009 -->
 <!--
-    <Connector port="8009" 
-               enableLookups="false" redirectPort="8443" protocol="AJP/1.3" />
+    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
 -->
 
-    <!-- Define a Proxied HTTP/1.1 Connector on port 8082 -->
-    <!-- See proxy documentation for more information about using this. -->
-    <!--
-    <Connector port="8082" 
-               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
-               enableLookups="false" acceptCount="100" connectionTimeout="20000"
-               proxyPort="80" disableUploadTimeout="true" />
-    -->
 
     <!-- An Engine represents the entry point (within Catalina) that processes
          every request.  The Engine implementation for Tomcat stand alone
          analyzes the HTTP headers included with the request, and passes them
-         on to the appropriate Host (virtual host). -->
+         on to the appropriate Host (virtual host).
+         Documentation at /docs/config/engine.html -->
 
     <!-- You should set jvmRoute to support load-balancing via AJP ie :
-    <Engine name="Standalone" defaultHost="localhost" jvmRoute="jvm1">         
+    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">         
     --> 
-         
-    <!-- Define the top level container in our container hierarchy -->
     <Engine name="Catalina" defaultHost="localhost">
 
-      <!-- The request dumper valve dumps useful debugging information about
-           the request headers and cookies that were received, and the response
-           headers and cookies that were sent, for all requests received by
-           this instance of Tomcat.  If you care only about requests to a
-           particular virtual host, or a particular application, nest this
-           element inside the corresponding <Host> or <Context> entry instead.
-
-           For a similar mechanism that is portable to all Servlet 2.4
-           containers, check out the "RequestDumperFilter" Filter in the
-           example application (the source for this filter may be found in
-           "$CATALINA_HOME/webapps/examples/WEB-INF/classes/filters").
+      <!--For clustering, please take a look at documentation at:
+          /docs/cluster-howto.html  (simple how to)
+          /docs/config/cluster.html (reference documentation) -->
+      <!--
+      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
+      -->        
 
-           Request dumping is disabled by default.  Uncomment the following
-           element to enable it. -->
+      <!-- The request dumper valve dumps useful debugging information about
+           the request and response data received and sent by Tomcat.
+           Documentation at: /docs/config/valve.html -->
       <!--
       <Valve className="org.apache.catalina.valves.RequestDumperValve"/>
       -->
 
-      <!-- Because this Realm is here, an instance will be shared globally -->
-
       <!-- This Realm uses the UserDatabase configured in the global JNDI
            resources under the key "UserDatabase".  Any edits
            that are performed against this UserDatabase are immediately
@@ -210,229 +198,27 @@ Tomcat Port       = [TOMCAT_SERVER_PORT] (for shutdown)
       <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
              resourceName="UserDatabase"/>
 
-      <!-- Comment out the old realm but leave here for now in case we
-           need to go back quickly -->
-      <!--
-      <Realm className="org.apache.catalina.realm.MemoryRealm" />
-      -->
-
-      <!-- Replace the above Realm with one of the following to get a Realm
-           stored in a database and accessed via JDBC -->
-
-      <!--
-      <Realm  className="org.apache.catalina.realm.JDBCRealm"
-             driverName="org.gjt.mm.mysql.Driver"
-          connectionURL="jdbc:mysql://localhost/authority"
-         connectionName="test" connectionPassword="test"
-              userTable="users" userNameCol="user_name" userCredCol="user_pass"
-          userRoleTable="user_roles" roleNameCol="role_name" />
-      -->
-
-      <!--
-      <Realm  className="org.apache.catalina.realm.JDBCRealm"
-             driverName="oracle.jdbc.driver.OracleDriver"
-          connectionURL="jdbc:oracle:thin:@ntserver:1521:ORCL"
-         connectionName="scott" connectionPassword="tiger"
-              userTable="users" userNameCol="user_name" userCredCol="user_pass"
-          userRoleTable="user_roles" roleNameCol="role_name" />
-      -->
-
-      <!--
-      <Realm  className="org.apache.catalina.realm.JDBCRealm"
-             driverName="sun.jdbc.odbc.JdbcOdbcDriver"
-          connectionURL="jdbc:odbc:CATALINA"
-              userTable="users" userNameCol="user_name" userCredCol="user_pass"
-          userRoleTable="user_roles" roleNameCol="role_name" />
-      -->
-
       <!-- Define the default virtual host
            Note: XML Schema validation will not work with Xerces 2.2.
        -->
-      <Host name="localhost" appBase="webapps"
-       unpackWARs="true" autoDeploy="false" 
-       xmlValidation="false" xmlNamespaceAware="false">
-
-        <!-- Defines a cluster for this node,
-             By defining this element, means that every manager will be changed.
-             So when running a cluster, only make sure that you have webapps in there
-             that need to be clustered and remove the other ones.
-             A cluster has the following parameters:
-
-             className = the fully qualified name of the cluster class
-
-             name = a descriptive name for your cluster, can be anything
-
-             mcastAddr = the multicast address, has to be the same for all the nodes
-
-             mcastPort = the multicast port, has to be the same for all the nodes
-             
-             mcastBindAddr = bind the multicast socket to a specific address
-             
-             mcastTTL = the multicast TTL if you want to limit your broadcast
-             
-             mcastSoTimeout = the multicast readtimeout 
-
-             mcastFrequency = the number of milliseconds in between sending a "I'm alive" heartbeat
+      <Host name="localhost"  appBase="webapps"
+            unpackWARs="true" autoDeploy="false"
+            xmlValidation="false" xmlNamespaceAware="false">
 
-             mcastDropTime = the number a milliseconds before a node is considered "dead" if no heartbeat is received
-
-             tcpThreadCount = the number of threads to handle incoming replication requests, optimal would be the same amount of threads as nodes 
-
-             tcpListenAddress = the listen address (bind address) for TCP cluster request on this host, 
-                                in case of multiple ethernet cards.
-                                auto means that address becomes
-                                InetAddress.getLocalHost().getHostAddress()
-
-             tcpListenPort = the tcp listen port
-
-             tcpSelectorTimeout = the timeout (ms) for the Selector.select() method in case the OS
-                                  has a wakup bug in java.nio. Set to 0 for no timeout
-
-             printToScreen = true means that managers will also print to std.out
-
-             expireSessionsOnShutdown = true means that 
-
-             useDirtyFlag = true means that we only replicate a session after setAttribute,removeAttribute has been called.
-                            false means to replicate the session after each request.
-                            false means that replication would work for the following piece of code: (only for SimpleTcpReplicationManager)
-                            <%
-                            HashMap map = (HashMap)session.getAttribute("map");
-                            map.put("key","value");
-                            %>
-             replicationMode = can be either 'pooled', 'synchronous' or 'asynchronous'.
-                               * Pooled means that the replication happens using several sockets in a synchronous way. Ie, the data gets replicated, then the request return. This is the same as the 'synchronous' setting except it uses a pool of sockets, hence it is multithreaded. This is the fastest and safest configuration. To use this, also increase the nr of tcp threads that you have dealing with replication.
-                               * Synchronous means that the thread that executes the request, is also the
-                               thread the replicates the data to the other nodes, and will not return until all
-                               nodes have received the information.
-                               * Asynchronous means that there is a specific 'sender' thread for each cluster node,
-                               so the request thread will queue the replication request into a "smart" queue,
-                               and then return to the client.
-                               The "smart" queue is a queue where when a session is added to the queue, and the same session
-                               already exists in the queue from a previous request, that session will be replaced
-                               in the queue instead of replicating two requests. This almost never happens, unless there is a 
-                               large network delay.
-        -->             
-        <!--
-            When configuring for clustering, you also add in a valve to catch all the requests
-            coming in, at the end of the request, the session may or may not be replicated.
-            A session is replicated if and only if all the conditions are met:
-            1. useDirtyFlag is true or setAttribute or removeAttribute has been called AND
-            2. a session exists (has been created)
-            3. the request is not trapped by the "filter" attribute
-
-            The filter attribute is to filter out requests that could not modify the session,
-            hence we don't replicate the session after the end of this request.
-            The filter is negative, ie, anything you put in the filter, you mean to filter out,
-            ie, no replication will be done on requests that match one of the filters.
-            The filter attribute is delimited by ;, so you can't escape out ; even if you wanted to.
-
-            filter=".*\.gif;.*\.js;" means that we will not replicate the session after requests with the URI
-            ending with .gif and .js are intercepted.
-            
-            The deployer element can be used to deploy apps cluster wide.
-            Currently the deployment only deploys/undeploys to working members in the cluster
-            so no WARs are copied upons startup of a broken node.
-            The deployer watches a directory (watchDir) for WAR files when watchEnabled="true"
-            When a new war file is added the war gets deployed to the local instance,
-            and then deployed to the other instances in the cluster.
-            When a war file is deleted from the watchDir the war is undeployed locally 
-            and cluster wide
-        -->
-        
-        <!--
-        <Cluster className="org.apache.catalina.cluster.tcp.SimpleTcpCluster"
-                 managerClassName="org.apache.catalina.cluster.session.DeltaManager"
-                 expireSessionsOnShutdown="false"
-                 useDirtyFlag="true"
-                 notifyListenersOnReplication="true">
-
-            <Membership 
-                className="org.apache.catalina.cluster.mcast.McastService"
-                mcastAddr="228.0.0.4"
-                mcastPort="45564"
-                mcastFrequency="500"
-                mcastDropTime="3000"/>
-
-            <Receiver 
-                className="org.apache.catalina.cluster.tcp.ReplicationListener"
-                tcpListenAddress="auto"
-                tcpListenPort="4001"
-                tcpSelectorTimeout="100"
-                tcpThreadCount="6"/>
-
-            <Sender
-                className="org.apache.catalina.cluster.tcp.ReplicationTransmitter"
-                replicationMode="pooled"
-                ackTimeout="15000"/>
-
-            <Valve className="org.apache.catalina.cluster.tcp.ReplicationValve"
-                   filter=".*\.gif;.*\.js;.*\.jpg;.*\.png;.*\.htm;.*\.html;.*\.css;.*\.txt;"/>
-                   
-            <Deployer className="org.apache.catalina.cluster.deploy.FarmWarDeployer"
-                      tempDir="/tmp/war-temp/"
-                      deployDir="/tmp/war-deploy/"
-                      watchDir="/tmp/war-listen/"
-                      watchEnabled="false"/>
-        </Cluster>
-        -->        
-
-
-
-        <!-- Normally, users must authenticate themselves to each web app
-             individually.  Uncomment the following entry if you would like
-             a user to be authenticated the first time they encounter a
-             resource protected by a security constraint, and then have that
-             user identity maintained across *all* web applications contained
-             in this virtual host. -->
+        <!-- SingleSignOn valve, share authentication between web applications
+             Documentation at: /docs/config/valve.html -->
         <!--
         <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
         -->
 
-        <!-- Access log processes all requests for this virtual host.  By
-             default, log files are created in the "logs" directory relative to
-             $CATALINA_HOME.  If you wish, you can specify a different
-             directory with the "directory" attribute.  Specify either a relative
-             (to $CATALINA_HOME) or absolute path to the desired directory.
-        -->
-        <Valve className="org.apache.catalina.valves.AccessLogValve"
-                 directory="logs"  prefix="localhost_access_log." suffix=".txt"
-                 pattern="common" resolveHosts="false"/>
-
-        <!-- Access log processes all requests for this virtual host.  By
-             default, log files are created in the "logs" directory relative to
-             $CATALINA_HOME.  If you wish, you can specify a different
-             directory with the "directory" attribute.  Specify either a relative
-             (to $CATALINA_HOME) or absolute path to the desired directory.
-             This access log implementation is optimized for maximum performance,
-             but is hardcoded to support only the "common" and "combined" patterns.
-        -->
+        <!-- Access log processes all example.
+             Documentation at: /docs/config/valve.html -->
         <!--
-        <Valve className="org.apache.catalina.valves.FastCommonAccessLogValve"
-                 directory="logs"  prefix="localhost_access_log." suffix=".txt"
-                 pattern="common" resolveHosts="false"/>
+        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"  
+               prefix="localhost_access_log." suffix=".txt" pattern="common" resolveHosts="false"/>
         -->
-        <!-- Access log processes all requests for this virtual host.  By
-             default, log files are created in the "logs" directory relative to
-             $CATALINA_HOME.  If you wish, you can specify a different
-             directory with the "directory" attribute.  Specify either a relative
-             (to $CATALINA_HOME) or absolute path to the desired directory.
-             This access log implementation is optimized for maximum performance,
-             but is hardcoded to support only the "common" and "combined" patterns.
 
-             This valve use NIO direct Byte Buffer to asynchornously store the
-             log.
-        -->
-        <!--
-        <Valve className="org.apache.catalina.valves.ByteBufferAccessLogValve"
-                 directory="logs"  prefix="localhost_access_log." suffix=".txt"
-                 pattern="common" resolveHosts="false"/>
-        -->
-
-       <!--  <Context docBase="webapps" path="/webapps" reloadable="false"/> -->
       </Host>
-
     </Engine>
-
   </Service>
-
 </Server>
diff --git a/pki/base/tks/shared/conf/tomcat-users.xml b/pki/base/tks/shared/conf/tomcat-users.xml
index f986faed3..daa9260cc 100644
--- a/pki/base/tks/shared/conf/tomcat-users.xml
+++ b/pki/base/tks/shared/conf/tomcat-users.xml
@@ -1,17 +1,45 @@
 <?xml version='1.0' encoding='utf-8'?>
 <!-- BEGIN COPYRIGHT BLOCK
-     Copyright (C) 2006 Red Hat, Inc.
+     Copyright (C) 2006-2010 Red Hat, Inc.
      All rights reserved.
+     Modifications: configuration parameters
      END COPYRIGHT BLOCK -->
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+
+<!--
+  <role rolename="tomcat"/>
+  <role rolename="role1"/>
+  <user username="tomcat" password="tomcat" roles="tomcat"/>
+  <user username="both" password="tomcat" roles="tomcat,role1"/>
+  <user username="role1" password="tomcat" roles="role1"/>
+-->
+
+<!-- The host manager webapp is restricted to users with role "admin" -->
+<!--<user name="tomcat" password="password" roles="admin" />-->
+<!-- The manager webapp is restricted to users with role "manager" -->
+<!--<user name="tomcat" password="password" roles="manager" />-->
 <tomcat-users>
   <role rolename="pkiuser"/>
   <role rolename="tomcat"/>
-  <role rolename="role1"/>
   <role rolename="manager"/>
   <role rolename="admin"/>
+
   <user username="pkiuser" password="pkiuser" roles="pkiuser"/>
   <user username="tomcat" password="tomcat" roles="tomcat"/>
-  <user username="both" password="tomcat" roles="tomcat,role1"/>
-  <user username="role1" password="tomcat" roles="role1"/>
   <user username="admin" password="netscape" roles="admin,manager"/>
 </tomcat-users>
diff --git a/pki/base/tks/shared/conf/tomcat5.conf b/pki/base/tks/shared/conf/tomcat5.conf
deleted file mode 100644
index ea1cd1906..000000000
--- a/pki/base/tks/shared/conf/tomcat5.conf
+++ /dev/null
@@ -1,80 +0,0 @@
-# --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2006 Red Hat, Inc.
-# All rights reserved.
-# --- END COPYRIGHT BLOCK ---
-#
-# tomcat5 service configuration file
-
-# Check to insure that this configuration file's associated PKI
-# subsystem currently resides on this system.
-PKI_SUBSYSTEM_TYPE=[PKI_SUBSYSTEM_TYPE]
-if [ ! -d /usr/share/pki/${PKI_SUBSYSTEM_TYPE} ] ; then
-	echo "This machine is missing the '${PKI_SUBSYSTEM_TYPE}' subsystem!"
-	exit 255
-fi
-
-# you could also override JAVA_HOME here
-# Where your java installation lives
-JAVA_HOME="/usr/lib/jvm/jre"
-
-# You can pass some parameters to java
-# here if you wish to
-#JAVA_OPTS="-Xminf0.1 -Xmaxf0.3"
-
-# Where your tomcat installation lives
-# That change from previous RPM where TOMCAT_HOME 
-# used to be /var/tomcat.
-# Now /var/tomcat will be the base for webapps only
-CATALINA_HOME="/usr/share/tomcat5"
-JASPER_HOME="/usr/share/tomcat5"
-CATALINA_TMPDIR="/usr/share/tomcat5/temp"
-JAVA_ENDORSED_DIRS="/usr/share/tomcat5/common/endorsed"
-
-# What user should run tomcat
-TOMCAT_USER="[PKI_USER]"
-TOMCAT_GROUP="[PKI_GROUP]"
-
-# You can change your tomcat locale here
-#LANG=en_US
-
-# Time to wait in seconds, while starting process
-STARTUP_WAIT=30
-
-# Time to wait in seconds, before killing process
-SHUTDOWN_WAIT=30
-
-
-# If you wish to further customize your tomcat environment,
-# put your own definitions here
-# (i.e. LD_LIBRARY_PATH for some jdbc drivers)
-# Just do not forget to export them :)
-
-OS=`uname -s`
-
-if [ $OS = "Linux" ]; then
-	PLATFORM=`uname -i`
-	if [ $PLATFORM = "i386" ]; then
-		# 32-bit Linux
-		LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib/dirsec:/usr/lib
-	elif [ $PLATFORM = "x86_64" ]; then
-		# 64-bit Linux
-		LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib64/dirsec:/usr/lib64:/usr/lib
-	fi
-	export LD_LIBRARY_PATH
-elif [ $OS = "SunOS" ]; then
-	PLATFORM=`uname -p`
-	if	[ "${PLATFORM}" = "sparc" ] &&
-		[ -d "/usr/lib/sparcv9/" ] ; then
-		PLATFORM="sparcv9"
-	fi
-	if [ $PLATFORM = "sparc" ]; then
-		# 32-bit Solaris
-		LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib/dirsec:/usr/lib
-	elif [ $PLATFORM = "sparcv9" ]; then
-		# 64-bit Solaris
-		JAVA_OPTS="-d64"
-		export JAVA_OPTS
-		LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib/sparcv9/dirsec:/usr/lib/sparcv9:/usr/lib/dirsec:/usr/lib
-	fi
-	export LD_LIBRARY_PATH
-fi
diff --git a/pki/base/tks/shared/etc/init.d/pki-tksd b/pki/base/tks/shared/etc/init.d/pki-tksd
index 7d6bb99a5..d8a23c86d 100755
--- a/pki/base/tks/shared/etc/init.d/pki-tksd
+++ b/pki/base/tks/shared/etc/init.d/pki-tksd
@@ -14,1816 +14,70 @@
 # with this program; if not, write to the Free Software Foundation, Inc.,
 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 #
-# Copyright (C) 2007 Red Hat, Inc.
+# Copyright (C) 2007-2010 Red Hat, Inc.
 # All rights reserved.
-# --- END COPYRIGHT BLOCK ### ---
+# --- END COPYRIGHT BLOCK ---
 #
-# pki-tksd   Startup script for Tomcat 5.0 pki-tks, the Apache Servlet Engine
+# pki-tksd   Startup script for pki-tks with tomcat6
 #
 # chkconfig:    - 84 16
-# description:  Token Key Service \
-#               (Tomcat 5.0)
+# description:  Token Key Service (Tomcat 6.0)
 # processname:  pki-tksd
 # piddir:       /var/run/pki/tks
-# config:       ${PKI_INSTANCE_PATH}/conf/tomcat5.conf
-#
-# Gomez Henri <hgomez@users.sourceforge.net>
-# Keith Irwin <keith_irwin@non.hp.com>
-# Nicolas Mailhot <nicolas.mailhot@one2team.com>
-#
-# version 1.02 - Removed initlog support
-# version 1.03 - Removed config:
-# version 1.04 - tomcat will start before httpd and stop after httpd
-# version 1.05 - jdk hardcoded to link /usr/java/jdk and tomcat runs
-#                as "nobody"
-# version 1.06 - split up into script and config file
-# version 1.07 - Rework from Nicolas ideas
-# version 1.08 - Fix work dir permission at start time, switch to use tomcat4
-# version 1.09 - Fix pidfile and config tags
-# version 1.10 - Fallback to su direct use on systems without
-#                Redhat/Mandrake init.d functions
-# version 1.11 - Fix webapps dir permissions
-# version 1.12 - remove initial start/stop level for chkconfig (- 80 20)
-# version 1.13 - remove chown of logs/work/temp/webapps dir,
-#                owned by tomcat4 at install time
-# version 1.14 - correct the start/stop ugly hack by waiting
-#                all the threads stops
-# version 1.15 - ensure we're looking for TOMCAT_USER running catalina
-# version 1.16 - Add support for CATALINA_PID env var
-# version 1.17 - Remove run files only tomcat started correctl
-#                in start area, check that tomcat is not allready running
-# version 1.18 - Fix kill typo (thanks Kaj J. Niemi)
-# version 1.19 - Add jar relinking
-# version 1.20 - Check there is no stalling tomcat4.pid
-# version 1.20tc5 - Changed all instances of tomcat4 to
-#                   tomcat5 except TOMCAT_USER
-# version 1.20tc5rh - Changed TOMCAT_USER from tomcat4 to tomcat
 #
 
-PKI_INIT_SCRIPT=""
+PROG_NAME=`basename $0`
+SERVICE_NAME="pki-tksd"
+SERVICE_PROG="/sbin/service"
 PKI_PATH="/usr/share/pki/tks"
-PKI_PIDDIR="/var/run/pki/tks"
-PKI_PROCESS="pki-tksd"
 PKI_REGISTRY="/etc/sysconfig/pki/tks"
 PKI_TYPE="pki-tks"
-
-# PKI subsystem-level directory and file values for locks
-lockfile="/var/lock/subsys/pki-tksd"
+PKI_TOTAL_PORTS=6
 
 # Disallow 'others' the ability to 'write' to new files
 umask 00002
 
-default_error=0
 command="$1"
 pki_instance="$2"
-case "${command}" in
-	start|stop|restart|condrestart|force-restart|try-restart)
-		# * 1 generic or unspecified error (current practice)
-		default_error=1
-		;;
-	reload)
-		default_error=3
-		;;
-	status)
-		# * 4 program or service status is unknown
-		default_error=4
-		;;
-	*)
-		# * 2 invalid argument(s)
-		default_error=2
-		;;
-esac
-
-# Check to insure that this script's original invocation directory
-# has not been deleted!
-CWD=`/bin/pwd > /dev/null 2>&1`
-if [ $? -ne 0 ] ; then
-	echo "Cannot invoke '$0' from non-existent directory!"
-	exit ${default_error}
-fi
-
-# Check to insure that this script's associated PKI
-# subsystem currently resides on this system.
-if [ ! -d ${PKI_PATH} ] ; then
-	echo "This machine is missing the '${PKI_TYPE}' subsystem!"
-	if [ "${command}" != "status" ]; then
-		# * 5 program is not installed
-		exit 5
-	else
-		exit ${default_error}
-	fi
-fi
-
-# Check to insure that this script's associated PKI
-# subsystem instance registry currently resides on this system.
-if [ ! -d ${PKI_REGISTRY} ] ; then
-	echo "This machine contains no registered '${PKI_TYPE}' subsystem instances!"
-	if [ "${command}" != "status" ]; then
-		# * 5 program is not installed
-		exit 5
-	else
-		exit ${default_error}
-	fi
-fi
-
-# Obtain the operating system upon which this script is being executed
-OS=`uname -s`
-ARCHITECTURE=""
-
-# This script must be run as root!
-RV=0
-if [ ${OS} = "Linux" ] ; then
-	PKI_INIT_SCRIPT="/sbin/service ${PKI_PROCESS}"
-	if [ `id -u` -ne 0 ] ; then
-		echo "Must be 'root' to execute '$0'!"
-		if [ "${command}" != "status" ]; then
-			# * 4 user had insufficient privilege
-			exit 4
-		else
-			# * 4 program or service status is unknown
-			exit 4
-		fi
-	fi
-	ARCHITECTURE=`uname -i`
-elif [ ${OS} = "SunOS" ] ; then
-	PKI_INIT_SCRIPT="/etc/init.d/${PKI_PROCESS}"
-	if [ `/usr/xpg4/bin/id -u` -ne 0 ] ; then
-		echo "Must be 'root' to execute '$0'!"
-		if [ "${command}" != "status" ]; then
-			# * 4 user had insufficient privilege
-			exit 4
-		else
-			# * 4 program or service status is unknown
-			exit 4
-		fi
-	fi
-	ARCHITECTURE=`uname -p`
-	if	[ "${ARCHITECTURE}" = "sparc" ] &&
-		[ -d "/usr/lib/sparcv9/" ] ; then
-		ARCHITECTURE="sparcv9"
-	fi
-else
-	echo "Unsupported OS '${OS}'!"
-	exit ${default_error}
-fi
 
 # Source function library.
-if [ -f /etc/init.d/functions ]; then
-	. /etc/init.d/functions
-else
-	# The checkpid() function is provided for platforms that do not
-	# contain the "/etc/init.d/functions" file (e. g. - Solaris) . . .
-
-	# Check if ${pid} (could be plural) are running (keep count)
-	checkpid()
-	{
-		rv=0
-		for i in $* ; do
-			ps -p $i > /dev/null 2>&1 ;
-			if [ $? -ne 0 ] ; then
-				rv=`expr ${rv} + 1`
-			else
-				rv=`expr ${rv} + 0`
-			fi
-		done
-		# echo "rv=${rv}"
-		return ${rv}
-	}
-
-	# Create the following directories on platforms
-	# where they do not exist (e. g. - Solaris) . . .
-	if [ ! -d "/var/lock" ] ; then
-		mkdir -p /var/lock
-		chown root:sys /var/lock
-		chmod 00755 /var/lock
-	fi
-	if [ ! -d "/var/lock/subsys" ] ; then
-		mkdir -p /var/lock/subsys
-		chown root:root /var/lock/subsys
-		chmod 00755 /var/lock/subsys
-	fi
-
-	#######################################################################
-	## NOTE:  The following code needs to eventually be moved into the   ##
-	##        template used to create the                                ##
-	##        "${PKI_INSTANCE_PATH}/conf/tomcat5.conf" file!             ##
-	#######################################################################
-
-	if [ ${OS} = "SunOS" ] ; then
-		DEFAULT_SOLARIS_JAVA_HOME="/usr/jdk/instances/jdk1.5.0/jre"
-		DEFAULT_LINUX_JAVA_HOME="/usr/lib/jvm/jre"
-		DEFAULT_LINUX_JAVA_HOME_PATH=`dirname ${DEFAULT_LINUX_JAVA_HOME}`
-
-		# ensure that the Sun JRE 1.5.0 exists at the default location
-		if [ -d ${DEFAULT_SOLARIS_JAVA_HOME} ] ; then
-			# create the directory in which the symlink resides (if necessary)
-			if [ ! -d ${DEFAULT_LINUX_JAVA_HOME_PATH} ] ; then
-				mkdir -p ${DEFAULT_LINUX_JAVA_HOME_PATH}
-			fi
-			# create the actual symlink (if necessary)
-			if [ ! -h ${DEFAULT_LINUX_JAVA_HOME} ] ; then
-				ln -s ${DEFAULT_SOLARIS_JAVA_HOME} ${DEFAULT_LINUX_JAVA_HOME}
-			fi
-		else
-			# for now, simply exit with an appropriate error message
-			echo -n "The Solaris 1.5.0 JRE must be installed "
-			echo -n "at \"${DEFAULT_SOLARIS_JAVA_HOME}\"!"
-			echo
-			echo
-			exit ${default_error}
-		fi
-	fi
-fi
-
-PKI_REGISTRY_ENTRIES=""
-TOTAL_PKI_REGISTRY_ENTRIES=0
-TOTAL_UNCONFIGURED_PKI_ENTRIES=0
-
-# Gather ALL registered instances of this PKI subsystem type
-for FILE in `/bin/ls -1 ${PKI_REGISTRY}/* 2>/dev/null`; do
-	if [ -f "$FILE" ] ; then
-		inst=`echo "$FILE"`
-		PKI_REGISTRY_ENTRIES="${PKI_REGISTRY_ENTRIES} $inst"
-		TOTAL_PKI_REGISTRY_ENTRIES=`expr ${TOTAL_PKI_REGISTRY_ENTRIES} + 1`
-	fi
-done
-
-if [ -n "${pki_instance}" ]; then
-	for I in ${PKI_REGISTRY_ENTRIES}; do
-		if [ "${PKI_REGISTRY}/${pki_instance}" = "$I" ]; then
-			PKI_REGISTRY_ENTRIES="${PKI_REGISTRY}/${pki_instance}"
-			TOTAL_PKI_REGISTRY_ENTRIES=1
-			break
-		fi
-	done
-fi
-
-usage()
-{
-	echo -n "Usage: ${PKI_INIT_SCRIPT} "
-	echo -n "{start"
-	echo -n "|stop"
-	echo -n "|restart"
-	echo -n "|condrestart"
-	echo -n "|force-restart"
-	echo -n "|try-restart"
-	echo -n "|reload"
-	echo -n "|status} "
-	echo -n "[instance-name]"
-	echo
-	echo
-}
-
-list_instances()
-{
-	echo
-	for FILE in `/bin/ls -1 ${PKI_REGISTRY}/* 2>/dev/null`; do
-		echo "    ${FILE}"
-	done
-	echo
-}
-
-# Check arguments
-if [ $# -lt 1 ] ; then
-	# * 3 unimplemented feature (for example, "reload")
-	#     [insufficient arguments]
-	echo "$0:  Insufficient arguments!"
-	echo
-	usage
-	echo "where valid instance names include:"
-	list_instances
-	exit 3
-elif [ ${default_error} -eq 2 ] ; then
-	# * 2 invalid argument
-	echo "$0:  Invalid arguments!"
-	echo
-	usage
-	echo "where valid instance names include:"
-	list_instances
-	exit 2
-elif [ $# -gt 2 ] ; then
-	echo "$0:  Excess arguments!"
-	echo
-	usage
-	echo "where valid instance names include:"
-	list_instances
-	if [ "${command}" != "status" ]; then
-		# * 2 excess arguments
-		exit 2
-	else
-		# * 4 program or service status is unknown
-		exit 4
-	fi
-fi
-
-# If an "instance" was supplied, check that it is a "valid" instance
-if [ -n "${pki_instance}" ]; then
-	if [ "${PKI_REGISTRY}/${pki_instance}" != "${PKI_REGISTRY_ENTRIES}" ]; then
-		echo -n "${pki_instance} is an invalid '${PKI_TYPE}' instance"
-		echo_failure
-		echo
-		if [ "${command}" != "status" ]; then
-			# * 5 program is not installed
-			exit 5
-		else
-			# * 4 program or service status is unknown
-			exit 4
-		fi
-	fi
-fi
-
-# On Solaris /var/run is in tmpfs and gets wiped out upon reboot
-# we have to recreate the ${PKI_PIDDIR} directory and make sure that
-# the directory is writable by the ${PKI_TYPE} server process.
-#
-# IMPORTANT:  ALL PKI subsystems installed on this machine MUST utilize
-#             the SAME values for ${PKI_GROUP} and ${PKI_USER}, since the
-#             "${PKI_PIDDIR}" will end up with the ownership permissions
-#             of the first instance that executes this function!
-#
-fix_pid_dir_ownership()
-{
-	if [ ! -d ${PKI_PIDDIR} ] ; then
-		mkdir -p ${PKI_PIDDIR}
-
-		chown root:root /var/run/pki
-		chmod 00755 /var/run/pki
-
-		chown root:root ${PKI_PIDDIR}
-		chmod 00755 ${PKI_PIDDIR}
-	fi
-}
-
-check_pki_configuration_status()
-{
-	rv=0
-
-	rv=`grep -c ^preop ${pki_instance_configuration_file}`
-
-	rv=`expr ${rv} + 0`
-
-	if [ ${rv} -ne 0 ] ; then
-		echo "    '${PKI_INSTANCE_ID}' must still be CONFIGURED!"
-		echo "    (see /var/log/${PKI_INSTANCE_ID}-install.log)"
-		if [ "${command}" != "status" ]; then
-			# * 6 program is not configured
-			rv=6
-		else
-			# * 4 program or service status is unknown
-			rv=4
-		fi
-		TOTAL_UNCONFIGURED_PKI_ENTRIES=`expr ${TOTAL_UNCONFIGURED_PKI_ENTRIES} + 1`
-	elif [ -f ${RESTART_SERVER} ] ; then
-		echo -n "    Although '${PKI_INSTANCE_ID}' has been CONFIGURED, "
-		echo -n "it must still be RESTARTED!"
-		echo
-		if [ "${command}" != "status" ]; then
-			# * 1 generic or unspecified error (current practice)
-			rv=1
-		else
-			# * 4 program or service status is unknown
-			rv=4
-		fi
-	fi
-
-	return ${rv}
-}
-
-get_pki_status_definitions()
-{
-	# establish well-known strings
-	begin_pki_status_comment="<!-- DO NOT REMOVE - Begin PKI Status Definitions -->"
-	end_pki_status_comment="<!-- DO NOT REMOVE - End PKI Status Definitions -->"
-	total_ports=0
-	unsecure_port_statement="Unsecure Port     = "
-	secure_agent_port_statement="Secure Agent Port = "
-	secure_ee_port_statement="Secure EE Port    = "
-	secure_admin_port_statement="Secure Admin Port = "
-	pki_console_port_statement="PKI Console Port  = "
-	tomcat_port_statement="Tomcat Port       = "
-
-	# initialize looping variables
-	pki_status_comment_found=0
-
-	# first check to see that an instance-specific "server.xml" file exists
-	if [ ! -f ${PKI_SERVER_XML_CONF} ] ; then
-		echo "File '${PKI_SERVER_XML_CONF}' does not exist!"
-		exit ${default_error}
-	fi
-
-	# read this instance-specific "server.xml" file line-by-line
-	# to obtain the current PKI Status Definitions
-	exec < ${PKI_SERVER_XML_CONF}
-	while read line; do
-		# first look for the well-known end PKI Status comment
-		# (to turn off processing)
-		if [ "$line" == "$end_pki_status_comment" ] ; then
-			pki_status_comment_found=0
-			break;
-		fi
-
-		# then look for the well-known begin PKI Status comment
-		# (to turn on processing)
-		if [ "$line" == "$begin_pki_status_comment" ] ; then
-			pki_status_comment_found=1
-		fi
-
-		# once the well-known begin PKI Status comment has been found,
-		# begin processing to obtain all of the PKI Status Definitions
-		if [ $pki_status_comment_found -eq 1 ] ; then
-			# look for a PKI Status Definition and print it
-			head=`echo "$line" | cut -b1-20`
-			if	[ "$head" == "$unsecure_port_statement"     ] ||
-				[ "$head" == "$secure_agent_port_statement" ] ||
-				[ "$head" == "$secure_ee_port_statement"    ] ||
-				[ "$head" == "$secure_admin_port_statement" ] ||
-				[ "$head" == "$pki_console_port_statement"  ] ||
-				[ "$head" == "$tomcat_port_statement"       ] ; then
-				echo "    $line"
-				total_ports=`expr ${total_ports} + 1`
-			fi
-		fi
-	done
-
-	if [ ${total_ports} -eq 6 ] ; then
-		return 0
-	else
-		return ${default_error}
-	fi
-}
-
-get_pki_configuration_definitions()
-{
-	# Obtain the PKI Subsystem Type
-	line=`grep ^cs.type= ${pki_instance_configuration_file}`
-	pki_subsystem=`echo "${line}" | cut -b9-`
-	if [ "${line}" != "" ] ; then
-		if	[ "${pki_subsystem}" != "CA"   ]  &&
-			[ "${pki_subsystem}" != "KRA"  ]  &&
-			[ "${pki_subsystem}" != "OCSP" ]  &&
-			[ "${pki_subsystem}" != "TKS"  ]  &&
-			[ "${pki_subsystem}" != "RA"   ]  &&
-			[ "${pki_subsystem}" != "TPS"  ]
-		then
-			return ${default_error}
-		fi
-		if	[ "${pki_subsystem}" == "KRA"   ] ; then
-			# Rename "KRA" to "DRM"
-			pki_subsystem="DRM"
-		fi
-	else
-		return ${default_error}
-	fi
-
-	# If "${pki_subsystem}" is a CA, DRM, OCSP, or TKS,
-	# check to see if "${pki_subsystem}" is a "Clone"
-	pki_clone=""
-	if	[ "${pki_subsystem}" == "CA"   ]  ||
-		[ "${pki_subsystem}" == "DRM"  ]  ||
-		[ "${pki_subsystem}" == "OCSP" ]  ||
-		[ "${pki_subsystem}" == "TKS"  ]
-	then
-		line=`grep ^subsystem.select= ${pki_instance_configuration_file}`
-		if [ "${line}" != "" ] ; then
-			pki_clone=`echo "${line}" | cut -b18-`
-			if [ "${pki_clone}" != "Clone" ] ; then
-				# Reset "${pki_clone}" to be empty
-				pki_clone=""
-			fi
-		else
-			return ${default_error}
-		fi
-	fi
-
-	# If "${pki_subsystem}" is a CA, and is NOT a "Clone", check to
-	# see "${pki_subsystem}" is a "Root" or a "Subordinate" CA
-	pki_hierarchy=""
-	if	[ "${pki_subsystem}" == "CA" ]  &&
-		[ "${pki_clone}" != "Clone"  ]
-	then
-		line=`grep ^hierarchy.select= ${pki_instance_configuration_file}`
-		if [ "${line}" != "" ] ; then
-			pki_hierarchy=`echo "${line}" | cut -b18-`
-		else
-			return ${default_error}
-		fi
-	fi
-
-	# If ${pki_subsystem} is a CA, check to
-	# see if it is also a Security Domain
-	pki_security_domain=""
-	if	[ "${pki_subsystem}" == "CA" ] ; then
-		line=`grep ^securitydomain.select= ${pki_instance_configuration_file}`
-		if [ "${line}" != "" ] ; then
-			pki_security_domain=`echo "${line}" | cut -b23-`
-			if [ "${pki_security_domain}" == "new" ] ; then
-				# Set a fixed value for "${pki_security_domain}"
-				pki_security_domain="(Security Domain)"
-			else
-				# Reset "${pki_security_domain}" to be empty
-				pki_security_domain=""
-			fi
-		else
-			return ${default_error}
-		fi
-	fi
-
-	# Always obtain this PKI instance's "registered"
-	# security domain information
-	pki_security_domain_name=""
-	pki_security_domain_hostname=""
-	pki_security_domain_https_admin_port=""
-
-	line=`grep ^securitydomain.name= ${pki_instance_configuration_file}`
-	if [ "${line}" != "" ] ; then
-		pki_security_domain_name=`echo "${line}" | cut -b21-`
-	else
-		return ${default_error}
-	fi
-
-	line=`grep ^securitydomain.host= ${pki_instance_configuration_file}`
-	if [ "${line}" != "" ] ; then
-		pki_security_domain_hostname=`echo "${line}" | cut -b21-`
-	else
-		return ${default_error}
-	fi
-
-	line=`grep ^securitydomain.httpsadminport= ${pki_instance_configuration_file}`
-	if [ "${line}" != "" ] ; then
-		pki_security_domain_https_admin_port=`echo "${line}" | cut -b31-`
-	else
-		return ${default_error}
-	fi
-
-	# Compose the "PKI Instance Name" Status Line
-	pki_instance_name="PKI Instance Name:   ${PKI_INSTANCE_ID}"
-
-	# Compose the "PKI Subsystem Type" Status Line
-	header="PKI Subsystem Type: "
-	if   [ "${pki_clone}" != "" ] ; then
-		if [ "${pki_security_domain}" != "" ]; then
-			# Possible Values:
-			#
-			#     "CA Clone (Security Domain)"
-			#
-			data="${pki_subsystem} ${pki_clone} ${pki_security_domain}"
-		else
-			# Possible Values:
-			#
-			#     "CA Clone"
-			#     "DRM Clone"
-			#     "OCSP Clone"
-			#     "TKS Clone"
-			#
-			data="${pki_subsystem} ${pki_clone}"
-		fi
-	elif [ "${pki_hierarchy}" != "" ] ; then
-		if [ "${pki_security_domain}" != "" ]; then
-			# Possible Values:
-			#
-			#     "Root CA (Security Domain)"
-			#     "Subordinate CA (Security Domain)"
-			#
-			data="${pki_hierarchy} ${pki_subsystem} ${pki_security_domain}"
-		else
-			# Possible Values:
-			#
-			#     "Root CA"
-			#     "Subordinate CA"
-			#
-			data="${pki_hierarchy} ${pki_subsystem}"
-		fi
-	else
-		# Possible Values:
-		#
-		#     "DRM"
-		#     "OCSP"
-		#     "RA"
-		#     "TKS"
-		#     "TPS"
-		#
-		data="${pki_subsystem}"
-	fi
-	pki_subsystem_type="${header} ${data}"
-
-	# Compose the "Registered PKI Security Domain Information" Status Line
-	header="Name: "
-	registered_pki_security_domain_name="${header} ${pki_security_domain_name}"
-
-	header="URL:  "
-	if	[ "${pki_security_domain_hostname}" != ""         ] &&
-		[ "${pki_security_domain_https_admin_port}" != "" ]
-	then
-		data="https://${pki_security_domain_hostname}:${pki_security_domain_https_admin_port}"
-	else
-		return ${default_error}
-	fi
-	registered_pki_security_domain_url="${header} ${data}"
-
-	# Print the "PKI Subsystem Type" Status Line
-	echo
-	echo "    ${pki_instance_name}"
-
-	# Print the "PKI Subsystem Type" Status Line
-	echo
-	echo "    ${pki_subsystem_type}"
-
-	# Print the "Registered PKI Security Domain Information" Status Line
-	echo
-	echo "    Registered PKI Security Domain Information:"
-	echo "    =========================================================================="
-	echo "    ${registered_pki_security_domain_name}"
-	echo "    ${registered_pki_security_domain_url}"
-	echo "    =========================================================================="
-
-	return 0
-}
-
-get_pki_secure_port()
-{
-	# establish well-known strings
-	begin_ssl_comment="<!-- DO NOT REMOVE - Begin define PKI secure port -->"
-	end_ssl_comment="<!-- DO NOT REMOVE - End define PKI secure port -->"
-	connector_statement="<Connector name=\""
-
-	# initialize looping variables
-	ssl_comment_found=0
-
-	# first check to see that an instance-specific "server.xml" file exists
-	if [ ! -f ${PKI_SERVER_XML_CONF} ] ; then
-		echo "File '${PKI_SERVER_XML_CONF}' does not exist!"
-		exit ${default_error}
-	fi
-
-	# read this instance-specific "server.xml" file line-by-line
-	# to obtain the current value of the PKI secure port
-	exec < ${PKI_SERVER_XML_CONF}
-	while read line; do
-		# first look for the well-known end SSL comment
-		# (to turn off processing)
-		if [ "$line" == "$end_ssl_comment" ] ; then
-			ssl_comment_found=0
-		fi
-
-		# then look for the well-known begin SSL comment
-		# (to turn on processing)
-		if [ "$line" == "$begin_ssl_comment" ] ; then
-			ssl_comment_found=1
-		fi
-
-		# once the well-known begin SSL comment has been found,
-		# begin processing to obtain the numeric port information
-		if [ $ssl_comment_found -eq 1 ] ; then
-			# look for the next Connector statement
-			head=`echo $line | cut -b1-17`
-			if [ "$head" == "$connector_statement" ] ; then
-				# once the Connector statement has been found,
-				tail=`echo $line | cut -b18-`
-				# extract the name of the connector
-				name=`echo $tail | cut -d\" -f1`
-				if	[ "$name" == "Agent"  ] ||
-					[ "$name" == "Secure" ] ; then
-					# extract the numeric port information
-					port=`echo $tail | cut -d\" -f3`
-					PKI_SECURE_PORT=$port
-					return 0
-				fi
-			fi
-		fi
-	done
-
-	return ${default_error}
-}
-
-display_instance_status()
-{
-	rv=0
-
-	if [ -f ${pidfile} ] ; then
-		pid=`cat ${pidfile}`
-		if [ "${pid}" == "" ] ; then
-			echo "${PKI_INSTANCE_ID} pid file exists but is empty"
-			if [ "${command}" != "status" ]; then
-				# * 1 generic or unspecified error (current practice)
-				rv=1
-			else
-				# * 4 program or service status is unknown
-				rv=4
-			fi
-		elif kill -0 ${pid} > /dev/null 2>&1 ; then
-			echo "${PKI_INSTANCE_ID} (pid ${pid}) is running ..."
-			echo
-			check_pki_configuration_status
-			rv=$?
-			if [ ${rv} -eq 0 ] ; then
-				get_pki_status_definitions
-				rv=$?
-				if [ ${rv} -ne 0 ] ; then
-					echo
-					echo "${PKI_INSTANCE_ID} Status Definitions not found"
-				else
-					get_pki_configuration_definitions
-					rv=$?
-					if [ ${rv} -ne 0 ] ; then
-						echo
-						echo "${PKI_INSTANCE_ID} Configuration Definitions not found"
-					fi
-				fi
-			else
-				# From the PKI point of view for a "non-status" action,
-				# a returned error code of "6" implies that the program
-				# is not "configured".  Similarly, an error code of "1"
-				# implies that the program was "configured" but must
-				# still be restarted.
-				#
-				# Similarly, from the PKI point of view for a "status"
-				# action, a returned error code of "4" implies that either
-				# the program is not "configured", or that the program
-				# was "configured" but must still be restarted.
-				#
-				# Regardless, it must still be considered that the instance
-				# is "running" from the viewpoint of other OS programs such
-				# as 'chkconfig'.
-				#
-				# For this reason, when returning from
-				# 'display_instance_status()', ignore non-zero return codes
-				# returned from 'check_pki_configuration_status()'.
-				#
-				if [ "${command}" != "status" ]; then
-					# * 0 action was successful
-					rv=0
-				else
-					# * 0 program is running or service is OK
-					rv=0
-				fi
-			fi
-			echo
-		else
-			echo "${PKI_INSTANCE_ID} is dead but pid file exists"
-			if [ "${command}" != "status" ]; then
-				# * 1 generic or unspecified error (current practice)
-				rv=1
-			else
-				# * 1 program is dead and /var/run pid file exists
-				rv=1
-			fi
-		fi
-	else
-		echo "${PKI_INSTANCE_ID} is stopped"
-		if [ "${command}" != "status" ]; then
-			# * 7 program is not running
-			rv=7
-		else
-			# * 3 program is not running
-			rv=3
-		fi
-	fi
-
-	return ${rv}
-}
-
-start_instance()
-{
-	rv=0
-
-	echo -n "Starting $TOMCAT_PROG: "
-
-	if [ -f ${RESTART_SERVER} ] ; then
-		rm -f ${RESTART_SERVER}
-	fi
-
-	if [ -f ${PKI_LOCKFILE} ] ; then
-		if [ -f ${pidfile} ]; then
-			read kpid < ${pidfile}
-			if checkpid $kpid 2>&1; then
-				echo
-				echo "${PKI_INSTANCE_ID} (pid ${kpid}) is already running ..."
-				echo
-				check_pki_configuration_status
-				rv=$?
-				if [ ${rv} != 0 ]; then
-					# From the PKI point of view for a "non-status" action,
-					# a returned error code of "6" implies that the program
-					# is not "configured".  Similarly, an error code of "1"
-					# implies that the program was "configured" but must
-					# still be restarted.
-					#
-					# Regardless, it must still be considered that the instance
-					# is "running" from the viewpoint of other OS programs such
-					# as 'chkconfig'.
-					#
-					# For "non-status" actions, ignore return codes of "1"
-					# from 'check_pki_configuration_status()'.
-					#
-					# However, for "non-status" actions that have a return
-					# code of "6", return this value unchanged to
-					# the calling routine so that the total number of
-					# configuration errors may be counted.
-					#
-
-					echo
-					if [ ${rv} = 1 ] ; then
-						# * 0 action was successful
-						return 0
-					elif [ ${rv} = 6 ] ; then
-						# * 6 program is not configured
-						return 6
-					else
-						# should never be reached
-						return ${rv}
-					fi
-				else
-					return 0
-				fi
-			else
-				echo
-				echo -n "lock file found but no process "
-				echo -n "running for pid $kpid, continuing"
-				echo
-				echo
-				rm -f ${PKI_LOCKFILE}
-			fi
-		fi
-	fi
-
-	fix_pid_dir_ownership
-
-	CATALINA_PID=${pidfile}
-	export CATALINA_PID
-	touch $CATALINA_PID
-	chown $TOMCAT_USER:$TOMCAT_GROUP $CATALINA_PID
-	chmod 00600 $CATALINA_PID
-	[ -x /sbin/restorecon ] && /sbin/restorecon  $CATALINA_PID
-
-	# restore context for ncipher hsm
-	[ -x /sbin/restorecon ] && [ -d /dev/nfast ] && /sbin/restorecon -R /dev/nfast
-
-	# Always initialize CLASSPATH to start looking
-	# in the local PKI classes directory . . .
-	CLASSPATH=/usr/share/pki/classes
-
-	if [ ${OS} = "Linux" ] ; then
-		$TOMCAT_RELINK_SCRIPT
-	elif [ ${OS} = "SunOS" ] ; then
-		# The following definitions are provided for Solaris
-		# platforms since they are unable to execute the
-		# "/usr/share/tomcat5/bin/relink",
-		# "/usr/bin/rebuild-jar-repository", and
-		# "/usr/share/java-utils/java-functions" files . . .
-
-		#######################################
-		##    /var/lib/tomcat5/common/lib:
-		#######################################
-
-		# Build the tomcat jar classpath . . .
-		CLASSPATH="$CLASSPATH":/usr/share/java/ant.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-collections.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-dbcp.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-el.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-logging-api.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-pool.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-ejb-2.1.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2ee-1.4.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2ee-connector-1.5.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2ee-deployment-1.1.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2ee-jacc-1.0.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2ee-management-1.0.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-j2eeschema-1.0.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-jms-1.1.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-jsp-2.0.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-jta-1.0.1B.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/geronimo/spec-servlet-2.4.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/jaf.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/jakarta-commons-collections.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/jakarta-commons-modeler.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/jasper5-compiler.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/jasper5-runtime.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/imap.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/mailapi.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/nntp.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/pop3.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/providers.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/javamail/smtp.jar
-
-		# BEGIN LINUX-SPECIFIC FILE
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jdtCompilerAdapter.jar
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jdtcore.jar
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jsp.jar
-		# END LINUX-SPECIFIC FILE
-
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-impl.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-jmx.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-remote.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-rimpl.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-rjmx.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-tools.jar
-
-		# BEGIN LINUX-SPECIFIC FILE
-		# CLASSPATH="$CLASSPATH":/usr/share/java/servlet.jar
-		# END LINUX-SPECIFIC FILE
-
-		CLASSPATH="$CLASSPATH":/usr/share/java/avalon-logkit.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/cmsutil.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-logging.jar
-		if [ "$ARCHITECTURE" = "sparc" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/java/dirsec/jss4.jar
-		elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/sparcv9/java/dirsec/jss4.jar
-		fi
-		CLASSPATH="$CLASSPATH":/usr/share/java/ldapjdk.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/common/lib/naming-factory.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/common/lib/naming-resources.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/pki/nsutil.jar
-		if [ "$ARCHITECTURE" = "sparc" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/java/osutil.jar
-		elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/sparcv9/java/osutil.jar
-		fi
-		CLASSPATH="$CLASSPATH":/usr/share/java/rhino.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/servletapi5.jar
-		if [ "$ARCHITECTURE" = "sparc" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/java/symkey.jar
-		elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/sparcv9/java/symkey.jar
-		fi
-		CLASSPATH="$CLASSPATH":/usr/share/java/velocity.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/xalan-j2.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/xerces-j2.jar
-
-		# Relink tomcat jar repositories . . .
-		cd /var/lib/tomcat5/common/lib
-
-		if [ ! -e /var/lib/tomcat5/common/lib/\[ant\].jar ]; then
-			ln -s /usr/share/java/ant.jar [ant].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[commons\-collections\].jar ]; then
-			ln -s /usr/share/java/commons-collections.jar [commons-collections].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[commons\-dbcp\].jar ]; then
-			ln -s /usr/share/java/commons-dbcp.jar [commons-dbcp].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[commons\-el\].jar ]; then
-			ln -s /usr/share/java/commons-el.jar [commons-el].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[commons\-logging-api\].jar ]; then
-			ln -s /usr/share/java/commons-logging-api.jar [commons-logging-api].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[commons\-pool\].jar ]; then
-			ln -s /usr/share/java/commons-pool.jar [commons-pool].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-ejb\-2.1\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-ejb-2.1-rc2.jar [geronimo]spec-ejb-2.1-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-ejb\-2.1.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-ejb-2.1.jar [geronimo]spec-ejb-2.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-1.4\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-1.4-rc2.jar [geronimo]spec-j2ee-1.4-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-1.4.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-1.4.jar [geronimo]spec-j2ee-1.4.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-connector\-1.5\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-connector-1.5-rc2.jar [geronimo]spec-j2ee-connector-1.5-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-connector\-1.5.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-connector-1.5.jar [geronimo]spec-j2ee-connector-1.5.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-deployment\-1.1\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-deployment-1.1-rc2.jar [geronimo]spec-j2ee-deployment-1.1-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-deployment\-1.1.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-deployment-1.1.jar [geronimo]spec-j2ee-deployment-1.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-jacc\-1.0\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-jacc-1.0-rc2.jar [geronimo]spec-j2ee-jacc-1.0-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-jacc\-1.0.jar ]; then
-			ln -s  /usr/share/java/geronimo/spec-j2ee-jacc-1.0.jar [geronimo]spec-j2ee-jacc-1.0.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-management\-1.0\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-management-1.0-rc2.jar [geronimo]spec-j2ee-management-1.0-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2ee\-management\-1.0.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2ee-management-1.0.jar [geronimo]spec-j2ee-management-1.0.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2eeschema\-1.0\-M2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2eeschema-1.0-M2.jar [geronimo]spec-j2eeschema-1.0-M2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-j2eeschema\-1.0.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-j2eeschema-1.0.jar [geronimo]spec-j2eeschema-1.0.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-jms\-1.1\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jms-1.1-rc2.jar [geronimo]spec-jms-1.1-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-jms\-1.1.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jms-1.1.jar [geronimo]spec-jms-1.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-jsp\-2.0\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jsp-2.0-rc2.jar [geronimo]spec-jsp-2.0-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-jsp\-2.0.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jsp-2.0.jar [geronimo]spec-jsp-2.0.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec-jta-1.0.1B-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jta-1.0.1B-rc2.jar [geronimo]spec-jta-1.0.1B-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-jta\-1.0.1B.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-jta-1.0.1B.jar [geronimo]spec-jta-1.0.1B.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-servlet\-2.4\-rc2.jar ]; then
-			ln -s /usr/share/java/geronimo/spec-servlet-2.4-rc2.jar [geronimo]spec-servlet-2.4-rc2.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[geronimo\]spec\-servlet\-2.4.jar ]; then
-			ln -s  /usr/share/java/geronimo/spec-servlet-2.4.jar [geronimo]spec-servlet-2.4.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[jaf\].jar ]; then
-			ln -s /usr/share/java/jaf.jar [jaf].jar
-		fi
-
-		### BEGIN SOLARIS-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jakarta\-commons\-collections.jar\] ]; then
-		###     ln -s /usr/share/java/jakarta-commons-collections.jar [jakarta-commons-collections.jar]
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jakarta\-commons\-modeler.jar\] ]; then
-		###     ln -s /usr/share/java/jakarta-commons-modeler.jar [jakarta-commons-modeler.jar]
-		### fi
-		### END SOLARIS-SPECIFIC LINKS
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jasper5\-compiler\].jar ]; then
-		###     ln -s /usr/share/java/jasper5-compiler.jar [jasper5-compiler].jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jasper5\-runtime\].jar ]; then
-		###     ln -s /usr/share/java/jasper5-runtime.jar [jasper5-runtime].jar
-		### fi
-
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]imap\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/imap-1.3.1.jar [javamail]imap-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]imap.jar ]; then
-			ln -s /usr/share/java/javamail/imap.jar [javamail]imap.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]mailapi\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/mailapi-1.3.1.jar [javamail]mailapi-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]mailapi.jar ]; then
-			ln -s /usr/share/java/javamail/mailapi.jar [javamail]mailapi.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]nntp\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/nntp-1.3.1.jar [javamail]nntp-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]nntp.jar ]; then
-			ln -s /usr/share/java/javamail/nntp.jar [javamail]nntp.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]pop3\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/pop3-1.3.1.jar [javamail]pop3-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]pop3.jar ]; then
-			ln -s /usr/share/java/javamail/pop3.jar [javamail]pop3.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]providers\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/providers-1.3.1.jar [javamail]providers-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]providers.jar ]; then
-			ln -s /usr/share/java/javamail/providers.jar [javamail]providers.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]smtp\-1.3.1.jar ]; then
-			ln -s /usr/share/java/javamail/smtp-1.3.1.jar [javamail]smtp-1.3.1.jar
-		fi
-		if [ ! -e /var/lib/tomcat5/common/lib/\[javamail\]smtp.jar ]; then
-			ln -s /usr/share/java/javamail/smtp.jar [javamail]smtp.jar
-		fi
-
-		### BEGIN LINUX-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jdtCompilerAdapter\].jar ]; then
-		###     ln -s /usr/share/java/jdtCompilerAdapter.jar [jdtCompilerAdapter].jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jdtcore\].jar ]; then
-		###     ln -s /usr/share/java/jdtcore.jar [jdtcore].jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[jsp\].jar ]; then
-		###     ln -s /usr/share/java/jsp.jar [jsp].jar
-		### fi
-		### END LINUX-SPECIFIC LINKS
-
-		if [ ! -e /var/lib/tomcat5/common/lib/\[mx4j\]\[mx4j\].jar ]; then
-			ln -s /usr/share/java/mx4j/mx4j.jar [mx4j][mx4j].jar
-		fi
-
-		### BEGIN LINUX-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[servlet\].jar ]; then
-		###     ln -s /usr/share/java/servlet.jar [servlet].jar
-		### fi
-		### END LINUX-SPECIFIC LINKS
-
-		### BEGIN LINUX-SPECIFIC FILE BUT SOLARIS-SPECIFIC LINK
-		if [ ! -e /var/lib/tomcat5/common/lib/avalon\-logkit.jar ]; then
-			ln -s /usr/share/java/avalon-logkit.jar avalon-logkit.jar
-		fi
-		### END LINUX-SPECIFIC FILE BUT SOLARIS-SPECIFIC LINK
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/cmsutil.jar ]; then
-		###     ln -s /usr/share/java/rphki/cmsutil.jar cmsutil.jar
-		### fi
-
-		### BEGIN LINUX-SPECIFIC FILE BUT SOLARIS-SPECIFIC LINK
-		if [ ! -e /var/lib/tomcat5/common/lib/commons\-logging.jar ]; then
-			ln -s /usr/share/java/commons-logging.jar commons-logging.jar
-		fi
-		### END LINUX-SPECIFIC FILE BUT SOLARIS-SPECIFIC LINK
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/jss4.jar ]; then
-		###     if [ "$ARCHITECTURE" = "sparc" ] ; then
-		###         ln -s /usr/lib/java/dirsec/jss4.jar jss4.jar
-		###     elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-		###         ln -s /usr/lib/sparcv9/java/dirsec/jss4.jar jss4.jar
-		###     fi
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/ldapjdk.jar ]; then
-		###     ln -s /usr/share/java/ldapjdk.jar ldapjdk.jar
-		### fi
-
-		### naming-factory.jar
-		### naming-resources.jar
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/nsutil.jar ]; then
-		###     ln -s /usr/share/java/pki/nsutil.jar nsutil.jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/osutil.jar ]; then
-		###     if [ "$ARCHITECTURE" = "sparc" ] ; then
-		###         ln -s /usr/lib/java/osutil.jar osutil.jar
-		###     elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-		###         ln -s /usr/lib/sparcv9/java/osutil.jar osutil.jar
-		###     fi
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/rhino.jar ]; then
-		###     ln -s /usr/share/java/rhino.jar rhino.jar
-		### fi
-
-		### BEGIN SOLARIS-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/common/lib/\[servletapi5.jar\] ]; then
-		###     ln -s /usr/share/java/servletapi5.jar [servletapi5.jar]
-		### fi
-		### END SOLARIS-SPECIFIC LINKS
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/symkey.jar ]; then
-		###     if [ "$ARCHITECTURE" = "sparc" ] ; then
-		###         ln -s /usr/lib/java/symkey.jar symkey.jar
-		###     elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-		###         ln -s /usr/lib/sparcv9/java/symkey.jar symkey.jar
-		###     fi
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/velocity.jar ]; then
-		###     ln -s /usr/share/java/velocity.jar velocity.jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/common/lib/xalan\-j2.jar ]; then
-		###     ln -s /usr/share/java/xalan-j2.jar xalan-j2.jar
-		### fi
-
-		if [ ! -e /var/lib/tomcat5/common/lib/xerces\-j2\-2.6.2.jar ]; then
-			ln -s /usr/share/java/xerces-j2-2.6.2.jar xerces-j2-2.6.2.jar
-		fi
-
-		### if [ ! -e /var/lib/tomcat5/common/lib/xerces\-j2.jar ]; then
-		###     ln -s /usr/share/java/xerces-j2.jar xerces-j2.jar
-		### fi
+. /etc/init.d/functions
 
-
-		#######################################
-		##    /var/lib/tomcat5/common/endorsed:
-		#######################################
-
-		# Build the tomcat jar classpath . . .
-		CLASSPATH="$CLASSPATH":/usr/share/java/xml-commons-apis.jar
-
-		# BEGIN LINUX-SPECIFIC FILE
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jaxp_parser_impl.jar
-		# END LINUX-SPECIFIC FILE
-
-
-		# Relink tomcat jar repositories . . .
-		cd /var/lib/tomcat5/common/endorsed
-
-		### BEGIN LINUX-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/common/endorsed/\[jaxp_parser_impl\].jar ]; then
-		###     ln -s /usr/share/java/jaxp_parser_impl.jar [jaxp_parser_impl].jar
-		### fi
-		### END LINUX-SPECIFIC LINKS
-
-		if [ ! -e /var/lib/tomcat5/common/endorsed/\[xml\-commons\-apis\].jar ]; then
-			ln -s /usr/share/java/xml-commons-apis.jar [xml-commons-apis].jar
-		fi
-
-
-		#######################################
-		##    /var/lib/tomcat5/server/lib:
-		#######################################
-
-		# Build the tomcat jar classpath . . .
-		CLASSPATH="$CLASSPATH":/usr/share/java/catalina-ant5.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-beanutils.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-digester.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-el.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-fileupload.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-logging.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/commons-modeler.jar
-
-		# BEGIN LINUX-SPECIFIC FILE
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jdtCompilerAdapter.jar
-		# CLASSPATH="$CLASSPATH":/usr/share/java/jdtcore.jar
-		# END LINUX-SPECIFIC FILE
-
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-impl.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-jmx.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-remote.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-rimpl.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-rjmx.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/mx4j/mx4j-tools.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/regexp.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/catalina-cluster.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/catalina-optional.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/catalina-storeconfig.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/catalina.jar
-		if [ "$ARCHITECTURE" = "sparc" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/java/dirsec/jss4.jar
-		elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-			CLASSPATH="$CLASSPATH":/usr/lib/sparcv9/java/dirsec/jss4.jar
-		fi
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/servlets-cgi.renametojar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/servlets-default.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/servlets-invoker.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/servlets-ssi.renametojar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/servlets-webdav.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/tomcat-ajp.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/tomcat-coyote.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/tomcat-http.jar
-		CLASSPATH="$CLASSPATH":/var/lib/tomcat5/server/lib/tomcat-util.jar
-		CLASSPATH="$CLASSPATH":/usr/share/java/tomcatjss.jar
-
-
-		# Relink tomcat jar repositories . . .
-		cd /var/lib/tomcat5/server/lib
-
-		if [ ! -e /var/lib/tomcat5/server/lib/\[catalina\-ant5\].jar ]; then
-			ln -s /usr/share/java/catalina-ant5.jar [catalina-ant5].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-beanutils\].jar ]; then
-			ln -s /usr/share/java/commons-beanutils.jar [commons-beanutils].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-digester\].jar ]; then
-			ln -s /usr/share/java/commons-digester.jar [commons-digester].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-el\].jar ]; then
-			ln -s /usr/share/java/commons-el.jar [commons-el].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-fileupload\].jar ]; then
-			ln -s /usr/share/java/commons-fileupload.jar [commons-fileupload].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-logging\].jar ]; then
-			ln -s /usr/share/java/commons-logging.jar [commons-logging].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[commons\-modeler\].jar ]; then
-			ln -s /usr/share/java/commons-modeler.jar [commons-modeler].jar
-		fi
-
-		### BEGIN LINUX-SPECIFIC LINKS
-		### if [ ! -e /var/lib/tomcat5/server/lib/\[jdtCompilerAdapter\].jar ]; then
-		###     ln -s /usr/share/java/jdtCompilerAdapter.jar [jdtCompilerAdapter].jar
-		### fi
-		### if [ ! -e /var/lib/tomcat5/server/lib/\[jdtcore\].jar ]; then
-		###     ln -s /usr/share/java/jdtcore.jar [jdtcore].jar
-		### fi
-		### END LINUX-SPECIFIC LINKS
-
-		if [ ! -e /var/lib/tomcat5/server/lib/\[mx4j\]\[mx4j\].jar ]; then
-			ln -s /usr/share/java/mx4j/mx4j.jar [mx4j][mx4j].jar
-		fi
-		if [ ! -e /var/lib/tomcat5/server/lib/\[regexp\].jar ]; then
-			ln -s /usr/share/java/regexp.jar [regexp].jar
-		fi
-
-		### catalina-cluster.jar
-		### catalina-optional.jar
-		### catalina-storeconfig.jar
-		### catalina.jar
-		### if [ ! -e /var/lib/tomcat5/server/lib/jss4.jar ]; then
-		###     if [ "$ARCHITECTURE" = "sparc" ] ; then
-		###         ln -s /usr/lib/java/dirsec/jss4.jar jss4.jar
-		###     elif [ "$ARCHITECTURE" = "sparcv9" ] ; then
-		###         ln -s /usr/lib/sparcv9/java/dirsec/jss4.jar jss4.jar
-		###     fi
-		### fi
-		### servlets-cgi.renametojar
-		### servlets-default.jar
-		### servlets-invoker.jar
-		### servlets-ssi.renametojar
-		### servlets-webdav.jar
-		### tomcat-ajp.jar
-		### tomcat-coyote.jar
-		### tomcat-http.jar
-		### tomcat-util.jar
-		### if [ ! -e /var/lib/tomcat5/server/lib/tomcatjss.jar ]; then
-		###     ln -s /usr/share/java/tomcatjss.jar tomcatjss.jar
-		### fi
-
-
-		#######################################
-		##    /var/lib/tomcat5/shared/lib:
-		#######################################
-
-		# Build the tomcat jar classpath . . .
-
-		export CLASSPATH
-
-
-		# Relink tomcat jar repositories . . .
-		cd /var/lib/tomcat5/shared/lib
-	fi
-
-	# daemon --user $TOMCAT_USER $TOMCAT_SCRIPT start
-	if [ ${OS} = "SunOS" ] ; then
-		su  $TOMCAT_USER -c "$TOMCAT_SCRIPT start" > /dev/null
-	else
-		runuser -s /bin/bash $TOMCAT_USER -c "$TOMCAT_SCRIPT start" > /dev/null
-	fi
-
-	rv=$?
-	if [ ${rv} = 0 ] ; then
-		touch ${PKI_LOCKFILE}
-		chown $TOMCAT_USER:$TOMCAT_GROUP $PKI_LOCKFILE
-		chmod 00600 $PKI_LOCKFILE
-	fi
-
-	if [ ${rv} = 0 ] ; then
-		count=0;
-
-		let swait=$STARTUP_WAIT
-		while	[ ! -s ${pidfile} ] &&
-				[ $count -lt $swait ]
-		do
-			echo -n "."
-			sleep 1
-			let count=$count+1;
-		done
-
-		if [ -f /etc/init.d/functions ]; then
-			if [ "$CONSOLETYPE" = "serial" ]; then
-				echo -n "         "
-			fi
-			echo_success
-			echo
-		else
-			echo "         [  OK  ]"
-		fi
-
-		get_pki_secure_port
-		if [ $? -ne 0 ] ; then
-			PKI_SECURE_PORT="<Port Undefined>"
-		fi
-
-                # Set permissions of log files
-                pki_logs_directory=${PKI_INSTANCE_PATH}/logs
-                pki_signedAudit="${pki_logs_directory}/signedAudit"
-                for file in ${pki_logs_directory}/*; do
-                    if  [  ! -d "${file}" ]; then
-                            chmod 00640 ${file}
-                            chgrp $TOMCAT_GROUP ${file}
-                            chown $TOMCAT_USER ${file}
-                    fi
-                done
-
-                # Set permissions of signedAudit log files
-                # do not set the group id, this will be set by the sgid on the directory
-                pki_signedAudit_files=`ls -1A ${pki_signedAudit} | wc -l`
-                if  [ ${pki_signedAudit_files} -gt 0 ]; then
-                    for file in ${pki_signedAudit}/*; do
-                        chmod 00640 ${file}
-                        chown $TOMCAT_USER ${file}
-                    done
-                fi
-
-		# ignore "status" return codes
-		echo
-		display_instance_status
-	else
-		if [ -f /etc/init.d/functions ]; then
-			if [ "$CONSOLETYPE" = "serial" ]; then
-				$0	echo -n "         "
-			fi
-			echo_failure
-			echo
-		else
-			echo "         [  FAILED  ]"
-		fi
-	fi
-
-	sleep 5
-	return ${rv}
-}
-
-stop_instance()
-{
-	rv=0
-
-	echo -n "Stopping $TOMCAT_PROG: "
-
-	if [ -f ${PKI_LOCKFILE} ] ; then
-		CATALINA_PID=${pidfile}
-		export CATALINA_PID
-
-		# daemon --user $TOMCAT_USER $TOMCAT_SCRIPT stop
-		if [ ${OS} = "SunOS" ] ; then
-			su  $TOMCAT_USER -c "$TOMCAT_SCRIPT stop" > /dev/null
-		else
-			runuser -s /bin/bash $TOMCAT_USER -c "$TOMCAT_SCRIPT stop" > /dev/null
-		fi
-
-		rv=$?
-
-		if [ ${rv} = 0 ]; then
-			count=0;
-
-			if [ -f ${pidfile} ]; then
-				read kpid < ${pidfile}
-				let kwait=$SHUTDOWN_WAIT
-
-				until	[ `ps -p $kpid | grep -c $kpid` = '0' ] ||
-						[ $count -gt $kwait ]
-				do
-					echo -n "."
-					sleep 1
-					let count=$count+1;
-				done
-
-				if [ $count -gt $kwait ]; then
-					kill -9 $kpid
-				fi
-			fi
-
-			rm -f ${PKI_LOCKFILE}
-			rm -f ${pidfile}
-
-			if [ -f /etc/init.d/functions ]; then
-				if [ "$CONSOLETYPE" = "serial" ]; then
-					echo -n "         "
-				fi
-				echo_success
-				echo
-			else
-				echo "         [  OK  ]"
-			fi
-		else
-			if [ -f /etc/init.d/functions ]; then
-				if [ "$CONSOLETYPE" = "serial" ]; then
-					echo -n "         "
-				fi
-				echo_failure
-				echo
-			else
-				echo "         [  FAILED  ]"
-			fi
-			rv=${default_error}
-		fi
-	else
-		echo
-		echo "process already stopped"
-		rv=0
-	fi
-
-	return ${rv}
-}
-
-start()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		config_errors=0
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "BEGIN STARTING '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Start every PKI instance of this type that isn't already running
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			start_instance
-
-			rv=$?
-			if [ ${rv} = 6 ] ; then
-				# Since at least ONE configuration error exists, then there
-				# is at least ONE unconfigured instance from the PKI point
-				# of view.
-				#
-				# However, it must still be considered that the
-				# instance is "running" from the point of view of other
-				# OS programs such as 'chkconfig'.
-				#
-				# Therefore, ignore non-zero return codes resulting
-				# from configuration errors.
-				#
-
-				config_errors=`expr $config_errors + 1`
-				rv=0
-			elif [ ${rv} != 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt ${errors} ] ; then
-			touch ${lockfile}
-			chmod 00600 ${lockfile}
-		fi
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			# NOTE:  "bad" return code(s) OVERRIDE configuration errors!
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "1 generic or unspecified error (current practice)"
-				rv=1
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances failed to start!"
-				echo
-			fi
-
-			if [ ${TOTAL_UNCONFIGURED_PKI_ENTRIES} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${TOTAL_UNCONFIGURED_PKI_ENTRIES} "
-				echo -n "of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances MUST be configured!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED STARTING '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances installed!"
-		rv=5
-	fi
-
-	return ${rv}
-}
-
-stop()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "BEGIN SHUTTING DOWN '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Shutdown every PKI instance of this type that is running
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			stop_instance
-
-			rv=$?
-			if [ ${rv} != 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		if [ ${errors} -eq 0 ] ; then
-			rm -f ${lockfile}
-		fi
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "1 generic or unspecified error (current practice)"
-				rv=1
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances were "
-				echo -n "unsuccessfully stopped!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED SHUTTING DOWN '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances installed!"
-		rv=5
-	fi
-
-	return ${rv}
-}
-
-restart()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	stop
-	sleep 2
-	echo
-	echo "============================================================"
-	echo
-	start
-
-	return $?
-}
-
-status()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 program is running or service is OK
-	#     * 1 program is dead and /var/run pid file exists
-	#     * 2 program is dead and /var/lock lock file exists
-	#     * 3 program is not running
-	#     * 4 program or service status is unknown
-	#     * 5-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "REPORT STATUS OF '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Obtain status of every PKI instance of this type
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			display_instance_status
-
-			rv=$?
-			if [ ${rv} -ne 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "4 - program or service status is unknown"
-				rv=4
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances reported status failures!"
-				echo
-			fi
-
-			if [ ${TOTAL_UNCONFIGURED_PKI_ENTRIES} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${TOTAL_UNCONFIGURED_PKI_ENTRIES} "
-				echo -n "of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances MUST be configured!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED REPORTING STATUS OF '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances installed!"
-		rv=4
-	fi
-
-	return ${rv}
-}
+# Source the PKI function library
+. /usr/share/pki/scripts/functions
 
 # See how we were called.
-case "${command}" in
-	start|stop|restart|status)
-		${command}
-		exit $?
-		;;
-	condrestart|force-restart|try-restart)
-		[ ! -f ${lockfile} ] || restart
-		exit $?
-		;;
-	reload)
-		echo "The 'reload' action is an unimplemented feature."
-		exit ${default_error}
-		;;
-	*)
-		# * 3 unimplemented feature (for example, "reload")
-		#     [invalid command - should never be reached]
-		echo
-		usage
-		echo "where valid instance names include:"
-		list_instances
-		exit 3
-		;;
+case $command in
+    status)
+	registry_status
+	exit $?
+	;;
+    start)
+	start
+	exit $?
+	;;
+    restart)
+	restart
+	exit $?
+	;;
+    stop)
+	stop
+	exit $?
+	;;
+    condrestart|force-restart|try-restart)
+        [ ! -f ${lockfile} ] || restart
+        exit $?
+        ;;
+    reload)
+        echo "The 'reload' action is an unimplemented feature."
+        exit ${default_error}
+        ;;
+    *)
+	echo "unknown action ($command)"
+        usage
+        echo "where valid instance names include:"
+        list_instances
+        exit ${default_error}
+        ;;
 esac
 
diff --git a/pki/base/tps/Makefile.am b/pki/base/tps/Makefile.am
index 16cec1f81..a98fd8971 100644
--- a/pki/base/tps/Makefile.am
+++ b/pki/base/tps/Makefile.am
@@ -248,7 +248,7 @@ scripts_DATA =	$(srcdir)/scripts/schemaMods.ldif \
 scripts_SCRIPTS =	$(srcdir)/scripts/nss_pcache
 
 if LINUX
-setup_DATA =	$(srcdir)/setup/config.desktop
+setup_DATA =	$(srcdir)/setup/config.desktop $(srcdir)/setup/registry_instance
 endif
 
 templates_DATA =	$(srcdir)/apache/pki_instance_command_wrapper \
diff --git a/pki/base/tps/Makefile.in b/pki/base/tps/Makefile.in
index b50254251..090edfeee 100644
--- a/pki/base/tps/Makefile.in
+++ b/pki/base/tps/Makefile.in
@@ -726,7 +726,7 @@ scripts_DATA = $(srcdir)/scripts/schemaMods.ldif \
 				$(srcdir)/scripts/addVLVIndexes.ldif
 
 scripts_SCRIPTS = $(srcdir)/scripts/nss_pcache
-@LINUX_TRUE@setup_DATA = $(srcdir)/setup/config.desktop
+@LINUX_TRUE@setup_DATA = $(srcdir)/setup/config.desktop $(srcdir)/setup/registry_instance
 templates_DATA = $(srcdir)/apache/pki_instance_command_wrapper \
 					$(srcdir)/apache/pki_subsystem_command_wrapper
 
diff --git a/pki/base/tps/apache/apachectl b/pki/base/tps/apache/apachectl
deleted file mode 100755
index 827512ef3..000000000
--- a/pki/base/tps/apache/apachectl
+++ /dev/null
@@ -1,189 +0,0 @@
-#!/bin/sh
-#
-# --- BEGIN COPYRIGHT BLOCK ---
-#
-# Copyright 2000-2004 The Apache Software Foundation
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-# 
-# Copyright (C) 2007 Red Hat, Inc.
-# All rights reserved.
-# --- END COPYRIGHT BLOCK ---
-#
-
-#
-#  NOTICE:  This "apachectl" script has been modified to support the
-#           Token Processing System (TPS).
-#
-
-# Initialize environment variables
-LD_LIBRARY_PATH=[SYSTEM_USER_LIBRARIES]:[SYSTEM_LIBRARIES]:${LD_LIBRARY_PATH}
-LD_LIBRARY_PATH=[SECURITY_LIBRARIES]:${LD_LIBRARY_PATH}
-export LD_LIBRARY_PATH
-
-# see if httpd is linked with the openldap libraries - we need to override them
-OS=`uname -s`
-if [ $OS = "Linux" ]; then
-   hasopenldap=0
-
-   /usr/bin/ldd $httpd 2>&1 | grep libldap- > /dev/null 2>&1 && hasopenldap=1
-
-   if [ $hasopenldap -eq 1 ] ; then
-       LD_PRELOAD="[SYSTEM_USER_LIBRARIES]/libldap50.so"
-       LD_PRELOAD="[SYSTEM_USER_LIBRARIES]/libssl3.so ${LD_PRELOAD}"
-       export LD_PRELOAD
-   fi
-fi
-
-#
-# Apache control script designed to allow an easy command line interface
-# to controlling Apache.  Written by Marc Slemko, 1997/08/23
-# 
-# The exit codes returned are:
-#   XXX this doc is no longer correct now that the interesting
-#   XXX functions are handled by [INSTANCE_ID]
-#       0 - operation completed successfully
-#       1 - 
-#       2 - usage error
-#       3 - [INSTANCE_ID] could not be started
-#       4 - [INSTANCE_ID] could not be stopped
-#       5 - [INSTANCE_ID] could not be started during a restart
-#       6 - [INSTANCE_ID] could not be restarted during a restart
-#       7 - [INSTANCE_ID] could not be restarted during a graceful restart
-#       8 - configuration syntax error
-#
-# When multiple arguments are given, only the error from the _last_
-# one is reported.  Run "apachectl help" for usage info
-#
-ARGV="$@"
-#
-# |||||||||||||||||||| START CONFIGURATION SECTION  ||||||||||||||||||||
-# --------------------                              --------------------
-# 
-
-#
-# a command that outputs a formatted text version of the HTML at the
-# url given on the command line.  Designed for lynx, however other
-# programs may work.  
-if [ -x /usr/bin/links ]; then
-    LYNX="links -dump"
-elif [ -x /usr/bin/lynx ]; then
-    LYNX="lynx -dump"
-else
-    LYNX="none"
-fi
-
-#
-# the URL to your server's mod_status status page.  If you do not
-# have one, then status and fullstatus will not work.
-STATUSURL="http://localhost:80/server-status"
-#
-# Set this variable to a command that increases the maximum
-# number of file descriptors allowed per child process. This is
-# critical for configurations that use many file descriptors,
-# such as mass vhosting, or a multithreaded server.
-ULIMIT_MAX_FILES="ulimit -S -n `ulimit -H -n`"
-
-########################################################################
-#   This section contains modified content of "/etc/sysconfig/httpd"   #
-########################################################################
-# Configuration file for the [INSTANCE_ID] service.
-
-#
-# The default processing model (MPM) is the process-based
-# 'prefork' model.  A thread-based model, 'worker', is also
-# available, but does not work with some modules (such as PHP).
-# The service must be stopped before changing this variable.
-#
-HTTPD=[FORTITUDE_DIR]/sbin/httpd.worker
-
-#
-# To pass additional options (for instance, -D definitions) to the
-# httpd binary at startup, set OPTIONS here.
-#
-OPTIONS="-f [HTTPD_CONF]"
-
-#
-# By default, the httpd process is started in the C locale; to 
-# change the locale in which the server runs, the HTTPD_LANG
-# variable can be set.
-#
-HTTPD_LANG=C
-########################################################################
-#                                                                      #
-########################################################################
-
-# Set the maximum number of file descriptors allowed per child process.
-if [ "x$ULIMIT_MAX_FILES" != "x" ] ; then
-    $ULIMIT_MAX_FILES
-fi
-
-ERROR=0
-if [ "x$ARGV" = "x" ] ; then 
-    ARGV="-h"
-fi
-
-function checklynx() {
-if [ "$LYNX" = "none" ]; then
-    echo "The 'links' package is required for this functionality."
-    exit 8
-fi
-}
-
-function testconfig() {
-# [INSTANCE_ID] is denied terminal access in SELinux, so run in the
-# current context to get stdout from $HTTPD -t.
-if test -x /usr/sbin/selinuxenabled && /usr/sbin/selinuxenabled; then
-    runcon -- `id -Z` $HTTPD $OPTIONS -t
-else
-    $HTTPD $OPTIONS -t
-fi
-ERROR=$?
-}
-
-case $ARGV in
-restart|graceful)
-    if $HTTPD -t >&/dev/null; then
-        $HTTPD $OPTIONS -k $ARGV
-        ERROR=$?
-    else
-        echo "apachectl: Configuration syntax error, will not run \"$ARGV\":"
-        testconfig
-    fi
-    ;;
-start|stop)
-    $HTTPD $OPTIONS -k $ARGV
-    ERROR=$?
-    ;;
-startssl|sslstart|start-SSL)
-    $HTTPD $OPTIONS -DSSL -k start
-    ERROR=$?
-    ;;
-configtest)
-    testconfig
-    ;;
-status)
-    checklynx
-    $LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } '
-    ;;
-fullstatus)
-    checklynx
-    $LYNX $STATUSURL
-    ;;
-*)
-    $HTTPD $OPTIONS $ARGV
-    ERROR=$?
-esac
-
-exit $ERROR
-
diff --git a/pki/base/tps/apache/conf/httpd.conf b/pki/base/tps/apache/conf/httpd.conf
index 5ad748f55..878a4e655 100644
--- a/pki/base/tps/apache/conf/httpd.conf
+++ b/pki/base/tps/apache/conf/httpd.conf
@@ -78,7 +78,7 @@ ServerRoot "[SERVER_ROOT]"
 # identification number when it starts.
 #
 <IfModule !mpm_netware.c>
-PidFile run/[INSTANCE_ID].pid
+PidFile run/[PKI_INSTANCE_ID].pid
 </IfModule>
 
 #
@@ -268,7 +268,7 @@ LoadModule tokendb_module     [FORTITUDE_MODULE]/mod_tokendb.so
 </Location>
 
 #
-# Load config files from the config directory "/etc/[INSTANCE_ID]/conf.d".
+# Load config files from the config directory "/etc/[PKI_INSTANCE_ID]/conf.d".
 #
 #Include conf.d/*.conf
 Include [SERVER_ROOT]/conf/perl.conf
@@ -295,10 +295,10 @@ Include [SERVER_ROOT]/conf/perl.conf
 <IfModule !mpm_winnt.c>
 <IfModule !mpm_netware.c>
 #
-# If you wish [INSTANCE_ID] to run as a different user or group, you must run
-# [INSTANCE_ID] as root initially and it will switch.  
+# If you wish [PKI_INSTANCE_ID] to run as a different user or group, you must run
+# [PKI_INSTANCE_ID] as root initially and it will switch.  
 #
-# User/Group: The name (or #number) of the user/group to run [INSTANCE_ID] as.
+# User/Group: The name (or #number) of the user/group to run [PKI_INSTANCE_ID] as.
 #  . On SCO (ODT 3) use "User nouser" and "Group nogroup".
 #  . On HPUX you may not be able to use shared memory as nobody, and the
 #    suggested workaround is to create a user www and use that user.
@@ -306,8 +306,8 @@ Include [SERVER_ROOT]/conf/perl.conf
 #  when the value of (unsigned)Group is above 60000; 
 #  don't use Group #-1 on these systems!
 #
-User [USERID]
-Group [GROUPID]
+User [PKI_USER]
+Group [PKI_GROUP]
 #Group #-1
 </IfModule>
 </IfModule>
diff --git a/pki/base/tps/apache/conf/nss.conf b/pki/base/tps/apache/conf/nss.conf
index 70c64116f..2e0b0ecae 100644
--- a/pki/base/tps/apache/conf/nss.conf
+++ b/pki/base/tps/apache/conf/nss.conf
@@ -101,7 +101,7 @@ NSSProtocol SSLv3,TLSv1
 
 #   SSL Certificate Nickname:
 #   The nickname of the server certificate you are going to use.
-NSSNickname "Server-Cert cert-[INSTANCE_ID]"
+NSSNickname "Server-Cert cert-[PKI_INSTANCE_ID]"
 
 #   Server Certificate Database:
 #   The NSS security database directory that holds the certificates and
@@ -196,7 +196,7 @@ NSSProtocol SSLv3,TLSv1
 
 #   SSL Certificate Nickname:
 #   The nickname of the server certificate you are going to use.
-NSSNickname "Server-Cert cert-[INSTANCE_ID]"
+NSSNickname "Server-Cert cert-[PKI_INSTANCE_ID]"
 
 #   Server Certificate Database:
 #   The NSS security database directory that holds the certificates and
diff --git a/pki/base/tps/build.xml b/pki/base/tps/build.xml
index ebfbeb225..603560b2c 100644
--- a/pki/base/tps/build.xml
+++ b/pki/base/tps/build.xml
@@ -184,7 +184,12 @@
                 <include name="lib/**"/>
                 <include name="samples/**"/>
                 <include name="scripts/**"/>
-                <include name="setup/config.desktop"/>
+            </zipfileset>
+            <zipfileset dir="./setup"
+                        filemode="644"
+                        prefix="usr/share/${product.prefix}/${product}/setup">
+                <include name="config.desktop"/>
+                <include name="registry_instance"/>
             </zipfileset>
             <zipfileset dir="."
                         filemode="755"
@@ -230,7 +235,12 @@
                 <include name="lib/**"/>
                 <include name="samples/**"/>
                 <include name="scripts/**"/>
-                <include name="setup/config.desktop"/>
+            </tarfileset>
+            <tarfileset dir="./setup"
+                        mode="644"
+                        prefix="usr/share/${product.prefix}/${product}/setup">
+                <include name="config.desktop"/>
+                <include name="registry_instance"/>
             </tarfileset>
             <tarfileset dir="."
                         mode="755"
diff --git a/pki/base/tps/doc/CS.cfg b/pki/base/tps/doc/CS.cfg
index 5e5c7e30c..32a88010d 100644
--- a/pki/base/tps/doc/CS.cfg
+++ b/pki/base/tps/doc/CS.cfg
@@ -18,15 +18,15 @@
 # All rights reserved.
 # --- END COPYRIGHT BLOCK ---
 #
-pkicreate.pki_instance_root=[INSTANCE_ROOT]
-pkicreate.pki_instance_name=[INSTANCE_ID]
-pkicreate.subsystem_type=[SUBSYSTEM_TYPE]
+pkicreate.pki_instance_root=[PKI_INSTANCE_ROOT]
+pkicreate.pki_instance_name=[PKI_INSTANCE_ID]
+pkicreate.subsystem_type=[PKI_SUBSYSTEM_TYPE]
 pkicreate.secure_port=[SECURE_PORT]
 pkicreate.non_clientauth_secure_port=[NON_CLIENTAUTH_SECURE_PORT]
 pkicreate.unsecure_port=[PORT]
-pkicreate.user=[USERID]
-pkicreate.group=[GROUPID]
-pkiremove.cert.subsystem.nickname=subsystemCert cert-[INSTANCE_ID]
+pkicreate.user=[PKI_USER]
+pkicreate.group=[PKI_GROUP]
+pkiremove.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_ID]
 cs.type=TPS
 selftests._000=##
 selftests._001=## Self Tests
@@ -47,7 +47,7 @@ service.instanceDir=[SERVER_ROOT]
 service.securePort=[SECURE_PORT]
 service.non_clientauth_securePort=[NON_CLIENTAUTH_SECURE_PORT]
 service.unsecurePort=[PORT]
-service.instanceID=[INSTANCE_ID]
+service.instanceID=[PKI_INSTANCE_ID]
 logging._000=#########################################
 logging._001=# RA configuration File
 logging._002=#
@@ -111,7 +111,7 @@ logging.audit.filename=[SERVER_ROOT]/logs/tps-audit.log
 logging.audit.signedAuditFilename=[SERVER_ROOT]/logs/signedAudit/tps_audit
 logging.audit.level=10
 logging.audit.logSigning=false
-logging.audit.signedAuditCertNickname=auditSigningCert cert-[INSTANCE_ID]
+logging.audit.signedAuditCertNickname=auditSigningCert cert-[PKI_INSTANCE_ID]
 logging.audit.selected.events=AUTHZ_SUCCESS,AUTHZ_FAIL,AUTH_FAIL,AUTH_SUCCESS,ROLE_ASSUME,ENROLLMENT,PIN_RESET,FORMAT,CONFIG,CONFIG_ROLE,CONFIG_TOKEN,CONFIG_PROFILE,CONFIG_AUDIT,APPLET_UPGRADE,KEY_CHANGEOVER,RENEWAL
 logging.audit.selectable.events=AUTHZ_SUCCESS,AUTHZ_FAIL,AUTH_FAIL,AUTH_SUCCESS,ROLE_ASSUME,ENROLLMENT,PIN_RESET,FORMAT,CONFIG,CONFIG_ROLE,CONFIG_TOKEN,CONFIG_PROFILE,CONFIG_AUDIT,APPLET_UPGRADE,KEY_CHANGEOVER,RENEWAL
 logging.audit.nonselectable.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,LOGGING_SIGNED_AUDIT_SIGNING
@@ -371,33 +371,33 @@ preop.cert.sslserver.enable=true
 preop.cert.subsystem.enable=true
 preop.cert.audit_signing.enable=false
 preop.cert.sslserver.defaultSigningAlgorithm=SHA1withRSA
-preop.cert.sslserver.dn=CN=[SERVER_NAME], OU=[INSTANCE_ID]
+preop.cert.sslserver.dn=CN=[SERVER_NAME], OU=[PKI_INSTANCE_ID]
 preop.cert.sslserver.keysize.customsize=2048
 preop.cert.sslserver.keysize.size=2048
 preop.cert.sslserver.keysize.select=custom
-preop.cert.sslserver.nickname=Server-Cert cert-[INSTANCE_ID]
+preop.cert.sslserver.nickname=Server-Cert cert-[PKI_INSTANCE_ID]
 preop.cert.sslserver.profile=caInternalAuthServerCert
 preop.cert.sslserver.subsystem=tps
 preop.cert._003=#preop.cert.sslserver.type=local
 preop.cert.sslserver.userfriendlyname=SSL Server Certificate
 preop.cert._004=#preop.cert.sslserver.cncomponent.override=false
 preop.cert.subsystem.defaultSigningAlgorithm=SHA1withRSA
-preop.cert.subsystem.dn=CN=TPS Subsystem Certificate, OU=[INSTANCE_ID]
+preop.cert.subsystem.dn=CN=TPS Subsystem Certificate, OU=[PKI_INSTANCE_ID]
 preop.cert.subsystem.keysize.customsize=2048
 preop.cert.subsystem.keysize.size=2048
 preop.cert.subsystem.keysize.select=custom
-preop.cert.subsystem.nickname=subsystemCert cert-[INSTANCE_ID]
+preop.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_ID]
 preop.cert.subsystem.profile=caInternalAuthSubsystemCert
 preop.cert.subsystem.subsystem=tps
 preop.cert._005=#preop.cert.subsystem.type=local
 preop.cert.subsystem.userfriendlyname=Subsystem Certificate
 preop.cert._006=#preop.cert.subsystem.cncomponent.override=true
 preop.cert.audit_signing.defaultSigningAlgorithm=SHA1withRSA
-preop.cert.audit_signing.dn=CN=TPS Audit Signing Certificate, OU=[INSTANCE_ID]
+preop.cert.audit_signing.dn=CN=TPS Audit Signing Certificate, OU=[PKI_INSTANCE_ID]
 preop.cert.audit_signing.keysize.customsize=2048
 preop.cert.audit_signing.keysize.size=2048
 preop.cert.audit_signing.keysize.select=custom
-preop.cert.audit_signing.nickname=auditSigningCert cert-[INSTANCE_ID]
+preop.cert.audit_signing.nickname=auditSigningCert cert-[PKI_INSTANCE_ID]
 preop.cert.audit_signing.profile=caInternalAuthAuditSigningCert
 preop.cert.audit_signing.subsystem=tps
 preop.cert._005=#preop.cert.audit_signing.type=local
diff --git a/pki/base/tps/etc/init.d/pki-tpsd b/pki/base/tps/etc/init.d/pki-tpsd
index ff542a7f2..0631954c2 100755
--- a/pki/base/tps/etc/init.d/pki-tpsd
+++ b/pki/base/tps/etc/init.d/pki-tpsd
@@ -1,1439 +1,83 @@
 #!/bin/bash
 #
 # --- BEGIN COPYRIGHT BLOCK ---
-# This library is free software; you can redistribute it and/or
-# modify it under the terms of the GNU Lesser General Public
-# License as published by the Free Software Foundation;
-# version 2.1 of the License.
-# 
-# This library is distributed in the hope that it will be useful,
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# Lesser General Public License for more details.
-# 
-# You should have received a copy of the GNU Lesser General Public
-# License along with this library; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor,
-# Boston, MA  02110-1301  USA 
-# 
-# Copyright (C) 2007 Red Hat, Inc.
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2007-2010 Red Hat, Inc.
 # All rights reserved.
 # --- END COPYRIGHT BLOCK ---
 #
-#
 # pki-tpsd         Startup script for the Apache HTTP pki-tps Server
 #
 # chkconfig:    - 87 13
-# description:  Token Processing System \
-#               (Apache 2.2)
+# description:  Token Processing System (Apache)
 # processname:  pki-tpsd
 # piddir:       /var/run/pki/tps
 # config:       ${PKI_SERVER_ROOT}/conf/httpd.conf
 
-PKI_INIT_SCRIPT=""
+PROG_NAME=`basename $0`
+SERVICE_NAME="pki-tpsd"
+SERVICE_PROG="/sbin/service"
 PKI_PATH="/usr/share/pki/tps"
-PKI_PIDDIR="/var/run/pki/tps"
-PKI_PROCESS="pki-tpsd"
 PKI_REGISTRY="/etc/sysconfig/pki/tps"
-PKI_SELINUX_TYPE="pki_tps_t"
 PKI_TYPE="pki-tps"
-
-# PKI subsystem-level directory and file values for locks
-lockfile="/var/lock/subsys/pki-tpsd"
+PKI_TOTAL_PORTS=3
 
 # Disallow 'others' the ability to 'write' to new files
 umask 00002
 
-default_error=0
 command="$1"
 pki_instance="$2"
-case "${command}" in
-	start|stop|restart|condrestart|force-restart|try-restart)
-		# * 1 generic or unspecified error (current practice)
-		default_error=1
-		;;
-	reload)
-		default_error=3
-		;;
-	status)
-		# * 4 program or service status is unknown
-		default_error=4
-		;;
-	*)
-		# * 2 invalid argument(s)
-		default_error=2
-		;;
-esac
-
-# Check to insure that this script's original invocation directory
-# has not been deleted!
-CWD=`/bin/pwd > /dev/null 2>&1`
-if [ $? -ne 0 ] ; then
-	echo "Cannot invoke '$0' from non-existent directory!"
-	exit ${default_error}
-fi
-
-# Check to insure that this script's associated PKI
-# subsystem currently resides on this system.
-if [ ! -d ${PKI_PATH} ] ; then
-	echo "This machine is missing the '${PKI_TYPE}' subsystem!"
-	if [ "${command}" != "status" ]; then
-		# * 5 program is not installed
-		exit 5
-	else
-		exit ${default_error}
-	fi
-fi
-
-# Check to insure that this script's associated PKI
-# subsystem instance registry currently resides on this system.
-if [ ! -d ${PKI_REGISTRY} ] ; then
-	echo "This machine contains no registered '${PKI_TYPE}' subsystem instances!"
-	if [ "${command}" != "status" ]; then
-		# * 5 program is not installed
-		exit 5
-	else
-		exit ${default_error}
-	fi
-fi
-
-# Obtain the operating system upon which this script is being executed
-# and initialize environment variables
-OS=`uname -s`
-ARCHITECTURE=""
-LD_LIBRARY_PATH=""
-
-# Time to wait in seconds, before killing process
-#
-#     NOTE:  Defined in "tomcat5.conf" for PKI Java/Tomcat Subsystems.
-#
-STARTUP_WAIT=30
-SHUTDOWN_WAIT=30
-
-# This script must be run as root!
-RV=0
-if [ ${OS} = "Linux" ] ; then
-	PKI_INIT_SCRIPT="/sbin/service ${PKI_PROCESS}"
-	if [ `id -u` -ne 0 ] ; then
-		echo "Must be 'root' to execute '$0'!"
-		if [ "${command}" != "status" ]; then
-			# * 4 user had insufficient privilege
-			exit 4
-		else
-			# * 4 program or service status is unknown
-			exit 4
-		fi
-	fi
-	ARCHITECTURE=`uname -i`
-	if [ ${ARCHITECTURE} = "i386" ] ; then
-		LD_LIBRARY_PATH="/usr/lib:/lib:${LD_LIBRARY_PATH}"
-	elif [ ${ARCHITECTURE} = "x86_64" ] ; then
-		LD_LIBRARY_PATH="/usr/lib64:/lib64:${LD_LIBRARY_PATH}"
-	else
-		echo "Unsupported architecture '${ARCHITECTURE}'!"
-		exit ${default_error}
-	fi
-elif [ ${OS} = "SunOS" ] ; then
-	PKI_INIT_SCRIPT="/etc/init.d/${PKI_PROCESS}"
-	if [ `/usr/xpg4/bin/id -u` -ne 0 ] ; then
-		echo "Must be 'root' to execute '$0'!"
-		if [ "${command}" != "status" ]; then
-			# * 4 user had insufficient privilege
-			exit 4
-		else
-			# * 4 program or service status is unknown
-			exit 4
-		fi
-	fi
-	ARCHITECTURE=`uname -p`
-	if	[ "${ARCHITECTURE}" = "sparc" ] &&
-		[ -d "/usr/lib/sparcv9/" ] ; then
-		ARCHITECTURE="sparcv9"
-	fi
-	if [ ${ARCHITECTURE} = "sparcv9" ] ; then
-		LD_LIBRARY_PATH="/usr/lib/sparcv9:/lib/sparcv9:${LD_LIBRARY_PATH}"
-		LD_LIBRARY_PATH="/usr/lib/sparcv9/dirsec:${LD_LIBRARY_PATH}"
-	else
-		echo "Unsupported architecture '${ARCHITECTURE}'!"
-		exit ${default_error}
-	fi
-else
-	echo "Unsupported OS '${OS}'!"
-	exit ${default_error}
-fi
-export LD_LIBRARY_PATH
 
 # Source function library.
-if [ -f /etc/init.d/functions ]; then
-	. /etc/init.d/functions
-else
-	# The checkpid() function is provided for platforms that do not
-	# contain the "/etc/init.d/functions" file (e. g. - Solaris) . . .
-
-	# Check if ${pid} (could be plural) are running (keep count)
-	checkpid()
-	{
-		rv=0
-		for i in $* ; do
-			ps -p $i > /dev/null 2>&1 ;
-			if [ $? -ne 0 ] ; then
-				rv=`expr $rv + 1`
-			else
-				rv=`expr $rv + 0`
-			fi
-		done
-		# echo "rv=$rv"
-		return $rv
-	}
-
-	# Create the following directories on platforms
-	# where they do not exist (e. g. - Solaris) . . .
-	if [ ! -d "/var/lock" ] ; then
-		mkdir -p /var/lock
-		chown root:sys /var/lock
-		chmod 00755 /var/lock
-	fi
-	if [ ! -d "/var/lock/subsys" ] ; then
-		mkdir -p /var/lock/subsys
-		chown root:root /var/lock/subsys
-		chmod 00755 /var/lock/subsys
-	fi
-fi
-
-PKI_REGISTRY_ENTRIES=""
-TOTAL_PKI_REGISTRY_ENTRIES=0
-TOTAL_UNCONFIGURED_PKI_ENTRIES=0
-
-# Gather ALL registered instances of this PKI subsystem type
-for FILE in `/bin/ls -1 ${PKI_REGISTRY}/* 2>/dev/null`; do
-	if [ -f "$FILE" ] ; then
-		inst=`echo "$FILE"`
-		PKI_REGISTRY_ENTRIES="${PKI_REGISTRY_ENTRIES} $inst"
-		TOTAL_PKI_REGISTRY_ENTRIES=`expr ${TOTAL_PKI_REGISTRY_ENTRIES} + 1`
-	fi
-done
-
-if [ -n "${pki_instance}" ]; then
-	for I in ${PKI_REGISTRY_ENTRIES}; do
-		if [ "${PKI_REGISTRY}/${pki_instance}" = "$I" ]; then
-			PKI_REGISTRY_ENTRIES="${PKI_REGISTRY}/${pki_instance}"
-			TOTAL_PKI_REGISTRY_ENTRIES=1
-			break
-		fi
-	done
-fi
-
-usage()
-{
-	echo -n "Usage: ${PKI_INIT_SCRIPT} "
-	echo -n "{start"
-	echo -n "|stop"
-	echo -n "|restart"
-	echo -n "|condrestart"
-	echo -n "|force-restart"
-	echo -n "|try-restart"
-	echo -n "|reload"
-	echo -n "|status} "
-	echo -n "[instance-name]"
-	echo
-	echo
-}
-
-list_instances()
-{
-	echo
-	for FILE in `/bin/ls -1 ${PKI_REGISTRY}/* 2>/dev/null`; do
-		echo "    ${FILE}"
-	done
-	echo
-}
-
-# Check arguments
-if [ $# -lt 1 ] ; then
-	# * 3 unimplemented feature (for example, "reload")
-	#     [insufficient arguments]
-	echo "$0:  Insufficient arguments!"
-	echo
-	usage
-	echo "where valid instance names include:"
-	list_instances
-	exit 3
-elif [ ${default_error} -eq 2 ] ; then
-	# * 2 invalid argument
-	echo "$0:  Invalid arguments!"
-	echo
-	usage
-	echo "where valid instance names include:"
-	list_instances
-	exit 2
-elif [ $# -gt 2 ] ; then
-	echo "$0:  Excess arguments!"
-	echo
-	usage
-	echo "where valid instance names include:"
-	list_instances
-	if [ "${command}" != "status" ]; then
-		# * 2 excess arguments
-		exit 2
-	else
-		# * 4 program or service status is unknown
-		exit 4
-	fi
-fi
-
-# If an "instance" was supplied, check that it is a "valid" instance
-if [ -n "${pki_instance}" ]; then
-	if [ "${PKI_REGISTRY}/${pki_instance}" != "${PKI_REGISTRY_ENTRIES}" ]; then
-		echo -n "${pki_instance} is an invalid '${PKI_TYPE}' instance"
-		echo_failure
-		echo
-		if [ "${command}" != "status" ]; then
-			# * 5 program is not installed
-			exit 5
-		else
-			# * 4 program or service status is unknown
-			exit 4
-		fi
-	fi
-fi
-
-# On Solaris /var/run is in tmpfs and gets wiped out upon reboot
-# we have to recreate the ${PKI_PIDDIR} directory and make sure that
-# the directory is writable by the ${PKI_TYPE} server process.
-#
-# IMPORTANT:  ALL PKI subsystems installed on this machine MUST utilize
-#             the SAME values for ${PKI_GROUP} and ${PKI_USER}, since the
-#             "${PKI_PIDDIR}" will end up with the ownership permissions
-#             of the first instance that executes this function!
-#
-fix_pid_dir_ownership()
-{
-	if [ ! -d ${PKI_PIDDIR} ] ; then
-		mkdir -p ${PKI_PIDDIR}
-
-		chown root:root /var/run/pki
-		chmod 00755 /var/run/pki
-
-		chown root:root ${PKI_PIDDIR}
-		chmod 00755 ${PKI_PIDDIR}
-	fi
-}
-
-check_pki_configuration_status()
-{
-	rv=0
-
-	rv=`grep -c ^preop ${pki_instance_configuration_file}`
-
-	rv=`expr ${rv} + 0`
-
-	if [ ${rv} -ne 0 ] ; then
-		echo "    '${PKI_INSTANCE_ID}' must still be CONFIGURED!"
-		echo "    (see /var/log/${PKI_INSTANCE_ID}-install.log)"
-		if [ "${command}" != "status" ]; then
-			# * 6 program is not configured
-			rv=6
-		else
-			# * 4 program or service status is unknown
-			rv=4
-		fi
-		TOTAL_UNCONFIGURED_PKI_ENTRIES=`expr ${TOTAL_UNCONFIGURED_PKI_ENTRIES} + 1`
-	elif [ -f ${RESTART_SERVER} ] ; then
-		echo -n "    Although '${PKI_INSTANCE_ID}' has been CONFIGURED, "
-		echo -n "it must still be RESTARTED!"
-		echo
-		if [ "${command}" != "status" ]; then
-			# * 1 generic or unspecified error (current practice)
-			rv=1
-		else
-			# * 4 program or service status is unknown
-			rv=4
-		fi
-	fi
-
-	return ${rv}
-}
-
-get_pki_status_definitions()
-{
-	# establish well-known strings
-	listen_statement="Listen"
-	total_ports=0
-	UNSECURE_PORT=""
-	CLIENTAUTH_PORT=""
-	NON_CLIENTAUTH_PORT=""
-
-	# check to see that an instance-specific "httpd.conf" file exists
-	if [ ! -f ${PKI_HTTPD_CONF} ] ; then
-		echo "File '${PKI_HTTPD_CONF}' does not exist!"
-		exit ${default_error}
-	fi
-
-	# check to see that an instance-specific "nss.conf" file exists
-	if [ ! -f ${PKI_NSS_CONF} ] ; then
-		echo "File '${PKI_NSS_CONF}' does not exist!"
-		exit ${default_error}
-	fi
-
-	# read this instance-specific "httpd.conf" file line-by-line
-	# to obtain the current value of the PKI unsecure port
-
-	exec < ${PKI_HTTPD_CONF}
-	while read line; do
-		# look for the listen statement
-		head=`echo $line | cut -b1-6`
-		if [ "$head" == "$listen_statement" ] ; then
-			# once the 'unsecure' listen statement has been found,
-			# extract the numeric port information
-			port=`echo $line | cut -b8-`
-			UNSECURE_PORT=$port
-			echo "    Unsecure Port              = http://${PKI_SERVER_NAME}:${UNSECURE_PORT}/cgi-bin/so/enroll.cgi"
-			echo "                                 (ESC Security Officer Enrollment)"
-			echo "    Unsecure Port              = http://${PKI_SERVER_NAME}:${UNSECURE_PORT}/cgi-bin/home/index.cgi"
-			echo "                                 (ESC Phone Home)"
-			total_ports=`expr ${total_ports} + 1`
-			break;
-		fi
-	done
-
-	# read this instance-specific "nss.conf" file line-by-line
-	# to obtain the current value of the "clientauth" PKI secure port
-	# AND the current value of the "non-clientauth" PKI secure port
-
-	exec < ${PKI_NSS_CONF}
-	while read line; do
-		# look for the listen statement
-		head=`echo $line | cut -b1-6`
-		if	[ "$head" == "$listen_statement" ] &&
-			[ ${total_ports} -eq 2           ] ; then
-			# once the 'non-clientauth' listen statement has been found,
-			# extract the numeric port information
-			non_clientauth_port=`echo $line | cut -b8-`
-			NON_CLIENTAUTH_PORT=$non_clientauth_port
-			echo "    Secure Non-Clientauth Port = https://${PKI_SERVER_NAME}:${NON_CLIENTAUTH_PORT}/cgi-bin/so/enroll.cgi"
-			echo "                                 (ESC Security Officer Enrollment)"
-			echo "    Secure Non-Clientauth Port = https://${PKI_SERVER_NAME}:${NON_CLIENTAUTH_PORT}/cgi-bin/home/index.cgi"
-			echo "                                 (ESC Phone Home)"
-			total_ports=`expr ${total_ports} + 1`
-			break
-		fi
-		if	[ "$head" == "$listen_statement" ] &&
-			[ ${total_ports} -eq 1           ] ; then
-			# once the 'clientauth' listen statement has been found,
-			# extract the numeric port information
-			clientauth_port=`echo $line | cut -b8-`
-			CLIENTAUTH_PORT=$clientauth_port
-			echo "    Secure Clientauth Port     = https://${PKI_SERVER_NAME}:${CLIENTAUTH_PORT}/cgi-bin/sow/welcome.cgi"
-			echo "                                 (ESC Security Officer Workstation)"
-			echo "    Secure Clientauth Port     = https://${PKI_SERVER_NAME}:${CLIENTAUTH_PORT}/tus"
-			echo "                                 (TPS Roles - Operator/Administrator/Agent)"
-			total_ports=`expr ${total_ports} + 1`
-		fi
-	done
-
-	if [ ${total_ports} -eq 3 ] ; then
-		return 0
-	else
-		return ${default_error}
-	fi
-}
-
-get_pki_configuration_definitions()
-{
-	# Obtain the PKI Subsystem Type
-	line=`grep ^cs.type= ${pki_instance_configuration_file}`
-	pki_subsystem=`echo "${line}" | cut -b9-`
-	if [ "${line}" != "" ] ; then
-		if	[ "${pki_subsystem}" != "CA"   ]  &&
-			[ "${pki_subsystem}" != "KRA"  ]  &&
-			[ "${pki_subsystem}" != "OCSP" ]  &&
-			[ "${pki_subsystem}" != "TKS"  ]  &&
-			[ "${pki_subsystem}" != "RA"   ]  &&
-			[ "${pki_subsystem}" != "TPS"  ]
-		then
-			return ${default_error}
-		fi
-		if	[ "${pki_subsystem}" == "KRA"   ] ; then
-			# Rename "KRA" to "DRM"
-			pki_subsystem="DRM"
-		fi
-	else
-		return ${default_error}
-	fi
-
-	# If "${pki_subsystem}" is a CA, DRM, OCSP, or TKS,
-	# check to see if "${pki_subsystem}" is a "Clone"
-	pki_clone=""
-	if	[ "${pki_subsystem}" == "CA"   ]  ||
-		[ "${pki_subsystem}" == "DRM"  ]  ||
-		[ "${pki_subsystem}" == "OCSP" ]  ||
-		[ "${pki_subsystem}" == "TKS"  ]
-	then
-		line=`grep ^subsystem.select= ${pki_instance_configuration_file}`
-		if [ "${line}" != "" ] ; then
-			pki_clone=`echo "${line}" | cut -b18-`
-			if [ "${pki_clone}" != "Clone" ] ; then
-				# Reset "${pki_clone}" to be empty
-				pki_clone=""
-			fi
-		else
-			return ${default_error}
-		fi
-	fi
-
-	# If "${pki_subsystem}" is a CA, and is NOT a "Clone", check to
-	# see "${pki_subsystem}" is a "Root" or a "Subordinate" CA
-	pki_hierarchy=""
-	if	[ "${pki_subsystem}" == "CA" ]  &&
-		[ "${pki_clone}" != "Clone"  ]
-	then
-		line=`grep ^hierarchy.select= ${pki_instance_configuration_file}`
-		if [ "${line}" != "" ] ; then
-			pki_hierarchy=`echo "${line}" | cut -b18-`
-		else
-			return ${default_error}
-		fi
-	fi
-
-	# If ${pki_subsystem} is a CA, check to
-	# see if it is also a Security Domain
-	pki_security_domain=""
-	if	[ "${pki_subsystem}" == "CA" ] ; then
-		line=`grep ^securitydomain.select= ${pki_instance_configuration_file}`
-		if [ "${line}" != "" ] ; then
-			pki_security_domain=`echo "${line}" | cut -b23-`
-			if [ "${pki_security_domain}" == "new" ] ; then
-				# Set a fixed value for "${pki_security_domain}"
-				pki_security_domain="(Security Domain)"
-			else
-				# Reset "${pki_security_domain}" to be empty
-				pki_security_domain=""
-			fi
-		else
-			return ${default_error}
-		fi
-	fi
-
-	# Always obtain this PKI instance's "registered"
-	# security domain information
-	pki_security_domain_name=""
-	pki_security_domain_hostname=""
-	pki_security_domain_https_admin_port=""
-
-	line=`grep ^securitydomain.name= ${pki_instance_configuration_file}`
-	if [ "${line}" != "" ] ; then
-		pki_security_domain_name=`echo "${line}" | cut -b21-`
-	else
-		return ${default_error}
-	fi
-
-	line=`grep ^securitydomain.host= ${pki_instance_configuration_file}`
-	if [ "${line}" != "" ] ; then
-		pki_security_domain_hostname=`echo "${line}" | cut -b21-`
-	else
-		return ${default_error}
-	fi
-
-	line=`grep ^securitydomain.httpsadminport= ${pki_instance_configuration_file}`
-	if [ "${line}" != "" ] ; then
-		pki_security_domain_https_admin_port=`echo "${line}" | cut -b31-`
-	else
-		return ${default_error}
-	fi
-
-	# Compose the "PKI Instance Name" Status Line
-	pki_instance_name="PKI Instance Name:   ${PKI_INSTANCE_ID}"
-
-	# Compose the "PKI Subsystem Type" Status Line
-	header="PKI Subsystem Type: "
-	if   [ "${pki_clone}" != "" ] ; then
-		if [ "${pki_security_domain}" != "" ]; then
-			# Possible Values:
-			#
-			#     "CA Clone (Security Domain)"
-			#
-			data="${pki_subsystem} ${pki_clone} ${pki_security_domain}"
-		else
-			# Possible Values:
-			#
-			#     "CA Clone"
-			#     "DRM Clone"
-			#     "OCSP Clone"
-			#     "TKS Clone"
-			#
-			data="${pki_subsystem} ${pki_clone}"
-		fi
-	elif [ "${pki_hierarchy}" != "" ] ; then
-		if [ "${pki_security_domain}" != "" ]; then
-			# Possible Values:
-			#
-			#     "Root CA (Security Domain)"
-			#     "Subordinate CA (Security Domain)"
-			#
-			data="${pki_hierarchy} ${pki_subsystem} ${pki_security_domain}"
-		else
-			# Possible Values:
-			#
-			#     "Root CA"
-			#     "Subordinate CA"
-			#
-			data="${pki_hierarchy} ${pki_subsystem}"
-		fi
-	else
-		# Possible Values:
-		#
-		#     "DRM"
-		#     "OCSP"
-		#     "RA"
-		#     "TKS"
-		#     "TPS"
-		#
-		data="${pki_subsystem}"
-	fi
-	pki_subsystem_type="${header} ${data}"
-
-	# Compose the "Registered PKI Security Domain Information" Status Line
-	header="Name: "
-	registered_pki_security_domain_name="${header} ${pki_security_domain_name}"
-
-	header="URL:  "
-	if	[ "${pki_security_domain_hostname}" != ""         ] &&
-		[ "${pki_security_domain_https_admin_port}" != "" ]
-	then
-		data="https://${pki_security_domain_hostname}:${pki_security_domain_https_admin_port}"
-	else
-		return ${default_error}
-	fi
-	registered_pki_security_domain_url="${header} ${data}"
-
-	# Print the "PKI Subsystem Type" Status Line
-	echo
-	echo "    ${pki_instance_name}"
-
-	# Print the "PKI Subsystem Type" Status Line
-	echo
-	echo "    ${pki_subsystem_type}"
-
-	# Print the "Registered PKI Security Domain Information" Status Line
-	echo
-	echo "    Registered PKI Security Domain Information:"
-	echo "    =========================================================================="
-	echo "    ${registered_pki_security_domain_name}"
-	echo "    ${registered_pki_security_domain_url}"
-	echo "    =========================================================================="
-
-	return 0
-}
-
-get_pki_secure_port()
-{
-	# establish well-known strings
-	listen_statement="Listen"
-
-	# first check to see that an instance-specific "nss.conf" file exists
-	if [ ! -f ${PKI_NSS_CONF} ] ; then
-		echo "File '${PKI_NSS_CONF}' does not exist!"
-		exit ${default_error}
-	fi
-
-	# read this instance-specific "nss.conf" file line-by-line
-	# to obtain the current value of the "clientauth" PKI secure port
-	exec < ${PKI_NSS_CONF}
-	while read line; do
-		# look for the listen statement
-		head=`echo $line | cut -b1-6`
-		if [ "$head" == "$listen_statement" ] ; then
-			# once the 'clientauth' listen statement has been found,
-			# extract the numeric port information
-			port=`echo $line | cut -b8-`
-			SECURE_PORT=$port
-			return 0
-		fi
-	done
-
-	return ${default_error}
-}
-
-display_instance_status()
-{
-	rv=0
-
-	if [ -f ${pidfile} ] ; then
-		pid=`cat ${pidfile}`
-		if [ "${pid}" == "" ] ; then
-			echo "${PKI_INSTANCE_ID} pid file exists but is empty"
-			if [ "${command}" != "status" ]; then
-				# * 1 generic or unspecified error (current practice)
-				rv=1
-			else
-				# * 4 program or service status is unknown
-				rv=4
-			fi
-		elif kill -0 ${pid} > /dev/null 2>&1 ; then
-			echo "${PKI_INSTANCE_ID} (pid ${pid}) is running ..."
-			echo
-			check_pki_configuration_status
-			rv=$?
-			if [ ${rv} -eq 0 ] ; then
-				get_pki_status_definitions
-				rv=$?
-				if [ ${rv} -ne 0 ] ; then
-					echo
-					echo "${PKI_INSTANCE_ID} Status Definitions not found"
-				else
-					get_pki_configuration_definitions
-					rv=$?
-					if [ ${rv} -ne 0 ] ; then
-						echo
-						echo "${PKI_INSTANCE_ID} Configuration Definitions not found"
-					fi
-				fi
-			else
-				# From the PKI point of view for a "non-status" action,
-				# a returned error code of "6" implies that the program
-				# is not "configured".  Similarly, an error code of "1"
-				# implies that the program was "configured" but must
-				# still be restarted.
-				#
-				# Similarly, from the PKI point of view for a "status"
-				# action, a returned error code of "4" implies that either
-				# the program is not "configured", or that the program
-				# was "configured" but must still be restarted.
-				#
-				# Regardless, it must still be considered that the instance
-				# is "running" from the viewpoint of other OS programs such
-				# as 'chkconfig'.
-				#
-				# For this reason, when returning from
-				# 'display_instance_status()', ignore non-zero return codes
-				# returned from 'check_pki_configuration_status()'.
-				#
-				if [ "${command}" != "status" ]; then
-					# * 0 action was successful
-					rv=0
-				else
-					# * 0 program is running or service is OK
-					rv=0
-				fi
-			fi
-			echo
-		else
-			echo "${PKI_INSTANCE_ID} is dead but pid file exists"
-			if [ "${command}" != "status" ]; then
-				# * 1 generic or unspecified error (current practice)
-				rv=1
-			else
-				# * 1 program is dead and /var/run pid file exists
-				rv=1
-			fi
-		fi
-	else
-		echo "${PKI_INSTANCE_ID} is stopped"
-		if [ "${command}" != "status" ]; then
-			# * 7 program is not running
-			rv=7
-		else
-			# * 3 program is not running
-			rv=3
-		fi
-	fi
-
-	return ${rv}
-}
-
-start_instance()
-{
-	rv=0
-
-	echo -n $"Starting ${prog}: "
-
-	if [ -f ${RESTART_SERVER} ] ; then
-		rm -f ${RESTART_SERVER}
-	fi
-
-	if [ -f ${PKI_LOCKFILE} ] ; then
-		if [ -f ${pidfile} ]; then
-			read kpid < ${pidfile}
-			if checkpid $kpid 2>&1; then
-				echo
-				echo "${PKI_INSTANCE_ID} (pid ${kpid}) is already running ..."
-				echo
-				check_pki_configuration_status
-				rv=$?
-				if [ ${rv} != 0 ]; then
-					# From the PKI point of view for a "non-status" action,
-					# a returned error code of "6" implies that the program
-					# is not "configured".  Similarly, an error code of "1"
-					# implies that the program was "configured" but must
-					# still be restarted.
-					#
-					# Regardless, it must still be considered that the instance
-					# is "running" from the viewpoint of other OS programs such
-					# as 'chkconfig'.
-					#
-					# For "non-status" actions, ignore return codes of "1"
-					# from 'check_pki_configuration_status()'.
-					#
-					# However, for "non-status" actions that have a return
-					# code of "6", return this value unchanged to
-					# the calling routine so that the total number of
-					# configuration errors may be counted.
-					#
-
-					echo
-					if [ ${rv} = 1 ] ; then
-						# * 0 action was successful
-						return 0
-					elif [ ${rv} = 6 ] ; then
-						# * 6 program is not configured
-						return 6
-					else
-						# should never be reached
-						return ${rv}
-					fi
-				else
-					return 0
-				fi
-			else
-				echo
-				echo -n "lock file found but no process "
-				echo -n "running for pid $kpid, continuing"
-				echo
-				echo
-				rm -f ${PKI_LOCKFILE}
-			fi
-		fi
-	fi
-
-	fix_pid_dir_ownership
-
-	touch ${pidfile}
-	chown ${PKI_USER}:${PKI_GROUP} ${pidfile}
-	chmod 00600 ${pidfile}
-	[ -x /sbin/restorecon ] && /sbin/restorecon  ${pidfile}
-
-	# restore context for ncipher hsm
-	[ -x /sbin/restorecon ] && [ -d /dev/nfast ] && /sbin/restorecon -R /dev/nfast
-
-	if [ -f /etc/init.d/functions ]; then
-		/usr/sbin/selinuxenabled
-		rv=$?
-		if [ ${rv} = 0 ] ; then	
-			if [ ${ARCHITECTURE} = "i386" ] ; then
-				LANG=${PKI_HTTPD_LANG} daemon runcon -t ${PKI_SELINUX_TYPE} -- ${httpd} ${PKI_OPTIONS}
-				# overwrite output from "daemon"
-				echo -n $"Starting ${prog}: "
-			elif [ ${ARCHITECTURE} = "x86_64" ] ; then
-				# NOTE:  "daemon" is incompatible with "httpd"
-				#        on 64-bit architectures
-				LANG=${PKI_HTTPD_LANG} runcon -t ${PKI_SELINUX_TYPE} -- ${httpd} ${PKI_OPTIONS}
-			fi
-		else
-			LANG=${PKI_HTTPD_LANG} daemon ${httpd} ${PKI_OPTIONS}
-			# overwrite output from "daemon"
-			echo -n $"Starting ${prog}: "
-		fi
-	else
-		LANG=${PKI_HTTPD_LANG} ${httpd} ${PKI_OPTIONS} -k start
-	fi
-
-	rv=$?
-	if [ ${rv} = 0 ] ; then
-		touch ${PKI_LOCKFILE}
-		chown ${PKI_USER}:${PKI_GROUP} ${PKI_LOCKFILE}
-		chmod 00600 ${PKI_LOCKFILE}
-	fi
-
-	if [ ${rv} = 0 ] ; then
-		count=0;
-
-		let swait=$STARTUP_WAIT
-		until	[ -s ${pidfile} ] ||
-				[ $count -gt $swait ]
-		do
-			echo -n "."
-			sleep 1
-			let count=$count+1;
-		done
-
-		if [ -f /etc/init.d/functions ]; then
-			if [ "$CONSOLETYPE" = "serial" ]; then
-				echo -n "                                       "
-			fi
-			echo_success
-			echo
-		else
-			echo "                                       [  OK  ]"
-		fi
-
-		get_pki_secure_port
-		if [ $? -ne 0 ] ; then
-			SECURE_PORT="<Port Undefined>"
-		fi
-
-		# Set permissions of log files
-		pki_signedAudit="${pki_logs_directory}/signedAudit"
-		for file in ${pki_logs_directory}/*; do
-			if	[ "${file}" != "${pki_signedAudit}" ]; then
-				chown ${PKI_USER}:${PKI_GROUP} ${file}
-				chmod 00640 ${file}
-			fi
-		done
-
-		# Set permissions of signedAudit log files
-		pki_signedAudit_files=`ls -1A ${pki_signedAudit} | wc -l`
-		if	[ ${pki_signedAudit_files} -gt 0 ]; then
-			for file in ${pki_signedAudit}/*; do
-				chown ${PKI_USER} ${file}
-				chmod 00640 ${file}
-			done
-		fi
+. /etc/init.d/functions
 
-		# ignore "status" return codes
-		echo
-		display_instance_status
-	else
-		if [ -f /etc/init.d/functions ]; then
-			if [ "$CONSOLETYPE" = "serial" ]; then
-				$0	echo -n "                                       "
-			fi
-			echo_failure
-			echo
-		else
-			echo "                                       [  FAILED  ]"
-		fi
-	fi
-
-	if [ ${OS} = "Linux" ] ; then
-		sleep 10
-	elif [ ${OS} = "SunOS" ] ; then
-		sleep 20
-	fi
-	return ${rv}
-}
-
-stop_instance()
-{
-	rv=0
-
-	echo -n "Stopping ${prog}: "
-
-	if [ -f ${PKI_LOCKFILE} ] ; then
-		${httpd} ${PKI_OPTIONS} -k stop
-
-		rv=$?
-
-		if [ ${rv} = 0 ]; then
-			count=0;
-
-			if [ -f ${pidfile} ]; then
-				read kpid < ${pidfile}
-				let kwait=$SHUTDOWN_WAIT
-
-				until	[ `ps -p $kpid | grep -c $kpid` = '0' ] ||
-						[ $count -gt $kwait ]
-				do
-					echo -n "."
-					sleep 1
-					let count=$count+1;
-				done
-
-				if [ $count -gt $kwait ]; then
-					kill -9 $kpid
-				fi
-			fi
-
-			rm -f ${PKI_LOCKFILE}
-			rm -f ${pidfile}
-
-			if [ -f /etc/init.d/functions ]; then
-				if [ "$CONSOLETYPE" = "serial" ]; then
-					echo -n "                                       "
-				fi
-				echo_success
-				echo
-			else
-				echo "                                       [  OK  ]"
-			fi
-		else
-			if [ -f /etc/init.d/functions ]; then
-				if [ "$CONSOLETYPE" = "serial" ]; then
-					echo -n "                                       "
-				fi
-				echo_failure
-				echo
-			else
-				echo "                                       [  FAILED  ]"
-			fi
-			rv=${default_error}
-		fi
-	else
-		echo
-		echo "process already stopped"
-		rv=0
-	fi
-
-	return ${rv}
-}
-
-reload_instance()
-{
-	rv=0
-
-	echo -n $"Reloading ${prog}: "
-
-	if ! LANG=${PKI_HTTPD_LANG} ${httpd} ${PKI_OPTIONS} -t >&/dev/null; then
-		rv=$?
-		echo $"not reloading due to configuration syntax error"
-		if [ -f /etc/init.d/functions ]; then
-			failure $"not reloading ${httpd} due to configuration syntax error"
-		else
-			echo $"not reloading ${httpd} due to configuration syntax error"
-		fi
-	else
-		if [ -f /etc/init.d/functions ]; then
-			killproc -p ${pidfile} ${httpd} -HUP
-			rv=$?
-		else
-			if [ -f ${PKI_LOCKFILE} ] ; then
-				if [ -f ${pidfile} ]; then
-					read kpid < ${pidfile}
-					if checkpid $kpid 2>&1; then
-						kill -HUP $kpid
-						rv=$?
-						if [ ${rv} != 0 ]; then
-							rv=${default_error}
-						fi
-					fi
-				else
-					# * 7 program is not running
-					rv=7
-					echo
-					echo -n "lock file found but no process "
-					echo -n "running for pid $kpid, continuing"
-					echo
-					echo
-					rm -f ${PKI_LOCKFILE}
-				fi
-			fi
-		fi
-	fi
-	echo
-
-	return ${rv}
-}
-
-# The semantics of the 'start()' function differs from the way 'apachectl'
-# does things -- attempting to start while running is a failure.
-# So we just do it the way init scripts are expected to behave here.
-start()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		config_errors=0
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "BEGIN STARTING '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Start every PKI instance of this type that isn't already running
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			start_instance
-
-			rv=$?
-			if [ ${rv} = 6 ] ; then
-				# Since at least ONE configuration error exists, then there
-				# is at least ONE unconfigured instance from the PKI point
-				# of view.
-				#
-				# However, it must still be considered that the
-				# instance is "running" from the point of view of other
-				# OS programs such as 'chkconfig'.
-				#
-				# Therefore, ignore non-zero return codes resulting
-				# from configuration errors.
-				#
-
-				config_errors=`expr $config_errors + 1`
-				rv=0
-			elif [ ${rv} != 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt ${errors} ] ; then
-			touch ${lockfile}
-			chmod 00600 ${lockfile}
-		fi
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			# NOTE:  "bad" return code(s) OVERRIDE configuration errors!
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "1 generic or unspecified error (current practice)"
-				rv=1
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances failed to start!"
-				echo
-			fi
-
-			if [ ${TOTAL_UNCONFIGURED_PKI_ENTRIES} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${TOTAL_UNCONFIGURED_PKI_ENTRIES} "
-				echo -n "of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances MUST be configured!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED STARTING '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances installed!"
-		rv=5
-	fi
-
-	return ${rv}
-}
-
-# The semantics of the 'stop()' function differs from the way 'apachectl'
-# does things -- attempting to shutdown when not running is a failure.
-# So we just do it the way init scripts are expected to behave here.
-stop()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "BEGIN SHUTTING DOWN '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Shutdown every PKI instance of this type that is running
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			stop_instance
-
-			rv=$?
-			if [ ${rv} != 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		if [ ${errors} -eq 0 ] ; then
-			rm -f ${lockfile}
-		fi
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "1 generic or unspecified error (current practice)"
-				rv=1
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances were "
-				echo -n "unsuccessfully stopped!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED SHUTTING DOWN '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances installed!"
-		rv=5
-	fi
-
-	return ${rv}
-}
-
-restart()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	stop
-	sleep 2
-	echo
-	echo "============================================================"
-	echo
-	start
-
-	return $?
-}
-
-reload()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 action was successful
-	#     * 1 generic or unspecified error (current practice)
-	#     * 2 invalid or excess argument(s)
-	#     * 3 unimplemented feature (for example, "reload")
-	#     * 4 user had insufficient privilege
-	#     * 5 program is not installed
-	#     * 6 program is not configured
-	#     * 7 program is not running
-	#     * 8-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "BEGIN RELOADING '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Reload every PKI instance of this type that is running
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			reload_instance
-
-			rv=$?
-			if [ ${rv} != 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "1 generic or unspecified error (current practice)"
-				rv=1
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances were "
-				echo -n "unsuccessfully reloaded!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED RELOADING '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances reloaded!"
-		rv=5
-	fi
-
-	return ${rv}
-}
-
-status()
-{
-	# From "http://fedoraproject.org/wiki/FCNewInit/Initscripts":
-	#
-	#     * 0 program is running or service is OK
-	#     * 1 program is dead and /var/run pid file exists
-	#     * 2 program is dead and /var/lock lock file exists
-	#     * 3 program is not running
-	#     * 4 program or service status is unknown
-	#     * 5-99 reserved for future LSB use
-	#     * 100-149 reserved for distribution use
-	#     * 150-199 reserved for application use
-	#     * 200-254 reserved
-	#
-
-	error_rv=0
-	rv=0
-
-	if [ -n "${PKI_REGISTRY_ENTRIES}" ]; then
-		errors=0
-
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			echo "REPORT STATUS OF '${PKI_TYPE}' INSTANCE(S):"
-		fi
-
-		# Obtain status of every PKI instance of this type
-		for PKI_REGISTRY_ENTRY in ${PKI_REGISTRY_ENTRIES}; do
-			# Source values associated with this particular PKI instance
-			[ -f ${PKI_REGISTRY_ENTRY} ] &&
-			. ${PKI_REGISTRY_ENTRY}
-
-			pidfile=${PKI_PIDDIR}/${PKI_PIDFILE}
-
-			[ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] && echo
-
-			display_instance_status
-
-			rv=$?
-			if [ ${rv} -ne 0 ] ; then
-				errors=`expr $errors + 1`
-				error_rv=${rv}
-			fi
-		done
-
-		# ONLY print a "WARNING" message if multiple
-		# instances are being examined
-		if [ ${TOTAL_PKI_REGISTRY_ENTRIES} -gt 1 ] ; then
-			if [ ${errors} -eq 1 ]; then
-				# Since only ONE error exists, return that "bad" error code.
-				rv=${error_rv}
-			elif [ ${errors} -gt 1 ]; then
-				# Since MORE than ONE error exists, return an OVERALL status
-				# of "4 - program or service status is unknown"
-				rv=4
-			fi
-
-			if [ ${errors} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${errors} of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances reported status failures!"
-				echo
-			fi
-
-			if [ ${TOTAL_UNCONFIGURED_PKI_ENTRIES} -ge 1 ]; then
-				echo
-				echo -n "WARNING:  "
-				echo -n "${TOTAL_UNCONFIGURED_PKI_ENTRIES} "
-				echo -n "of ${TOTAL_PKI_REGISTRY_ENTRIES} "
-				echo -n "'${PKI_TYPE}' instances MUST be configured!"
-				echo
-			fi
-
-			echo
-			echo "FINISHED REPORTING STATUS OF '${PKI_TYPE}' INSTANCE(S)."
-		fi
-	else
-		echo
-		echo "ERROR:  No '${PKI_TYPE}' instances installed!"
-		rv=4
-	fi
-
-	return ${rv}
-}
+# Source the PKI function library
+. /usr/share/pki/scripts/functions
 
 # See how we were called.
-case "${command}" in
-	start|stop|restart|reload|status)
-		${command}
-		exit $?
-		;;
-	condrestart|force-restart|try-restart)
-		[ ! -f ${lockfile} ] || restart
-		exit $?
-		;;
-	*)
-		# * 3 unimplemented feature (for example, "reload")
-		#     [invalid command - should never be reached]
-		echo
-		usage
-		echo "where valid instance names include:"
-		list_instances
-		exit 3
-		;;
+case $command in
+    status)
+	registry_status
+	exit $?
+	;;
+    start)
+	start
+	exit $?
+	;;
+    restart)
+	restart
+	exit $?
+	;;
+    stop)
+	stop
+	exit $?
+	;;
+    condrestart|force-restart|try-restart)
+        [ ! -f ${lockfile} ] || restart
+        exit $?
+        ;;
+    reload)
+        echo "The 'reload' action is an unimplemented feature."
+        exit ${default_error}
+        ;;
+    *)
+	echo "unknown action ($command)"
+        usage
+        echo "where valid instance names include:"
+        list_instances
+        exit ${default_error}
+        ;;
 esac
 
diff --git a/pki/base/tps/setup/config.desktop b/pki/base/tps/setup/config.desktop
index f84fadac2..2bfc396e6 100644
--- a/pki/base/tps/setup/config.desktop
+++ b/pki/base/tps/setup/config.desktop
@@ -21,7 +21,7 @@
 [Desktop Entry]
 Version=1.0.0
 Encoding=UTF-8
-Name=Token Processing System Configuration - [INSTANCE_ID]
+Name=Token Processing System Configuration - [PKI_INSTANCE_ID]
 GenericName=Token Processing System Configuration
 Comment=Configure Token Processing System
 Exec=firefox https://[SERVER_NAME]:[SECURE_PORT]/tps/admin/console/config/login?pin=[PKI_RANDOM_NUMBER]
diff --git a/pki/base/tps/setup/registry_instance b/pki/base/tps/setup/registry_instance
new file mode 100644
index 000000000..e02f19011
--- /dev/null
+++ b/pki/base/tps/setup/registry_instance
@@ -0,0 +1,117 @@
+# Establish PKI Variable "Slot" Substitutions
+
+PKI_FLAVOR=[PKI_FLAVOR]
+export PKI_FLAVOR
+
+PKI_SUBSYSTEM_TYPE=[PKI_SUBSYSTEM_TYPE]
+export PKI_SUBSYSTEM_TYPE
+
+PKI_USER=[PKI_USER]
+export PKI_USER
+
+PKI_GROUP=[PKI_GROUP]
+export PKI_GROUP
+
+PKI_INSTANCE_ID=[PKI_INSTANCE_ID]
+export PKI_INSTANCE_ID
+
+PKI_INSTANCE_INITSCRIPT=[PKI_INSTANCE_INITSCRIPT]
+export PKI_INSTANCE_INITSCRIPT
+
+PKI_HTTPD_CONF=[HTTPD_CONF]
+export PKI_HTTPD_CONF
+
+PKI_SERVER_ROOT=[SERVER_ROOT]
+export PKI_SERVER_ROOT
+
+PKI_SYSTEM_USER_LIBRARIES=[SYSTEM_USER_LIBRARIES]
+export PKI_SYSTEM_USER_LIBRARIES
+
+PKI_FORTITUDE_DIR=[FORTITUDE_DIR]
+export PKI_FORTITUDE_DIR
+
+PKI_NSS_CONF=[NSS_CONF]
+export PKI_NSS_CONF
+
+PKI_SERVER_NAME=[SERVER_NAME]
+export PKI_SERVER_NAME
+
+PKI_LOCK_FILE="[PKI_LOCKDIR]/${PKI_INSTANCE_ID}.pid"
+export PKI_LOCK_FILE
+
+PKI_PID_FILE="[PKI_PIDDIR]/${PKI_INSTANCE_ID}.pid"
+export PKI_PID_FILE
+
+PKI_SELINUX_TYPE="pki_tps_t"
+export PKI_SELINUX_TYPE
+
+pki_instance_configuration_file=${PKI_SERVER_ROOT}/conf/CS.cfg
+export pki_instance_configuration_file
+
+RESTART_SERVER=${PKI_SERVER_ROOT}/conf/restart_server_after_configuration
+export RESTART_SERVER
+
+########################################################################
+#   This section contains modified content of "/etc/sysconfig/httpd"   #
+########################################################################
+# Configuration file for the ${PKI_INSTANCE_ID} service.
+
+#
+# The default processing model (MPM) is the process-based
+# 'prefork' model.  A thread-based model, 'worker', is also
+# available, but does not work with some modules (such as PHP).
+# The service must be stopped before changing this variable.
+#
+PKI_HTTPD=${PKI_FORTITUDE_DIR}/sbin/httpd.worker
+export PKI_HTTPD
+
+#
+# To pass additional options (for instance, -D definitions) to the
+# httpd binary at startup, set PKI_OPTIONS here.
+#
+PKI_OPTIONS="-f ${PKI_HTTPD_CONF}"
+export PKI_OPTIONS
+
+#
+# By default, the httpd process is started in the C locale; to
+# change the locale in which the server runs, the PKI_HTTPD_LANG
+# variable can be set.
+#
+PKI_HTTPD_LANG=C
+export PKI_HTTPD_LANG
+########################################################################
+#                                                                      #
+########################################################################
+
+# This will prevent initlog from swallowing up a pass-phrase prompt if
+# mod_ssl needs a pass-phrase from the user.
+PKI_INITLOG_ARGS=""
+export PKI_INITLOG_ARGS
+
+# Set PKI_HTTPD=/usr/sbin/httpd.worker in /etc/sysconfig/httpd to use a server
+# with the thread-based "worker" MPM; BE WARNED that some modules may not
+# work correctly with a thread-based MPM; notably PHP will refuse to start.
+
+# Path to the server binary and short-form for messages.
+httpd=${PKI_HTTPD}
+export httpd
+
+pki_logs_directory=${PKI_SERVER_ROOT}/logs
+export pki_logs_directory
+
+# see if httpd is linked with the openldap libraries - we need to override them
+if [ ${OS} = "Linux" ]; then
+    hasopenldap=0
+
+    /usr/bin/ldd ${httpd} 2>&1 | grep libldap- > /dev/null 2>&1 && hasopenldap=1
+
+    if [ ${hasopenldap} -eq 1 ] ; then
+        LD_PRELOAD="${PKI_SYSTEM_USER_LIBRARIES}/libldap60.so"
+        LD_PRELOAD="${PKI_SYSTEM_USER_LIBRARIES}/libssl3.so:${LD_PRELOAD}"
+        export LD_PRELOAD
+    fi
+elif [ ${OS} = "SunOS" ]; then
+    LD_PRELOAD_64="${PKI_SYSTEM_USER_LIBRARIES}/libldap60.so"
+    LD_PRELOAD_64="${PKI_SYSTEM_USER_LIBRARIES}/dirsec/libssl3.so:${LD_PRELOAD_64}"
+    export LD_PRELOAD_64
+fi