Use ./msgcert add-cert to install the certificates of certificate authorities. A CA certificate validates the identity of the CA itself. The server uses these CA certificates in the process of authenticating clients and other servers.
If, for example, you set up your enterprise for certificate-based client authentication in addition to password-based authentication (see “Setting Up Certificate-Based Login” on page 157), you need to install the CA certificates of all CAs that are trusted to issue the certificates that your clients may present. These CAs may be internal to your organization or they may be external, representing commercial or governmental authorities or other enterprises. (For more details on the use of CA certificates for authentication, see Introduction to Public-Key Cryptography in in Managing Servers With iPlanet Console 5.0.)
When installed, Messaging Server initially contains CA certificates for several commercial CAs. If you need to add other commercial CAs or if your enterprise is developing its own CA for internal use (using Sun Java System Certificate Server), you need to obtain and install additional CA certificates.
The CA certificates automatically provided with Messaging Server are not initially marked as trusted for client certificates. You need to edit the trust settings if you want to trust client certificates issued by these CAs. For instructions, see 23.5.1 Obtaining Certificates.
The following procedure describes the process of requesting and installing CA-signed server and trusted CA certificates for use with Messaging Server.
You can also use the Directory Server Admin Console to perform this task.
Generate a CA--signed server certificate request.
msgcert request-cert [-W CERT_PW_FILE] {-S DN|--name NAME [--org ORG] [--org-unit ORG-UNIT] [--city CITY] [--state STATE] [--country COUNTRY] } [-F FORMAT] [-o OUTPUT_FILE] |
Below is an example of a request for a CA-signed server certificate. It returns the certificate in binary format:
./msgcert request-cert --name aqua --org siroe --org-unit Messaging -o my_ca_signed_request_cert |
To return the certificate in ASCII format use the command as follows:
./msgcert request-cert --name aqua --org siroe --org-unit Messaging -F ascii -o my_casigned_request_cert |
Certificate Authorities usually require all of the attributes that are shown in this example in order to completely identify the server. For a description of each attribute, enter ./msgcert request-cert --help. When you request a certificate by using msgcert request-cert, the resulting certificate request is a binary certificate request unless you specify ASCII as output format. If you specify ASCII, the resulting certificate request is a PKCS #10 certificate request in PEM format. PEM is the Privacy Enhanced Mail format specified by RFCs 1421 through 1424 and used to represent a base64-encoded certificate request in US-ASCII characters. The content of the request look similar to the following example:
-----BEGIN NEW CERTIFICATE REQUEST----- MIIBdTCB3wIBADA2MRIwEAYDVQQLEwlNZXNzYWdpbmcxDjAMBgNVBAoTBXNpcm9l MRAwDgYDVQQDEwdhcXVhdGljMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDt KEh5Fnj/h9GEu18Da6DkJpcNShkwxanjnKs2883ZoUV5Sp4pN7U6Vfbh0414WXZh D26m3t81q9b9h47Klkf0pW1X3BB6LOjGOHSt2VoNBI8n3hJ6XiN2zYbrlLTgdKuo y0YrSG/kHFnqKghikag9O/Ox+cwD+mpjl2QnsPZgswIDAQABoAAwDQYJKoZIhvcN AQEEBQADgYEArqgWQIwNZDC2d3EZawI23Wj9o6Pyvu9J1rkb+NYgIEnNp9jugxqX F326N0ABLdHXXNX/2ZvC5TKOgS4RidTBM89N9xJvokmvRGfc+1x80uxy474YdNlZ s+nP8AYo9dW9mrLOammozx9HLPSVYNFp4FxekgV2n8QG7WC5rkN5bCE= -----END NEW CERTIFICATE REQUEST----- |
Transmit the certificate request to your Certificate Authority, according to its procedures.
The process for obtaining your Certificate Authority certificate differs depending on the certificate authority you use. Some commercial CAs provide a website that allows you to automatically download the certificate. Other CAs will email it to you upon request.
After you have sent your request, you must wait for the CA to respond with your certificate. Response time for your request varies. For example, if your CA is internal to your company, the CA might only take a day or two to respond to your request. If your selected CA is external to your company, the CA could take several weeks to respond to your request.
Save the certificate you receive back from the Certificate Authority.
You should back up your certificates in a safe location. If you ever lose the certificates, you can reinstall them by using your backup file. You can save them in text files. The PKCS #11 certificate in PEM format looks similar to the following example.
-----BEGIN CERTIFICATE----- MIICjCCAZugAwIBAgICCEEwDQYJKoZIhKqvcNAQFBQAwfDELMAkGA1UEBhMCVVMx IzAhBgNVBAoGlBhbG9a2FWaWxsZGwSBXaWRnZXRzLCBJbmMuMR0wGwYDVQQLExRX aWRnZXQgTW3FrZXJzICdSJyBVczEpMCcGAx1UEAxgVGVzdCBUXN0IFRlc3QgVGVz dCBUZXN0IFlc3QgQ0EswHhcNOTgwMzEyMDIzMzUWhcNOTgwMzI2MDIzMpzU3WjBP MQswCYDDVQQGEwJVUzEoMCYGA1UEChMfTmV0c2NhcGUgRGlyZN0b3J5VIFB1Ymxp Y2F0aW9uczEWMB4QGA1UEAxMNZHVgh49dq2tLNvbjTBaMA0GCSqGSIb3DQEBAQUA A0kAMEYkCQCksMR/aLGdfp4m0OiGgijG5KgOsyRNvwGYW7kfW+8mmijDtZaRjYNj jcgpF3VnlbxbclX9LVjjNLC5737XZdAgEDozYwpNDARBglghkgBhvhCEAQEEBAMC APAwHkwYDVR0jBBgwFAU67URjwCaGqZHUpSpdLxlzwJKiMwDQYJKoZIhQvcNAQEF BQADgYEAJ+BfVem3vBOPBveNdLGfjlb9hucgmaMcQa9FA/db8qimKT/ue9UGOJqL bwbMKBBopsDn56p2yV3PLIsBgrcuSoBCuFFnxBnqSiTS7YiYgCWqWaUA0ExJFmD6 6hBLseqkSWulk+hXHN7L/NrViO+7zNtKcaZLlFPf7d7j2MgX4Bo= -----END CERTIFICATE----- |
You can also use the Directory Server Admin Console to perform this task.
Add the CA--signed server certificate using the following command:
msgcert add-cert cert_alias cert_file |
Where cert_alias is a name which you give to identify your certificate, and cert_file is the text file containing the PKCS #11 certificate in PEM format.
For example, to install a CA-signed server certificate, you might use a command similar to:
msgcert add-cert /my_cert/server-cert-file |
The certificate is now installed, but is not yet trusted. To trust the CA-signed server certificate, you must install the Certificate Authority certificate.
Add the trusted Certificate Authority certificate using the following command:
msgcert add-cert -C cert_alias cert_file |
The -C option indicates that the certificate is a trusted Certificate Authority certificate.
For example, to install a trusted certificate from a Certificate Authority, you might use the command:
msgcert add-cert -C CA-cert /my_cert/ca-cert-file |
Optionally, use the following command to verify your installed certificates:
To list all server certificates, showing information such as alias and validity dates:
msgcert list-certs |
The Messaging server will have a default certificate called Server-Cert when generated with ./msgcert generate-CertDB . The text Same as issuer indicates that the default certificate is a self-signed server certificate. For example:
# ./msgcert list-certs Enter the certificate database password: Alias Valid from Expires on Self- Issued by Issued to signed ------------ ---------------- --------------- ------ --------------------- -------------- SelfSignedCrt 2006/07/28 12:58 2006/10/28 12:58 y CN=SFO,L=SC,ST=ca,C=us Same as issuer Server-Cert 2006/07/28 07:47 2006/10/28 07:47 y CN=perseids Same as issuer 2 certificates found |
To list trusted CA certificates:
msgcert list-certs -C |
To view the details of a certificate, including the certificate expiry date:
msgcert show-cert cert_alias |
For example, to show a self-signed certificate:
# ./msgcert show-cert MySelfSigned-Cert Enter the certificate database password: Certificate: Data: Version: 3 (0x2) Serial Number: 00:83:35:37:94 Signature Algorithm: PKCS #1 MD5 With RSA Encryption Issuer: "CN=siroe,O=comms,OU=Messaging,L=SantaClara,ST=ca,C=us" Validity: Not Before: Fri Jul 28 19:58:31 2006 Not After : Sat Oct 28 19:58:31 2006 Subject: "CN=siroe,O=comms,OU=Messaging,L=SantaClara,ST=ca,C=us" Subject Public Key Info: Public Key Algorithm: PKCS #1 RSA Encryption RSA Public Key: Modulus: aa:9d:3d:23:b2:59:39:f3:77:c8:69:7f:b0:d1:ac:d2: 4e:81:c8:51:0f:27:6f:a1:21:4b:a9:27:46:d7:0f:b4: c8:44:86:32:5e:4f:2f:1c:2f:a9:b8:a3:49:b5:b8:ab: 51:a8:a5:ba:1c:e8:90:7d:46:67:f9:a7:44:c5:1d:24: e6:bd:e8:8f:07:b4:5a:68:41:b1:19:f2:ea:98:ba:25: 55:b8:ba:9c:af:bb:43:c3:c0:8f:14:a7:4c:2b:50:b4: ac:df:b5:cd:68:de:a6:14:9d:68:77:d3:8b:7f:de:c0: 5d:35:d7:55:8d:b5:c3:14:2a:60:a9:bf:de:96:90:a9 Exponent: 65537 (0x10001) Signature Algorithm: PKCS #1 MD5 With RSA Encryption Signature: 15:86:f1:cc:85:c9:08:0f:ff:d3:56:d8:e2:c8:ea:3c: 8e:45:36:be:8b:b0:7d:2f:e9:cd:e3:b4:ad:8c:70:59: c8:a5:14:da:9c:fa:7f:70:86:64:34:0b:21:ae:c4:28: d2:f5:94:5c:a6:78:0f:d9:fd:fc:c5:5e:37:49:25:a9: bc:12:59:cb:fb:4e:e9:d4:8a:8d:3d:41:12:ae:f1:7f: 8d:d3:10:ac:fb:33:51:5d:0c:1b:dc:23:5f:95:d5:6d: c6:1d:e5:ed:13:8b:16:41:89:5b:4d:de:c0:c7:56:a2: 48:82:38:32:5a:99:d5:21:20:c5:0d:5c:ea:0c:84:aa Fingerprint (MD5): EF:76:A3:6C:09:4E:BC:6B:87:76:A3:35:70:1F:B2:C4 Fingerprint (SHA1): BB:1C:20:4B:79:3A:F1:49:F0:83:FB:CC:9C:56:10:D3:06:97:AA:07 Certificate Trust Flags: SSL Flags: Valid CA Trusted CA User Trusted Client CA Email Flags: User Object Signing Flags: User |
When your CA-signed server certificate (public and private key) expires, you can renew it by using the following procedure. You can also use the Directory Server Admin Console to perform this task.
Obtain an updated CA-signed server certificate from your Certificate Authority.
Once you receive the updated certificate, install the certificate.
msgcert renew-cert cert_alias cert_file |
In some cases you might want to export a certificate so that you can later import the certificate, for example, to another host. You can also use the Directory Server Admin Console to perform this task.
Export the certificate.
msgcert export-cert [-o OUTPUT_FILE] CERT_ALIAS |
For example:
$ ./msgcert export-cert -o /tmp/first-certificate "First Certificate" $./msgcert export-cert -o /tmp/first-server-certificate Server-Cert Choose the PKCS#12 file password: Confirm the PKCS#12 file password: $ls /tmp first-server-certificate /tmp/first-certificate |
Import the certificate.
$ msgcert import-cert CERT_FILE |
For example, to import the certificate
$ msgcert import-cert /tmp/first-server-certificate Enter the PKCS#12 file password: $ |