Complete Contents
About This Guide
PART 1:
Netscape Certificate Management System
Chapter 1:
Introduction to Certificate Management System
Chapter 2:
Administration Tasks and Tool
Chapter 3:
Configuration
PART 2:
Managing Certificate Management System
Chapter 4:
Installing and Uninstalling CMS Instances
Chapter 5:
Starting and Stopping CMS Instances
PART 3:
System-Level Configuration
Chapter 6:
Configuring Ports, Database, and SMTP Settings
Chapter 7:
Managing Privileged Users and Groups
Chapter 8:
Keys and Certificates
PART 4:
Authentication
Chapter 9:
Introduction to Authentication
Chapter 10:
Authentication Modules for End-Entity Enrollment
Chapter 11:
Using the PIN Generator Tool
Chapter 12:
Configuring Authentication for End Users
Chapter 13:
Developing Custom Authentication Modules
PART 5:
Job Scheduling and Notification
Chapter 14:
Introduction to Job Scheduling and Notifications
Chapter 15:
Configuring Schedulable Jobs
PART 6:
Policies
Chapter 16:
Introduction to Policy
Chapter 17:
Constraints-Specific Policy Modules
Chapter 18:
Extension-Specific Policy Modules
Chapter 19:
Configuring a Subsystem's Policies
PART 7:
Publishing
Chapter 20:
Introduction to Publishing Certificates and CRLs
Chapter 21:
Modules for Publishing Certificates and CRLs
Chapter 22:
Configuring a Certificate Manager for Publishing
PART 8:
Agent and End-Entity Interfaces
Chapter 23:
Introduction to End-Entity and Agent Interfaces
Chapter 24:
Customizing End-Entity and Agent Interfaces
PART 9:
Logs
Chapter 25:
Introduction to Logs
Chapter 26:
Managing Logs
PART 10:
Issuance and Management of End-Entity Certificates
Chapter 27:
Issuing and Managing End-Entity Certificates
Chapter 28:
Recovering Encrypted Data
PART 11:
Appendixes
Appendix A: Distinguished Names
Appendix B: Backing Up and Restoring Data
Appendix C: Command-Line Utilities
Appendix D: Certificate Database Tool
Appendix E: Key Database Tool
Appendix F: Netscape Signing Tool
Appendix G: SSL Strength Tool
Appendix H: SSL Debugging Tool
Netscape Certificate Management System Administrator's Guide
Contents
Index
Bookshelf
Netscape Certificate Management System Administrator's Guide
 
 
Contents
About This Guide
What's in This Guide
Who Should Read This Guide
What You Should Already Know
Conventions Used in This Guide
Where to Go for Related Information
Part 1
Netscape Certificate Management System
Chapter 1
Introduction to Certificate Management System
Overview
Key Features
System Architecture
LDAP Directory Integration
How the Main Subsystems Function
Entry Points for Various Types of Users
Chapter 2
Administration Tasks and Tool
Netscape Console
Console Tab
Users and Groups Tab
Netscape Administration Server
Starting Administration Server
Shutting Down Administration Server
Logging In to Netscape Console
The CMS Window
Tasks Tab
Configuration Tab
Status Tab
Logging In to the CMS Window
Chapter 3
Configuration
Effects of Installation Type on Configuration
Duplicating a Configuration from One Instance to Another
Locating the Configuration File
Modifying the Configuration
Changing the Configuration From the CMS Window
Changing the Configuration by Editing the Configuration File
Guidelines for Editing the Configuration File
Sample Configuration File
Road Map to Configuring Subsystems
Part 2
Managing Certificate Management System
Chapter 4
Installing and Uninstalling CMS Instances
Installing Multiple Instances
Viewing Instance Information
Changing the Name of an Instance
Removing an Instance From a System
Uninstalling Certificate Management System
Uninstalling from the Command Line
Uninstalling by Using the Windows NT Add/Remove Programs Utility
Chapter 5
Starting and Stopping CMS Instances
Starting Certificate Management System
Required Start-up Information
Configuring the Server to Start Without the Single Sign-On Password
Configuring the Server to Read the Single Sign-on Password
Starting From Netscape Console
Starting From the Command Line
Starting From the Windows NT Services Panel
Stopping Certificate Management System
Stopping From Netscape Console
Stopping From the Command Line
Stopping From the Windows NT Services Panel
Restarting Certificate Management System
Restarting From the CMS Window
Restarting From the Command Line
Checking System Status
Attending to an Unresponsive Server
CMS Watchdog Process
Password Cache
Password Cache Utility
Locating the PasswordCache Utility
Syntax
Managing the Password Cache
Changing the Single Sign-On Password
Listing the Contents of the Password Cache
Adding a New Entry to the Password Cache
Changing the Password of an Entry in the Password Cache
Deleting an Entry From the Password Cache
Creating a New Password Cache
Password-Quality Checker
Part 3
System-Level Configuration
Chapter 6
Configuring Ports, Database, and SMTP Settings
CMS Ports
Remote Administration Port
Agent Port
End-Entity Ports
Configuring Port Numbers
Step 1. Specify the Port Number
Step 2: Specify IP Addresses
Internal Database
Configuring the Internal Database
Step 1. Identify the Directory Server Instance
Step 2. Restrict Access to the Internal Database
SMTP Settings
Chapter 7
Managing Privileged Users and Groups
Privileged-User Types and Responsibilities
Administrators
Agents
Agent's Certificate for SSL Client Authentication
Revocation Status Checking of Agent Certificates
Trusted Managers
Subsystems That Can Function as Trusted Managers
Connectors for Linking Trusted Managers
Trusted Manager's Certificate for SSL Client Authentication
Groups and Their Privileges
Group for Administrators
Groups for Agents
Group for Certificate Manager Agents
Group for Registration Manager Agents
Group for Data Recovery Manager Agents
Group for Trusted Managers
Setting Up Privileged Users
Setting Up Administrators
Step 1. Find the Required Information
Step 2. Add the Information to the Internal Database
Setting Up Agents
Setting up Agents Using the Automated Process
Setting up Agents Using the Manual Process
Setting Up Trusted Managers
Setting up Trusted Managers Using the Automated Process
Setting Up a Registration Manager as a Trusted Manager
Setting Up a Certificate Manager as a Trusted Manager
Changing Privileged-User Information
Changing a Privileged User's Login Information
Changing a Privileged User's Certificate
Changing Members in a Group
Deleting a Privileged User
Chapter 8
Keys and Certificates
Keys and Certificates for the Main Subsystems
Certificate Manager's Key Pairs and Certificates
CA Signing Key Pair and Certificate
SSL Server Key Pair and Certificate
Registration Manager's Key Pairs and Certificates
Signing Key Pair and Certificate
SSL Server Key Pair and Certificate
Data Recovery Manager's Key Pairs and Certificates
Transport Key Pair and Certificate
Storage Key Pair
SSL Server Key Pair and Certificate
Tokens for Storing Keys and Certificates
Internal Token
External Token
Installing External Tokens
Managing Tokens Used by the Subsystems
Viewing Tokens
Changing a Token's Password
Hardware Cryptographic Accelerators
Certificate Setup Wizard
Using the Wizard to Request a Certificate
Step 1. Select the Operation
Step 2. Choose the Certificate
Step 3. Specify the Key-Pair Information
Step 4. Specify the Subject Name for the Certificate
Step 5. Specify the Validity Period
Step 6. Specify Extensions
Step 7. Copy the Certificate Signing Request
Step 8. Check the Certificate Request Status
Step 9. Send the Certificate Signing Request to a CA
Using the Wizard to Install a Certificate or Certificate Chain
Data Formats for Installing Certificates and Certificate Chains
Step 1. Select the Operation
Step 2. Select the Certificate or Certificate Chain
Step 3. Specify the Location of the Certificate
Step 4. View the Certificate or Certificate Chain
Step 5. Install the Certificate or Certificate Chain
Step 6. Verify the Certificate Status
Configuring the Server's Security Preferences
Configuring the Server to Use Separate SSL Server Certificates
Step 1. Get the Required SSL Server Certificates
Step 2: Update the Configuration
Getting an SSL Client Certificate for a Subsystem
Step 1. Generate a Key Pair for the Subsystem
Step 2. Generate a Certificate Signing Request for the Key Pair
Step 3. Submit the CSR to the CA
Step 4. Ask an Agent to Approve the Request
Step 5. Install the Certificate in the Internal Database
Step 6. Configure the Subsystem to Use This Certificate
Setting Up Cipher Preferences for SSL Communications
SSL Ciphers Supported in Certificate Management System
Configuring the Server to Use Specific Ciphers
Getting New Certificates for the Subsystems
Step 1. Plan for the New Certificate
Step 2. Request the New Certificate
Step 3. Install the New Certificate
Step 4. Deploy the New Certificate
Deploying Certificate Manager's CA Signing Certificate
Deploying Registration Manager's Signing Certificate
Deploying Data Recovery Manager's Transport Certificate
Deploying a Subsystem's SSL Server Certificate
Renewing Certificates for the Subsystems
Step 1. Plan for Certificate Renewal
Step 2. Renew the Existing Certificate
Step 3. Install the Renewed Certificate
Step 4. Deploy the Renewed Certificate
Deploying Certificate Manager's Renewed CA Signing Certificate
Deploying Registration Manager's Renewed Signing Certificate
Deploying Data Recovery Manager's Renewed Transport Certificate
Deploying a Subsystem's Renewed SSL Server Certificate
Step 5. Restart the Server
Managing the Certificate Database
Viewing the Certificate Database Content
Deleting a Certificate From the Certificate Database
Changing the Trust Settings of a CA Certificate
Installing a New CA Certificate in the Certificate Database
Installing a CA Certificate Chain in the Certificate Database
Part 4
Authentication
Chapter 9
Introduction to Authentication
Privileged-User Authentication
Authentication of Administrators
Authentication of Agents
End-Entity Authentication
Authentication of End Entities During Certificate Enrollment
Authentication of End Users During Certificate Renewal
Certificate Renewal Form
Authentication of End Users During Certificate Revocation
SSL Client Authenticated Revocation
Challenge-Password-Based Revocation
Certificate Revocation Forms
Chapter 10
Authentication Modules for End-Entity Enrollment
Overview of Authentication Modules
Manual Authentication
Directory-Based Authentication
UidPwdDirAuth Module
Directory- and PIN-Based Authentication
UidPwdPinDirAuth Module
NIS Server-Based Authentication
NISAuth Module
Portal Enrollment
PortalEnroll Module
Certificate-Based Enrollment
Enrollment Forms
Generating Files Required By Third-Party Object Signing Tools
Chapter 11
Using the PIN Generator Tool
Locating the PIN Generator Tool
The setpin Command
Command-Line Syntax
Arguments
Example
How the Tool Works
Input File
Output File
How PINs Are Stored in the Directory
Exit Codes
Chapter 12
Configuring Authentication for End Users
Authentication Management
Authentication Management From the CMS Window
Authentication Instance Tab
Authentication Plugin Registration Tab
Authentication Parameters in the Configuration File
Managing Authentication Instances
Setting Up Authentication for End-User Enrollment
Step 1: Find the Required Information
Step 2. Set Up the Directory for PIN-Based Enrollment
Step 3. Enable the PIN Present Policy
Step 4: Add an Authentication Instance
Step 5. Set Up the Enrollment Interface
Step 6. Enable End-Entity Interaction
Step 7. Turn on Automated Notification
Step 8. Test Your Authentication Setup
Step 9. Deliver PINs to End Users
Deleting an Authentication Instance
Modifying an Authentication Instance
Managing Authentication Plug-in Modules
Registering an Authentication Module
Deleting an Authentication Module
Chapter 13
Developing Custom Authentication Modules
Authentication Subsystem Architecture
How the Architecture Works
How Authentication Managers Are Used
Customizing Authentication
Step 1. Decide on an Authentication Scheme
Step 2. Write the Authentication Plug-in Module
Authentication Manager Plug-in API
Compiling and Installing Authentication Manager Plug-ins
Authentication Manager Examples
Step 3. Register the Authentication Manager Plug-in Module
Step 4. Create an Instance of the Authentication Plug-in Module
Step 5. Customize the End-Entity Enrollment Forms
Part 5
Job Scheduling and Notification
Chapter 14
Introduction to Job Scheduling and Notifications
Overview of Job Plug-in Modules
Certificate Renewal Notifications
RenewalNotificationJob Module
Notification of Request Queue Status
RequestInQJob Module
Directory Update and Notification
UnpublishExpiredJob Module
Schedule for Executing Jobs
Event-Driven Notifications
Notifications of Certificate Issuance to End Entities
Configuring a Subsystem to Send Notifications to End Entities
Notification of New Request in Queue
Configuring a Subsystem to Send Request Queue Notifications
Customizing Notification Messages
Templates for Event-Triggered Notifications
Templates for Summary Notifications
Customizing Message Templates
Tokens Available in Message Templates
Tokens for Certificate Issuance Notifications to End Entities
Tokens for Rejection Notifications to End Entities
Tokens for Renewal Notification Messages
Tokens for Request In Queue Notification Messages
Tokens for Directory Update Notification Messages
Chapter 15
Configuring Schedulable Jobs
Job Management
Job Management From the CMS Window
Job Instance Tab
Job Plugin Registration Tab
Job Scheduler Parameters in the Configuration File
Scheduling Automated Jobs
Step 1. Plan
Step 2. Modify Existing Jobs
Step 3. Delete Unwanted Jobs
Step 4. Add New Jobs
Step 5. Schedule the Frequency
Step 6. Customize Message Templates
Step 7. Verify Mail Server Settings
Managing Job Plug-in Modules
Registering a Job Module
Deleting a Job Module
Part 6
Policies
Chapter 16
Introduction to Policy
What Is Policy?
Policy Rules
Types of Policy Rules
Using Predicates in Policy Rules
Expression Support for Predicates
Attributes for Predicates
Policy Processor
Built-in Policy Plug-in Modules
Chapter 17
Constraints-Specific Policy Modules
Overview of Constraints-Specific Policy Modules
DSA Key Constraints Policy
DSAKeyConstraints Module
DSAKeyRule Rule
Issuer Constraints Policy
IssuerConstraints Module
IssuerRule Rule
Key Algorithm Constraints Policy
KeyAlgorithmConstraints Module
KeyAlgRule Rule
PIN Present Policy
PinPresentConstraints Module
Renewal Constraints Policy
RenewalConstraints Module
RenewalConstraintsRule Rule
Revocation Constraints Policy
RevocationConstraints Module
RevocationConstraintsRule Rule
Renewal Validity Constraints Policy
RenewalValidityConstraints Module
DefaultRenewalValidityRule Rule
RSA Key Constraints Policy
RSAKeyConstraints Module
RSAKeyRule Rule
Signing Algorithm Constraints Policy
SigningAlgorithmConstraints Module
SigningAlgRule Rule
Subordinate CA Name Constraints Policy
SubCANameConstraints Module
SubCANameConstraints Rule
Unique Subject Name Constraints Policy
UniqueSubjectNameConstraints Module
UniqueSubjectNameConstraints Rule
Validity Constraints Policy
ValidityConstraints Module
DefaultValidityRule Rule
Chapter 18
Extension-Specific Policy Modules
Certificate Extensions
Structure of Certificate Extensions
Sample Certificate Extensions
Object Identifier
Registration of Object Identifiers
Overview of Extension-Specific Policy Modules
Authority Information Access Extension Policy
AuthInfoAccessExt Module
Authority Key Identifier Extension Policy
AuthorityKeyIdentifierExt Module
AuthorityKeyIdentifierExt Rule
Basic Constraints Extension Policy
BasicConstraintsExt Module
BasicConstraintsExt Rule
Certificate Policies Extension Policy
CertificatePoliciesExt Module
CertificatePoliciesExt Rule
Certificate Renewal Window Extension Policy
CertificateRenewalWindowExt Module
Certificate Scope of Use Extension Policy
CertificateScopeOfUseExt Module
CRL Distribution Points Extension Policy
CRLDistributionPointsExt Module
CRLDistributionPointsExt Rule
Extended Key Usage Extension Policy
ExtendedKeyUsageExt Module
CODESigningExt Rule
OCSPSigningExt Rule
Generic ASN.1 Extension Policy
GenericASN1Ext Module
GenericASN1Ext Rule
Issuer Alternative Name Extension Policy
IssuerAltNameExt Module
Key Usage Extension Policy
KeyUsageExt Module
CMCertKeyUsageExt Rule
RMCertKeyUsageExt Rule
ServerCertKeyUsageExt Rule
ClientCertKeyUsageExt Rule
ObjSignCertKeyUsageExt Rule
Name Constraints Extension Policy
NameConstraintsExt Module
NameConstraintsExt Rule
Netscape Certificate Comment Extension Policy
NSCCommentExt Module
NSCCommentExt Rule
Netscape Certificate Type Extension Policy
NSCertTypeExt Module
NSCertTypeExt Rule
OCSP No Check Extension Policy
OCSPNoCheck Module
OCSPNoCheckExt Rule
Policy Constraints Extension Policy
PolicyConstraintsExt Module
PolicyConstraintsExt Rule
Policy Mappings Extension Policy
PolicyMappingsExt Module
PolicyMappingsExt Rule
Private Key Usage Period Extension Policy
PrivateKeyUsagePeriodExt Module
Subject Alternative Name Extension Policy
SubjectAltNameExt Module
SubjectAltNameExt Rule
Subject Directory Attributes Extension Policy
SubjectDirectoryAttributesExt Module
Subject Key Identifier Extension Policy
SubjectKeyIdentifierExt Module
SubjectKeyIdentifierExt Rule
Chapter 19
Configuring a Subsystem's Policies
Policy Management
Policy Management From the CMS Window
Policy Rules Management Tab
Policy Plugin Registration Tab
Policy Parameters in the Configuration File
Setting up Policy Rules for a Subsystem
Step 1. Plan
Step 2. Modify Existing Policy Rules
Step 3. Delete Unwanted Policy Rules
Step 4. Add New Policy Rules
Step 5. Reorder Policy Rules
Step 6. Restart the Server
Step 7. Test Policy Configuration
Step A. Enroll for a Certificate
Step B. Approve the Request
Step C. Check the Certificate Details
Managing Policy Plug-in Modules
Registering a Policy Module
Deleting a Policy Module
Part 7
Publishing
Chapter 20
Introduction to Publishing Certificates and CRLs
Publishing of Certificates
Publishing of Certificates to a Directory
Timing of Directory Updates
Directory Update Process
Directory Synchronization
Publishing of Certificates to a Flat File
Publishing of CRLs
Reasons for Revoking a Certificate
Revocation Checking by Netscape Clients
Revocation Checking by Netscape Servers
Supported Methods for Verifying Revocation Status of Certificates
Publishing of CRLs to an LDAP Directory
Publishing of CRLs to Flat Files
Publishing of CRLs to an Online Validation Authority
Chapter 21
Modules for Publishing Certificates and CRLs
Mapper Modules
Overview of Mapper Modules
CA Certificate Mapper
LdapCaSimpleMap Module
LdapCaCertMap Mapper
LdapCrlMap Mapper
DN Components Mapper
LdapDNCompsMap Module
Subject Name Mapper
LdapDNExactMap Module
Simple Mapper
LdapSimpleMap Module
LdapUserCertMap Mapper
Subject Attribute Mapper
LdapSubjAttrMap Module
Publisher Modules
Overview of Publisher Modules
Flat File Publisher
FileBasedPublisher Module
CA Certificate Publisher
LdapCaCertPublisher Module
LdapCaCertPublisher Publisher
End-Entity Certificate Publisher
LdapUserCertPublisher Module
LdapUserCertPublisher Publisher
CRL Publisher
LdapCrlPublisher Module
LdapCrlPublisher Publisher
ValiCert Publisher
ValiCertPublisher Module
CRL Extension Modules
Structure of CRL Extensions
Sample CRL and CRL Entry Extensions
Overview of CRL Extension Modules
AuthorityKeyIdentifier Rule
CRLNumber Rule
CRLReason Rule
HoldInstruction Rule
InvalidityDate Rule
IssuerAlternativeName Rule
IssuingDistributionPoint Rule
Chapter 22
Configuring a Certificate Manager for Publishing
Publishing Certificates and CRLs to a Directory
Step 1. Plan
Step 2. Set Up the Directory for Publishing
Step A. Verify the Directory Schema
Step B. Add an Entry for the CA
Step C. Identify an Entry That Has Write Access
Step D. Verify Entries for End Entities
Step E. Specify the Directory Authentication Method
Step F. Modify the Certificate Mapping File
Step G. Restart Directory Server
Step 3. Configure the Certificate Manager to Publish Certificates
Step A. Modify the Default Mappers, Publishers, and Publishing Rules
Step B. Add Mappers, Publishers, and Publishing Rules
Step 4. Configure the Certificate Manager to Publish CRLs
Step A. Specify CRL Details
Step B. Set the CRL Extensions
Step C. Create a Mapper for the CRL
Step D. Create a Publisher for the CRL
Step E. Create a Publishing Rule for the CRL
Step 5. Identify the Publishing Directory
Step 6. Test Certificate and CRL Publishing
Step A. Decide a Directory Entry for Requesting a Certificate
Step B. Request a Certificate
Step C. Approve the Request
Step D. Download the Certificate to the Browser
Step E. Check if the Directory Has the Certificate
Step F. Revoke the Certificate
Step G. Check the Directory for the CRL
Manually Updating Certificates and CRL in a Directory
Manually Updating Certificates in the Directory
Manually Updating the CRL in the Directory
Publishing Certificates and CRLs to Flat Files
Step 1. Plan
Step 2. Configure the Certificate Manager
Step A. Create a Publisher for the Flat File
Step B. Create Publishing Rules for Publishing CA Certificate,
Step C. Specify CRL Details
Step D. Set the CRL Extensions
Step E. Make Sure Publishing is Enabled
Step 3. Test Publishing
Step A. Request a Certificate
Step B. Approve the Request
Step C. Download the Certificate to the Browser
Step D. Check the File for the Certificate
Step E. Revoke the Certificate
Step F. Check the File for the CRL
Publishing CRLs to Online Validation Authority
Step 1. Plan
Step 2. Install an OCSP-Compliant Client
Step 3. Install the Certificate VA
Step A: Verify and Copy Files
Step B. Read the Documentation
Step C. Run the Installation Program
Step D. Generate a Key Pair and Self-Signed Certificate
Step E. Copy the CA Certificate
Step F. Add the CA Certificate to the Certificate Store
Step 4. Configure Certificate Manager for Required Extension Policies
Step 5. Replace the Certificate VA's Certificate
Step A. Copy the Server's Certificate Signing Request
Step B. Request an OCSP Responder Certificate From the
Certificate Manager
Step C. Approve the Request
Step D. Add the Certificate to the Certificate Store
Step E. Verify That the Certificates Are Stored
Step 6. Restart Certificate VA
Step 7. Configure the Certificate Manager for Publishing CRLs
Step A. Create a Publisher for the CRL
Step B. Create a Publishing Rule for the CRL
Step C. Specify CRL Details
Step D. Set CRL Extensions
Step E. Make Sure Publishing is Enabled
Step 8. Test Publishing
Step A. Turn On Revocation Checking
Step B. Request a Certificate
Step C. Approve the Request
Step D. Download the Certificate to the Browser
Step E. Verify the Certificate in the Browser
Step F. Check the Certificate VA Status
Step G. Revoke the Certificate
Step H. Verify the Certificate in the Client
Step I. Check the Certificate VA Status Again
Managing Mapper and Publisher Modules
Registering a Mapper or Publisher Module
Deleting a Mapper or Publisher Module
Part 8
Agent and End-Entity Interfaces
Chapter 23
Introduction to End-Entity and Agent Interfaces
End-Entity Services
How Client Type Determines the End-Entity Interface
Certificate Request Formats Specific to End Entities
Agent Services
Certificate Manager Agent Services
Registration Manager Agent Services
Data Recovery Manager Agent Services
Accessing the Agent Services Interface
Chapter 24
Customizing End-Entity and Agent Interfaces
What You Need to Know to Change Forms
HTTP, Query URLs, and HTML Forms
JavaScript
How the Forms Work
Requests Sent to the CMS server
Responses and Output Templates
Errors and the Error Template
Displaying Forms in Non-English Languages
End-Entity Forms and Templates
Locating End-Entity Forms and Templates
Forms for Certificate Enrollment
Forms for Certificate Renewal
Forms for Certificate Revocation
Forms for Certificate Retrieval
Forms for Key Recovery
Other Forms
Output Templates for End-Entity Interfaces
Agent Forms and Templates
Structure of the Agent Services Interface
Locating Agent Forms and Templates
JavaScript Used By All Interfaces
End-entity Interface Reference
Certificate Enrollment Protocol Interface
Description
Default Forms
Request Parameters
Challenge Revocation Interface
Description
Default Forms
Request Parameters
Response
Display Certificate By Serial Number Interface
Description
Default Forms
Request Parameters
Response
Display Certificate From Request Interface
Description
Default Forms
Request Parameters
Response
Enrollment Interface
Description
Default Forms
Request Parameters
Response
Get CA Chain Interface
Description
Default Forms
Request Parameters
Response
Get Certificate By Serial Number Interface
Description
Default Forms
Request Parameters
Response
Get Certificate From Request Interface
Description
Default Forms
Request Parameters
Response
Get CRL Interface
Description
Default Forms
Request Parameters
Response
List Certificates Interface
Description
Default Forms
Request Parameters
Response
Renewal Interface
Description
Default Forms
Request Parameters
Response
Revocation Interface
Description
Default Forms
Request Parameters
Response
Agent Interface Reference
Approve Revocation Interface
Description
Default Forms
Request Parameters
Response
Bulk Enrollment Interface
Description
Configuration Parameters
Default Forms
Request Parameters
Response
Display Key By Serial Number Interface
Description
Default Forms
Request Parameters
Response
Display Key For Recovery Interface
Description
Default Forms
Request Parameters
Response
Examine Recovery Interface
Description
Default Forms
Request Parameters
Response
Get Approval Status Interface
Description
Default Forms
Request Parameters
Response
Get PKCS #12 Data Interface
Description
Default Forms
Request Parameters
Response
Grant Recovery Interface
Description
Default Forms
Request Parameters
Response
Key Query Interface
Description
Default Forms
Request Parameters
Response
Key Recovery Query Interface
Description
Default Forms
Request Parameters
Response
Process Certificate Request Interface
Description
Default Forms
Request Parameters
Response
Process DRM Request Interface
Description
Default Forms
Request Parameters
Response
Process Request Interface
Description
Default Forms
Request Parameters
Response
Recover Key By Serial Number Interface
Description
Default Forms
Request Parameters
Response
Remove Certificate Hold Interface
Description
Default Forms
Request Parameters
Response
Requests Query Interface
Description
Default Forms
Request Parameters
Response
Select for Revocation Interface
Description
Default Forms
Request Parameters
Response
Update CRL Interface
Description
Default Forms
Request Parameters
Response
Update Directory Interface
Description
Default Forms
Request Parameters
Response
Part 9
Logs
Chapter 25
Introduction to Logs
Logs Maintained by Certificate Management System
Services That Are Logged
Log Levels (Message Categories)
Log File Locations
Log File Naming Conventions
Active Log File Naming Convention
Rotated Log File Naming Convention
Buffered Versus Unbuffered Logging
Rotation of Log Files
Timing of Log File Rotation
Location of Rotated Log Files
Deletion of Log Files
How to Conserve Disk Space
Timing of Log File Deletion
Archiving of Rotated Log Files
Chapter 26
Managing Logs
Management of Logs
Log Management From the CMS Window
Log Parameters in the Configuration File
Configuring Logs
Configuring System Logs
Configuring Error Logs
Configuring Audit Logs
Monitoring Logs
Monitoring System Logs
Monitoring Error Logs
Monitoring Audit Logs
Using System Tools for Monitoring the Server (Windows NT Only)
Logging to Windows NT Event Log
Using Event Viewer
Avoiding Event Log From Getting Filled
Signing Log Files
Part 10
Issuance and Management of End-Entity Certificates
Chapter 27
Issuing and Managing End-Entity Certificates
Certificate Issuance to Servers
How the Manual Server Enrollment Process Works
Getting Server SSL Certificates for Netscape Servers
Getting Certificates for Version 3.x Servers
Getting Certificates for Netscape Version 4.x Servers
CEP Enrollment
CEP Enrollment Using the Script
Setting up CEP Enrollment Manually
Step 1. Set up the Directory for Publishing Certificates and CRLs
Step 2. Configure the Certificate Manager for Publishing Certificates and CRLs
Step 3. Set up Automated Enrollment
Step 4. Set Up Multiple CEP Services
Certificate Issuance to Routers or VPN Clients
Step 1. Find the Required Information
Step 2. Generate the Key Pair for the Router
Step 3. Request the CA's Certificate
Step 4. Submit the Certificate Request to the CA
Example
Certificate Renewal
Renewal of Client Certificates
Renewal of Server Certificates
Certificate Revocation
Chapter 28
Recovering Encrypted Data
PKI Setup for Key Archival and Recovery
Clients That Can Generate Dual Key Pairs
Data Recovery Manager
Forms for Users and Key Recovery Agents
Key Archival Process
Why You Should Archive Keys
Where the Keys are Stored
How Key Archival Works
Key Recovery Process
Key Recovery Agents and Their Passwords
Secret Sharing of Storage Key Password
Interface for the Key Recovery Process
Local Versus Remote Key Recovery Authorization
How Agent-Initiated Key Recovery Works
Key Recovery Agent Scheme
Changing the Key Recovery Agent Scheme
Changing Key Recovery Agents' Passwords
Setting Up Key Archival and Recovery Process
Step 1. Set Up the Key Archival Process
Step A. Deploy Clients That Can Generate Dual Key Pairs
Step B. Connect the Enrollment Authority and the Data Recovery Manager
Step C. Customize the Certificate Enrollment Form
Step D. Configure Key Archival Policies
Step 2. Set Up the Key Recovery Process
Step A. Verify the m of n Scheme
Step B. Facilitate the Key Recovery Agents to Change the Passwords
Step C. Determine the Authorization Mode for Key Recovery
Step D. Customize the Key Recovery Form
Step E. Configure Key Recovery Policies
Step 3. Test Your Key Archival and Recovery Setup
Step A. Test Your Key Archival Setup
Step B. Verify the Key
Step C. Delete the Certificate
Step D. Test Your Key Recovery Setup
Step D. Restore the Key in the Browser's Database
Part 11
Appendixes
Appendix A
Distinguished Names
What Is a Distinguished Name?
Distinguished Name Components
Root Distinguished Name
Base Distinguished Name
DNs in Certificate Management System
Extending Attribute Support
Adding New or Proprietary Attributes
Adding Attributes to an Enrollment Form
Changing the DER Encoding Order
Role of Distinguished Names in Certificates
DNs in End-Entity Certificates
DNs in CA Certificates
Selecting DNs for Certificates
DN Patterns and Certificate Subject Names
Appendix B
Backing Up and Restoring Data
Backup and Restore Tools
Backing Up Data
What the Backup Tool Does
What the Backup Tool Does Not Do
Running the Backup Tool
After You Finish a Backup
Restoring Data
Before You Restore Data
Running the Restore Tool
Appendix C
Command-Line Utilities
Summary of Command-Line Utilities
ASCII to Binary Tool
Availability
Syntax
Example
Binary to ASCII Tool
Availability
Syntax
Example
Pretty Print Certificate Tool
Availability
Syntax
Example
Pretty Print CRL Tool
Availability
Syntax
Example
dumpasn1 Tool
Appendix D
Certificate Database Tool
Availability
Syntax
Options and Arguments
Usage
Examples
Creating a New Certificate Database
Listing Certificates in a Database
Creating a Certificate Request
Creating a Certificate
Adding a Certificate to the Database
Validating a Certificate
Appendix E
Key Database Tool
Availability
Syntax
Options and Arguments
Usage
Examples
Creating a Key Database
Generating a New Key
Displaying Public Key Information
Listing Key IDs
Deleting a Private Key
Appendix F
Netscape Signing Tool
Introduction to Netscape Signing Tool
What Is Netscape Signing Tool?
JAR Format and JAR Archives
What Signing a File Means
Object-Signing Certificates
Using Netscape Signing Tool
Getting Ready to Use Netscape Signing Tool
Setting Up Your Certificate
Listing Available Certificates
Signing a File
Using Netscape Signing Tool with a ZIP Utility
Tips and Techniques
SignTool Syntax and Options
Command Syntax
Command Options
Command File Syntax
Command File Keywords and Example
Generating Test Object-Signing Certificates
Generating the Keys and Certificate
Using Netscape Signing Tool with Smart Cards
What Is a Smart Card?
Setting Up a Smart Card
Using the -M Option to List Smart Cards
Using Netscape Signing Tool and a Smart Card to Sign Files
Netscape Signing Tool and FIPS-140-1
Using FIPS-140 Mode
Verifying FIPS Mode
Answers to Common Questions
Appendix G
SSL Strength Tool
Availability
Syntax
Options and Arguments
Usage
Restricting Ciphers
Export Policy and Step-up
Examples
Example 1
Example 2
Example 3
Appendix H
SSL Debugging Tool
Availability
Description
Syntax
Options
Examples
Example 1
Command
Output
Example 2
Command
Output
Example 3
Command
Output
Example 4
Command
Output
Usage Tips
Index
© Copyright © 2000 Sun Microsystems, Inc. Some preexisting portions Copyright © 2000 Netscape Communications Corp. All rights reserved.