About This Guide
Chapter 1 Agent Services
Chapter 2 Handling Certificate Requests
Chapter 3 Finding and Revoking Certificates
Chapter 4 Publishing to a Directory
Chapter 5 Recovering Encrypted Data
Index
Netscape Certificate Management System Agent's Guide: Handling Certificate Requests
Previous Next Contents Index


Chapter 2 Handling Certificate Requests

As a Certificate Manager or Registration Manager agent, you are responsible for handling both manual enrollment requests made by end entities (end users, server administrators, or other CMS subsystems) and automated enrollment requests that have been deferred. This chapter describes the general procedure for handling requests and explains how to handle different aspects of certificate request management.

The chapter has the following sections:


Managing Requests
This the typical procedure for handling certificate enrollment requests:

  1. View the list of pending requests for the Certificate or Registration Manager (see "Listing Certificate Requests").

  2. Select a request from the list to view it and, optionally, assign the request to yourself (see "Selecting a Request").

  3. Process the request (see "Approving Requests" and "Other Options for Handling Requests").
In processing a request for a certificate, you can choose to take one of the following actions:

Each of these actions changes the status of the certificate request. If you close the form without taking one of these actions, the request remains in the queue with the same status.

It's also possible to clone any request, whether it's still pending, canceled, rejected, or completed. This can be useful in a variety of situations. For example, if a user receives a certificate that doesn't work because it has been incorrectly formulated, you can locate the completed request, clone it, and correct it without requiring the user to enroll a second time. Cloning a request gives it a new request ID number and puts it into the list of pending requests, but does not change the status of the original request.

Figure 2.1 illustrates the process for handling requests and the different types of status for a request.

Figure 2.1    The certificate request management process


Listing Certificate Requests
The Certificate or Registration Manager keeps a queue of all certificate service requests that have been submitted to it. The queue records whether a request is pending, completed, canceled, or rejected. Four types of requests can be in the queue:

As a Certificate or Registration Manager agent, you must review and approve manual enrollment requests; those that require review have a status of Pending.

To see a list of requests:

  1. Go to the Certificate or Registration Manager Agent Services page (see Accessing Agent Services).

    2. You must submit the proper client certificate to get access to this page.

  2. Click List Requests at the top of the left frame to view the queue of requests for certificates and to issue those certificates.

    3. The List Requests form appears.

  3. Choose the type of requests you want to see by selecting one of the following from the Request type menu:

  4. Choose the status of requests you want to see by selecting one of the following from the Request status menu:

  5. To start the list at a specific place in the queue, enter the starting request identifier in decimal or hexadecimal form.

    6. Use 0x to indicate a hexadecimal number; for example, 0x2A.

  6. Choose the number of matching requests you want to see. When you specify a number n, the system displays the first n requests after the starting sequence number that matches your specified criteria.

  7. Click Find to display the list of requests that match your specified criteria.

    8. The Request Queue form appears.

Selecting a Request
To select a request from the queue:

  1. On the Agent Services page, click List Requests, specify search criteria, and click Find to display a list of certificate signing requests.

    2. See "Listing Certificate Requests" for details.

  2. On the Request Queue form, find the particular request you want to examine.

    3. If the request you want to see is not shown, scroll to the bottom of the list, specify an additional number n, and click Find. The system displays the next n requests that match your original search criteria.

  3. When you have found the request you want, click Details at the left.

    4. The Request details form appears, showing detailed information about the selected request. Use this form to approve or otherwise handle the request. For more information, see "Approving Requests" and "Other Options for Handling Requests."

    If the system changes the state of the displayed request, and if you use your browser's Back or Forward buttons or the Go (history) menu to move to another page, the data shown can become out of date. To refresh the data, click the highlighted serial number at the top of the page.


Approving Requests
As an agent, you can approve a certificate request. If the request was made directly to the Certificate Manager, it issues the certificate; if the request was made through a Registration Manager, the Registration Manager passes the approved request on to the Certificate Manager for issuance. Before approving a request, you can assign it to yourself, adjust the attributes of the request, and verify that it will result in a valid certificate. To do these things, use the Request Details form that appears when you examine a selected request (as described in "Selecting a Request"). If you want to reject or cancel the request, see "Other Options for Handling Requests."The approval and issuing process has the following stages:

Assigning a Request
Before acting on a request, you can assign it to yourself. Assignment is not required; any agent can act on an unassigned request. When a request is assigned to a particular agent, all agents can examine that request, but only the assigned agent can act on it. When a request is assigned to another agent, however, you can choose to reassign it to yourself in order to act on it.

When you view the details of an unassigned request, you can click "assign to me" to assign it to yourself. The request is immediately assigned to you, and the Request Details page reflects the assignment. If you leave the page without approving, rejecting, or canceling the request, the request remains in the queue with the status of Pending, but it is assigned to you.

Adjusting, Verifying, and Approving a Request
Before you verify and approve a request, you can adjust some of the parameters, such as the subject name and validity period.

To adjust, verify, and approve a certificate request:

  1. Select the certificate request from a list of requests, as described in "Selecting a Request."

  2. In the Service Request form, check the Assigned To prompt to see if the certificate request is assigned to you.

  3. To change the subject name, enter a new value in the Subject Name field.

    4. For example, you might need to change the subject name to prevent duplications or to correct spelling errors. Nothing prevents you from issuing many different certificates with the same subject name. However, in current versions of Netscape software (Netscape Navigator, Netscape Communicator, and Netscape servers), you cannot install more than one certificate with a particular subject name.

  4. If you want to change the validity period, you can set the dates directly using the menus for start and end times or you can select a predefined period from the "Length of validity period" menu. Making a selection from the "Length of validity period menu" sets the "Not valid after" date based on the "Not valid before date" and your selection.

  5. Use the Extensions section to specify Netscape certificate type bits that you want to be set in the issued certificate.

  6. If you want to add extensions other than Netscape cert type extensions, you can paste a base-64 encoding of the extension in the "Additional Extensions" field.

  7. If you want the certificate to be signed using a signature algorithm other than the default, choose an alternative from the "Signature algorithm" drop-down list:

  8. Review the unauthenticated request attributes. These attriubutes were submitted by the end entity with the enrollment request. Since these attributes do not come from a trusted source (such as an authentication module in the CMS server), they are "unauthenticated." Your site policies may or may not require agents to review or validate any of these attributes.

  9. Review the authenticated attributes. These attributes were generated in the CMS server by authentication or policy plug-in modules. They are considered authenticated since they have been validated by or have originated in the CMS server itself.

  10. If the certificate request is for an SSL client certificate for a CMS manager or a CMS agent, you should indicate this in the last section, labeled Privileges.

  11. To approve the request and issue the certificate, open the drop-down menu at the bottom of the page, choose "Accept this request," then click Do It.

    12. If the certificate conforms to policy, a page containing the new certificate appears. It includes instructions on how to help the certificate requester install the new certificate.

Note. If, after verifying or attempting to issue the certificate, you receive the error message "The requested signature algorithm is not enabled," check with your CMS administrator to make sure that the signature algorithm you selected in Step 7 is supported.

Sending an Issued Certificate to the Requester
When the Certificate Manager has issued a certificate in response to a request, the user who requested it must receive a copy of it to install locally. End users install their own certificates in their client software. Server administrators install their servers' certificates in the servers that they manage.

Depending on how your Certificate Management System is configured, an end user who requests a certificate might receive automatic email notification of the success of the request; this email message contains either the certificate itself or a URL from which the user can get the certificate. In this case, you need not take any further action.

If your system is not configured for automatic certificate-issuance notification, or if the requester is a server administrator, you must either send the issued certificate to the requester or ask the requester to pick it up from the Certificate Manager's end-entity gateway.

Figure 2.2 shows a web page containing a new certificate. This is the page you receive in response to the command "Issue this certificate," as described in Step 11 in "Approving Requests.") Before you issue the certificate, you should copy the requester's email address.

Figure 2.2    A newly issued certificate page

To copy and mail a new server certificate to the requester, follow these steps:

  1. Open a new email message composition window and address it to the requester.

  2. From the Agent Services window where the new certificate is displayed, copy only the base-64 encoded certificate. Be sure to include the marker lines -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.

  3. Paste the base-64 encoded certificate into the addressed email message and send the message.
To deliver a new client certificate to the requester, note the serial number of the request you approved, then follow these steps:

  1. Go to the Agent Services gateway, click List Requests in the left frame, enter the serial number for the request that you approved, and click Find.

  2. In the Request Queue form, click Details beside the relevant request, then right-click the certificate serial number and choose Open Frame in New Window from the pop-up menu.

  3. In the new browser window containing the certificate, copy the URL from the Location or Netsite field.

  4. Open a new email message composition window and address it to the requester.

  5. Paste the URL into the body of the message, along with instructions to the effect that the user should go to that URL and click the Import button at the bottom of the page.
Alternatively, you can include the URL for the Agent Services gateway in the email message instead, along with the certificate serial number, and instruct the user as follows:

  1. Click the Retrieval tab. The List Certificates form should appear.

  2. Enter the serial number of the certificate in both serial number fields.

  3. Click Find.

  4. When the Search Results form appears, click Details.

  5. When the certificate appears, scroll down to the bottom of the form and click Import Certificate.
Other Options for Handling Requests
If you do not want to issue the certificate in response to a certificate request, you can choose one of the other options from the command menu at the bottom of the Request Details form, then click Do It.

 

Copyright © 2000 Sun Microsystems, Inc. Some preexisting portions Copyright © 2000 Netscape Communications Corp. All rights reserved.