About This Guide
Chapter 1
Introduction to Certificate Management System
Chapter 2
Default Demo Installation
Chapter 3
Planning Your Deployment
Chapter 4
Installation Worksheet
Chapter 5
Installation and Configuration
Appendix A
Migrating from Certificate Server 1.x
Appendix B
Certificate Extensions
Appendix C
Certificate Download Specification
Appendix D
Using SSL with iPlanet Web Server, Enterprise Edition
Appendix E
Export Control Information
Glossary
Index
Netscape Certificate Management System Installation and Deployment Guide
Contents
Index
Bookshelf
Contents
About This Guide
What You Should Already Know
What's in This Guide
Conventions Used in This Guide
Where to Go for Related Information
Part 1
Overview and Demo Installation
Chapter 1
Introduction to Certificate Management System
System Overview
Public-Key Infrastructure
Subsystems of Certificate Management System
Basic System Configuration
Authentication and Policy Modules
Authentication Modules
Policy Modules
Steps in End-Entity Enrollment
Some Enrollment Scenarios
Firewall Considerations
Extranet/E-Commerce: Acme Sales Corp.
Enrolling Existing Customers
Enrolling New Customers
Enrolling Extranet Users
PIN Registration: Atlas Manufacturing
VPN Client Enrollment and Revocation
Router Enrollment and Revocation
End Entities and Life-Cycle Management
Life-Cycle Management Formats and Protocols
Access to Subsystems
HTML Forms for End Users
Netscape Personal Security Manager
Summary of System Features
Authentication Modules
Policy Modules
Job Scheduler Plug-Ins
Event-Driven Notifications
Registration Manager
Certificate Manager
Signing Algorithms
Certificate Revocation Lists
Data Recovery Manager
Command-Line Utilities
System Architecture
PKCS #11
NSS
JSS and the Java/JNI Layer
Middleware/JDK 1.1.6 Layers
Authentication and Policy Modules
Standards Summary
Certificate Management Formats and Protocols
Security and Directory Protocols
Chapter 2
Default Demo Installation
System Requirements
Operating System and Software Required
Platform Requirements
UNIX Platform Requirements
Windows NT Platform Requirements
Other Requirements
Overview of the Default Demo
Demo Passwords
Installing the Default Demo
Step 1. Run the Installation Script - Unix
Step 1. Run the Installation Script - Windows NT
Step 2. Run the Installation Wizard
Step 3. Get the First User Certificate
Enrolling for the First Agent Certificate
If You Need the First Agent Form Again
Using the Default Demo
Verify the Installation
Viewing Issued Certificates From the Agent Gateway
Enrolling for a Certificate From the End-Entity Gateway
Finding and Approving a Certificate Request
Setting Your Browser to Use the Agent Certificate
Testing Your New Certificate
Create a Policy
Configuring an RSA Key Length Policy
Use an LDAP Directory
Enable Directory-Based Authentication
Add a User to the Directory
Enroll with Directory-Based Authentication
Publish Certificates in a Directory
Configure the Publishing Destination
Set Rules for Publishing Certificates
Update the Publishing Directory
Send Renewal Reminders
Configuring a Mail Server for CMS
Configuring CMS to Send Renewal Reminders
Part 2
Planning and Installation
Chapter 3
Planning Your Deployment
Topology Decisions
Server Groups and CMS Instances
Single Certificate Manager
Certificate Manager and Registration Manager
Certificate Manager and Data Recovery Manager
Certificate Manager, Data Recovery Manager, and Registration Manager
Cloned Certificate Manager
Certificate Authority Decisions
CA's Distinguished Name
CA Signing Key Type and Length
CA Signing Certificate's Validity Period
Self-Signed Root Versus Subordinate CA
CAs and Certificate Extensions
CA Certificate Renewal or Reissuance
Cryptographic Token Decisions
Publishing Decisions
Subsystem Certificate Decisions
SSL Server Certificates
Certificate Manager Certificates
Registration Manager Certificates
Data Recovery Manager Certificate and Storage Key
Authentication Decisions
Policy Decisions
Deployment Strategy and Port Assignments
Chapter 4
Installation Worksheet
Information for Unix Installation Script
Installation Location
Configuration Directory Server
User/Group Directory Server
Configuration Directory Settings
Administration Server Information
Certificate Management System Identifier
Information for NT Installation Script
Installation Directory
Configuration Directory Server
User/Group Directory Server
Configuration Directory Settings
Configuration Directory Server Administrator
Directory Server Administration Domain
Directory Manager Settings
Administration Server Port
Certificate Management System Identifier
Initial Configuration
Internal Database
Administrator
Subsystems
Remote Certificate Manager
Remote Data Recovery Manager
Network Configuration
Certificate Manager Configuration
Server Migration from Certificate Server 1.x
Migration Tool Output Files
Token for CA Signing Certificate
Token for SSL Server Certificate
CA Signing Certificate
CA's Serial Number Range
Key-Pair Information for CA Signing Certificate
Subject Name for CA Signing Certificate
Validity Period for CA Signing Certificate
Extensions for CA Signing Certificate
CA Signing Certificate Request
Registration Manager Configuration
Registration Manager Signing Certificate Request
Key-Pair Information for Registration Manager Signing Certificate
Subject Name for Registration Manager Signing Certificate
Registration Manager Signing Certificate Issuer
Data Recovery Manager Configuration
Transport Certificate
Key-Pair Information for Transport Certificate
Subject Name for Transport Certificate
Validity Period for Transport Certificate
Extensions for Transport Certificate
Transport Certificate Request
Storage Key and Recovery Agent Configuration
Storage Key Creation
Data Recovery Scheme - 1
Data Recovery Scheme - 2
Cloned Certificate Manager Configuration
Server Migration from Certificate Server 1.x
Migration Tool Output Files
Token for CA Signing Certificate
Token for SSL Server Certificate
CA Signing Certificate
CA's Serial Number Range
Cloned Key and Certificate Material
SSL Server Key and Certificate
SSL Server Certificate Configuration
SSL Server Certificate
Key-Pair Information for SSL Server Certificate
Subject Name for SSL Server Certificate
Validity Period for SSL Server Certificate
Extensions for SSL Server Certificate
SSL Certificate Request
Single Sign-On Password
Chapter 5
Installation and Configuration
Installation Overview
Installation Stages
Stage 1: Running the Installation Script
Running the Installation Script on Unix
Running the Installation Script on Windows NT
Stage 2: Using the Installation Wizard
Initial Configuration
Certificate Manager Configuration
Self-Signed CA Certificate
Subordinate CA Certificate Request
Registration Manager Configuration
Data Recovery Manager Configuration
Transport Certificate from a Remote CA
Storage Key and Recovery Agent Configuration
Certificate Manager and Data Recovery Manager Configuration
Certificate Manager Configuration
Data Recovery Manager Configuration
Registration Manager and Data Recovery Manager Configuration
Registration Manager Configuration
Data Recovery Manager Configuration
Cloned Certificate Manager Configuration
SSL Certificate Configuration
SSL Server Certificate from the Local CA
SSL Server Certificate from a Remote CA
Single Signon Configuration
Additional Steps
Administrator/Agent Certificate Enrollment
Stage 3: Further Configuration Options
Stage 4: Creating Additional Instances or Certificate Manager Clones
First Agent for an Additional CMS Instance
Appendix A
Migrating from Certificate Server 1.x
Using the Migration Tool
Command-Line Syntax
Arguments
The Migration Process
Entering Informix Database Login Information
Entering Key and Certificate Database Passwords
Exit Codes and Error Messages
Generated Files
Using Output Files on Another Platform
Converting Output Files
Importing Data to New Databases
Hardware, Operating System, and Version Support
Appendix B
Certificate Extensions
Introduction to Certificate Extensions
Recommendations for Extension Use
Standard X.509 v3 Certificate Extensions
authorityInfoAccess
authorityKeyIdentifier
basicConstraints
certificatePolicies
cRLDistributionPoints
extKeyUsage
issuerAltName
keyUsage
nameConstraints
OCSPNocheck
policyConstraints
policyMappings
privateKeyUsagePeriod
subjectAltName
subjectDirectoryAttributes
subjectKeyIdentifier
Standard X.509 v3 CRL Extensions
Extensions for CRLs
authorityKeyIdentifier
CRLNumber
deltaCRLIndicator
issuerAltName
issuingDistributionPoint
CRL Entry Extensions
certificateIssuer
holdInstructionCode
invalidityDate
reasonCode
Netscape-Defined Certificate Extensions
netscape-cert-type
netscape-comment
Adding Extensions in Certificate Management System
CA Certificates and Extension Interactions
Appendix C
Certificate Download Specification
Data Formats
Binary Formats
Text Formats
Importing Certificate Chains
Importing Certificates into Netscape Communicator
Importing Certificates into Netscape Servers
Object Identifiers
Appendix D
Using SSL with iPlanet Web Server, Enterprise Edition
Creating a New Server
Obtaining a Server Certificate
Creating a Trust Database
Submitting a Certificate Signing Request
Importing the Certificate
Enabling SSL on the Server
Enabling Encryption on the Server
Trusting the Root CA Certificate
Enabling Client Authentication for All Requests
Specifying the Authentication Directory
Note for CGI Programmers
Modifying the Configuration File
Modifying the Access Control Lists
Testing Client Authentication
Appendix E
Export Control Information
Approved Export Operations and Key Sizes
SSL Cipher Suite Profiles for Export
Glossary
Index
Copyright © 2000 Sun Microsystems, Inc. Some preexisting portions Copyright © 2000 Netscape Communications Corp. All rights reserved.
