Netscape Certificate Management System Agent's Guide: Agent Services

About This Guide
Chapter 1 Agent Services
Chapter 2 Handling Certificate Requests
Chapter 3 Finding and Revoking Certificates
Chapter 4 Publishing to a Directory
Chapter 5 Recovering Encrypted Data
Index

Contents

Index

Chapter 1 Agent Services

This chapter describes the role of the privileged users called agents in managing Netscape Certificate Management System (CMS). It also introduces the tools that agents use to administer service requests.

The chapter has the following sections:

Overview of Certificate Management System

Agent Tasks

Forms for Performing Agent Operations

Accessing Agent Services

Overview of Certificate Management System

Netscape Certificate Management System is a highly configurable set of software components and tools for creating, deploying, and managing certificates. The standards and services that facilitate the use of public-key cryptography and X.509 version 3 certificates in a networked environment are collectively called the public key infrastructure (PKI) for that environment. In any PKI, a certificate authority (CA) is a trusted entity that issues, renews, and revokes certificates. An end entity is a person, router, server, or other entity that uses a certificate to identify itself.

To participate in a PKI, an end entity must enroll, or register, in the system. The end entity typically initiates enrollment by giving the CA some form of identification and a newly generated public key. The CA uses the information provided to authenticate, or confirm, the identity; it then issues the end entity a certificate that associates that identity with the public key, and signs the certificate with the CA's own private signing key.

End entities and CAs may be in different geographic or organizational areas or in completely different organizations. CAs may include third parties that provide services through the Internet as well as the root CAs and subordinate CAs for individual organizations. Policies and certificate content may vary from one organization to another. End-entity enrollment for some certificates may require physical verification, such as an interview or notarized documents, while enrollment for others may be fully automated.

To meet the widest possible range of configuration requirements, Certificate Management System permits the independent installation of three separate subsystems, or "managers," that typically play distinct roles:

A Certificate Manager functions as a root or subordinate certificate authority. This subsystem issues, renews, and revokes certificates, generates certificate revocation lists (CRLs), and can publish certificates and CRLs to a Lightweight Directory Access Protocol (LDAP) directory. It can be configured to accept requests from end entities, Registration Managers, or both, and can process requests either manually (that is, with the aid of a human being) or automatically (based entirely on customizable policies and procedures). When set up to work with a separate Registration Manager, the Certificate Manager processes requests and returns the signed certificates to the Registration Manager for distribution to the end entities. (For an overview of the role of certificate authorities and related concepts of public-key cryptography, see Appendix D of Managing Servers with Netscape Console.)

A Registration Manager performs a subset of end-entity tasks performed by the Certificate Manager, such as enrollment or renewal, on behalf of the Certificate Manager. After the Registration Manager approves requests, it forwards them to the Certificate Manager, which processes them and issues the certificates. The Registration Manager then distributes the certificates to the end entities and can publish them to the appropriate directory.

A Data Recovery Manager oversees the long-term archival and recovery of private encryption keys for end entities. A Certificate Manager or Registration Manager can be configured to archive end entities' private encryption keys with a Data Recovery Manager as part of the process of issuing new certificates. The Data Recovery Manager is useful only if end entities are encrypting data (using applications such as S/MIME email) that the organization may need to recover someday. It can be used only with client software that supports dual key pairs—that is, two separate key pairs, one for encryption and one for digital signatures. This service is available in newer clients only (including current versions of Communicator with the Netscape Personal Security Manager installed). The Data Recovery Manager archives encryption keys. It does not archive signing keys, since such archival would undermine nonrepudiation properties of dual-key certificates.

Since CAs can delegate some responsibilities to subordinate CAs, a Certificate Manager might delegate responsibilities to one or more levels of subordinate Certificate Managers, and Registration Managers might delegate responsibilities to subordinate Registration Managers. Therefore many complex variations are possible.

Three kinds of entities can access CMS subsystems: administrators, agents, and end entities. Administrators are responsible for the initial setup and ongoing maintenance of the subsystems. Administrators can designate users with special privileges, called agents, for each subsystem. Agents manage day-to-day interactions with end entities and other aspects of the PKI. This guide describes the tasks that agents can perform. End entities access Registration Manager or Certificate Manager subsystems to enroll in a PKI and to take part in other life-cycle management operations, such as renewal or revocation.

Figure 1.1 shows the ports used by administrators, agents, and end entities. All agent and administrator interactions with CMS subsystems occur over HTTPS. End-entity interactions can take place over HTTP or HTTPS.

Figure 1.1 Certificate Management System and its users

Agent Tasks

The designated agents for each subsystem are responsible for the everyday management of end-entity requests and other aspects of the PKI:

Certificate Manager agents manage certificate requests received by the Certificate Manager subsystem, maintain and revoke certificates as necessary, and maintain global information about certificates.

Registration Manager agents manage the certificate requests received by the Registration Manager subsystem.

Data Recovery Manager agents initiate the recovery of lost keys, and can obtain information about key service requests and archived keys.

To perform the privileged operations of an agent, you use the CMS Agent Services pages. To access these pages, you must have a personal SSL client certificate, and the CMS administrator must have identified you as a privileged user in the user database. For more information on how to get set up as a privileged user, see the Netscape Certificate Management System Administrator's Guide.

Certificate Manager Agent Services
The default entry page to the Certificate Manager agent services is shown in Figure 1.2. To access these pages, you must be a designated Certificate Manager agent and your client software must have a valid certificate identifying you as such.

Figure 1.2 Certificate Manager Agent Services page

As a Certificate Manager agent, you can perform the following tasks:

Handle certificate requests.

You can list the certificate service requests received by the Certificate Manager subsystem, assign requests to yourself, reject or cancel requests, and approve requests for certificate enrollment. See Chapter 2, "Handling Certificate Requests."

Clone requests.

You can clone any request, whether it's still pending, canceled, rejected, or completed. This can be useful in a variety of situations. For example, if a user receives a certificate that doesn't work because it has been incorrectly formulated, you can locate the completed request, clone it, and correct it without requiring the user to enroll a second time. Cloning a request gives it a new request ID number and puts it into the list of pending requests, but does not change the status of the original request.

Find certificates.

You can search for individual certificates, or search for and list certificates by various criteria, then display the details of certificates you have found. See Chapter 3, "Finding and Revoking Certificates."

Revoke certificates.

If a user's key has been compromised, you need to revoke the user's certificate to ensure that the key is not misused. You may also need to revoke the certificates of users who have left the organization. You can use Certificate Manager Agent Services to find and revoke a specific certificate or a set of certificates. Users can also revoke their own certificates. See "Revoking Certificates"in Chapter 3.

Update the CRL.

The Certificate Manager maintains a public list of certificates that have been revoked, called the certificate revocation list (CRL). The list is usually maintained automatically, but you may sometimes need to use the Certificate Manager Agent Services page to update the list manually. See "Updating the CRL" in Chapter 3.

Publish certificates to a directory.

You can set up Certificate Management System to publish certificates and lists of revoked certificates in an LDAP directory. Certificate information is usually published automatically, but you may sometimes need to use the Certificate Manager Agent Services page to update the directory manually. See Chapter 4, "Publishing to a Directory."

Registration Manager Agent Services
The default entry page to the Registration Manager agent services is shown in Figure 1.3. To access these pages, you must be a designated Registration Manager agent and your client software must have a valid certificate identifying you as such.

Figure 1.3 Registration Manager Agent Services page

As a Registration Manager agent, you can handle certificate requests. You can list the certificate service requests received by the Registration Manager subsystem, assign requests to yourself, reject or cancel requests, clone requests, and approve enrollment requests to be passed on to the Certificate Manager for issuance. See Chapter 2, "Handling Certificate Requests."

Data Recovery Manager Agent Services
The default entry page to the Data Recovery Manager agent services is shown in Figure 1.4. To access these pages, you must be a designated Data Recovery Manager agent and your client software must have a valid certificate identifying you as such.

Figure 1.4 Data Recovery Manager Agent Services page

As a Data Recovery Manager agent, you can perform the following tasks:

List key recovery requests from end entities.

List or search for archived keys.

Initiate the recovery of private data-encryption keys.

Key recovery requires the authorization of one or more recovery agents. The administrator for the Data Recovery Manager designates recovery agents. Typically, several recovery agents own portions of the storage key for the Data Recovery Manager. The approval of m of a total of n agents is required to authorize key recovery. The values of m and n for your installation of the Data Recovery Manager is determined by the administrator in charge of the subsystem.

For more information on these tasks, see Chapter 5, "Recovering Encrypted Data."

Forms for Performing Agent Operations

The agent services consist of a form-based HTML interface that is part of your Certificate Management System installation. The CMS administrator designates particular users as agents for each installed subsystem (Certificate Manager, Registration Manager, and Data Recovery Manager). Only a designated agent for a subsystem can use the Agent Services interface for that subsystem. In addition, you must have a personal client SSL certificate to access the Agent Services interface.

As a subsystem agent with the proper certificate, you use the Agent Services page to access the forms you need to perform the agent tasks. Table 1.1 describes each of these HTML forms.

Table 1.1 Forms used for agent operations


Form name	Description
List Requests (Certificate Manager and Registration Manager)	Use this form to examine, select, and process requests for certificate services. Both Certificate Manager and Registration Manager agents can use this form. For instructions on using this form, see "Listing Certificate Requests" in Chapter 2.
List Certificates (Certificate Manager)	Use this form to list certificates within a range of serial numbers. You can limit the list to valid certificates. Only Certificate Manager agents can use this form. For instructions on using this form, see "Basic Certificate Listing" in Chapter 3.
Search for Certificates (Certificate Manager)	Use this form to search for and list certificates issued by CMS. Only Certificate Manager agents can use this form. This form allows you to search by subject name or by certificate type, the state of the certificate (expired, revoked, and so on), and the dates when the certificate was issued or revoked, expired, or became valid. For instructions on using this form, see "Advanced Certificate Search" in Chapter 3.
Revoke Certificates (Certificate Manager)	Use this form to search for and revoke certificates issued by Certificate Management System. Only Certificate Manager agents can use this form. For instructions on using this form, see "Revoking Certificates" in Chapter 3.
Update Revocation List (Certificate Manager)	Use this form to manually update the published list of revoked certificates. Only Certificate Manager agents can use this form. For instructions on using this form, see "Managing the Certificate Revocation List" in Chapter 3.
Update Directory Server (Certificate Manager)	Use this form to update the LDAP publishing directory with changes in certificate information (newly issued certificates, updated CRLs, and so on). Only Certificate Manager agents can use this form. For instructions on using this form, see "Updating the Directory with Changes" in Chapter 4.
List Requests (Data Recovery Manager)	Use this form to find and examine requests for key services. Only Data Recovery Manager agents can use this form. For instructions on using this form, see "Viewing Key Service Requests" in Chapter 5.
Search for Keys (Data Recovery Manager)	Use this form to find and list specific archived keys. Only Data Recovery Manager agents can use this form. For instructions on using this form, see "Finding Archived Keys" in Chapter 5.
Recover Keys (Data Recovery Manager)	Use this form to find and recover specific archived keys. Only Data Recovery Manager agents can use this form. You can select a key in the list returned by a search and initiate its recovery, which must be authorized by designated key recovery agents. For instructions on using this form, see "Recovering Keys" in Chapter 5.
Authorize Recovery (Data Recovery Manager)	Use this form to remotely authorize a key recovery request initiated by another Data Recovery Manager agent. Key recovery agents do not have to be Data Recovery Manager agents if key recovery is handled locally; however, only key recovery agents who are also Data Recovery Manager agents can access this form. For instructions on using this form, see "Recovering Keys" in Chapter 5.