Chapter 2 Using Netscape Certificate Management System

With Netscape Certificate Management System, you can perform the following tasks:

• User Enrollment

• Server Enrollment


• Registration Manager Enrollment


• Certificate Manager Enrollment


• OCSP Responder Enrollment


• Object Signing Enrollment


• User Certificate Renewal


• User Certificate Revocation


• Certificate Retrieval


• Import CA Certificate Chain


• Import Certificate Revocation List

• Manual User Enrollment (based on explicit approval by someone who verifies the user's identity)

• Directory-Based User Enrollment (based on user information in an LDAP directory)


• Directory- and PIN-Based Enrollment (based on user information and an identifying PIN number in a directory)


• NIS Server-Based Enrollment (based on user information in a NIS name service)


• Portal Enrollment (based on a user providing information and selecting a user name that is unique in the portal directory)

These attributes are combined with your name and login ID to form a unique identifier called your distinguished name. Ask your system administrator for specific designations for your organization unit and organization. Depending on how your system is configured, you may not need to provide all of these attributes.

The challenge phrase is a password that you can use to revoke your certificate at any time. In order to revoke the certificate, you must either present the certificate to the server (your web browser will do this automatically if the certificate is installed in it) or you must know this secret challenge phrase (in case your certificate is not accessible when you need to revoke it). Select a password that you can remember and use a mix of letters, numbers, and symbols (for example, !,@,#,%,^). Protect your password: if someone else knows it, they can revoke your certificate.

You may be able to provide comments that will help the issuing agent confirm your identity and decide whether to approve your request.

The key length determines the encryption strength of your key. The United States and other governments have set rules governing permissible encryption strengths in data or software that is imported or exported, so the key length you use may be dictated by which countries you are dealing with. If you are not sure what key length to use, ask your system administrator.

If you see text at the top of the form that says IMPORTANT NOTICE TO ADMINISTRATORS, you should immediately contact your system administrator. If this text is present, the form probably won't work, and your administrator may not have set up Certificate Management System and the LDAP directory correctly.

The key length determines the encryption strength of your key. The United States and other governments have set rules governing permissible encryption strengths in data or software that is imported or exported, so the key length you use may be dictated by which countries you are dealing with. If you are not sure what key length to use, ask your system administrator.

If you see text at the top of the form that says IMPORTANT NOTICE TO ADMINISTRATORS, you should immediately contact your system administrator. If this text is present, the form probably won't work, and your administrator may not have set up Certificate Management System and the LDAP directory correctly.

The key length determines the encryption strength of your key. The United States and other governments have set rules governing permissible encryption strengths in data or software that is imported or exported, so the key length you use may be dictated by which countries you are dealing with. If you are not sure what key length to use, ask your system administrator.

Enter the user name and password you use to log on to the NIS-based network or server.

The key length determines the encryption strength of your key. The United States and other governments have set rules governing permissible encryption strengths in data or software that is imported or exported, so the key length you use may be dictated by which countries you are dealing with. If you are not sure what key length to use, ask your system administrator.

Select a user name (or enter the user name you have already registered) and enter a new password. To keep the password secret, it does not appear as you type it (you see only asterisks) so you need to enter it twice: the entries are compared to make sure you typed the same thing in both fields.

This section asks for more information that is needed to issue a certificate to you. Be sure to fill out all fields that are required. In the default form, these fields are marked with an asterisk.

The key length determines the encryption strength of your key. The United States and other governments have set rules governing permissible encryption strengths in data or software that is imported or exported, so the key length you use may be dictated by which countries you are dealing with.

• Server Certificate Enrollment (for Server Administrators)
• Directory-Based Server Enrollment (for Server Administrators)

• If you are the administrator for a Netscape server, create the PKCS #10 request using the Administration Server associated with the server for which you are requesting a certificate. In the Administration Server's administration forms, choose Encryption, then choose Request Server Certificate.
• If you are not using a Netscape server, use your server's tools for creating a PKCS#10 request.

This information is used to verify your identity and to direct the certificate to you when it is issued.

You may be able to provide comments that will help the issuing agent confirm your identity and decide whether to approve your request.

If you see text at the top of the form that says IMPORTANT NOTICE TO ADMINISTRATORS, you should immediately contact your system administrator. If this text is present, the form probably won't work, and your administrator may not have set up Certificate Management System and the LDAP directory correctly.

• If you are the administrator for a Netscape server, create the PKCS #10 request using the Administration Server associated with the server for which you are requesting a certificate. In the Administration Server's administration forms, choose Encryption, then choose Request Server Certificate.
• If you are not using a Netscape server, use your server's tools for creating a PKCS #10 request.

This information is used to find your entry in the directory and to identify you in case an administrator needs to contact you.

You may be able to provide comments that will help your system administrator to track or identify your enrollment request.

The PKCS #10 certificate request that you need to paste here is created during installation of the Registration Manager.

This information is used to identify you in case the administrator needs to contact you and to direct the certificate to you when it is issued.

You may be able to provide comments that will help the issuing agent confirm your identity and decide whether to approve your request.

The PKCS #10 certificate request that you need to paste here is created during installation of the Certificate Manager for which you are requesting a signing certificate.

This information is used to find your entry in the directory and to identify you in case an administrator needs to contact you.

You may be able to provide comments that will help the issuing agent confirm your identity and decide whether to approve your request.

Use your server's tools for creating a PKCS#10 request, copy the request to the clipboard, and then paste the request in this section of the form.

This information is used to verify your identity and to direct the certificate to you when it is issued.

You may be able to provide comments that will help the issuing agent confirm your identity and decide whether to approve your request.

1. The first time you access the CVA admin server page, you see the Certificate VA setup menu. Select "Create a New Key Pair."
2. Follow the instructions to generate a key pair and enter information about your server.
3. Before you submit the certificate request, select "Generate self-signed certificate."

There is a known problem with generating a request to submit to a CA. To work around this problem, you create a self-signed certificate and extract a certificate request from it later.

4. Finish configuring the CVA server, then start it according to the instructions.
5. Reload the CVA admin server page.
6. Select "Manage Keys and Certificates."
7. Select "Display Certificate Request." A PKCS #10 certificate request appears. Copy the request, including the "-----BEGIN CERTIFICATE REQUEST-----" and "-----END CERTIFICATE REQUEST-----" lines to the clipboard.
8. Open the CMS end-entity page in a browser, select the Enrollment tab then select "OCSP Server Enrollment" from the Server section of the menu.
9. Paste the request into the "PKCS #10 Request" text area.
10. Fill in your contact information, then click Submit.

Your request has been submitted. When the certificate is ready, you will be notified by the CMS agent (usually by email) with instructions on where to retrieve the certificate.

11. When the certificate has been issued, copy the base-64 encoded certificate from the CMS retrieval page to the clipboard.
12. Open the CVA admin server page and select "Manage Certificate Stores" then "Add Certificate."
13. Copy and paste the base-64 encoded certificate into the form provided on the CVA admin server.

These attributes are combined with your name and login ID to form a unique identifier called your distinguished name. Ask your system administrator for specific designations for your organization unit and organization. Depending on how your system is configured, you may not need to provide all of these attributes.

Netscape Object-Signing and Microsoft Authenticode signing require different certificate extensions in the signer's certificate. Select the option that corresponds to the object-signing protocol you use.

The key length determines the encryption strength of your key. The United States and other governments have set rules governing permissible encryption strengths in data or software that is imported or exported, so the key length you use may be dictated by which countries you are dealing with. If you are not sure what key length to use, ask your system administrator.

You may be able to provide comments that will help the issuing agent confirm your identity and decide whether to approve your request.

Use the tools that come with your object-signing application to create a PKCS#10 request, copy the request to the clipboard, and then paste the request in this section of the form.

This information is used to verify your identity and to direct the certificate to you when it is issued.

You may be able to provide comments that will help the issuing agent confirm your identity and decide whether to approve your request.

Select the reason for the revocation. The reason is stored with the revoked certificate, where it can be reviewed by an administrator.

See Search Certificates for information on how to search for your certificate's serial number.

The Challenge Password was set when you enrolled for the certificate. If you do not know the challenge password, you will not be able to use this form to revoke your certificate. Contact the Certificate Management System administrator to get your certificate revoked.

Select the reason for the revocation. The reason is stored with the revoked certificate, where it can be reviewed by an administrator.

• Check Request Status: Check on the status of a pending enrollment request.


• List Certificates: Retrieve certificates by serial number


• Search Certificates: Find certificates by their owner or validity information.


• Import CA Certificate Chain: Retrieve the Certificate Manager's own identifying certificate.


• Import Certificate Revocation List: Review or update your local copy of the certificate revocation list (CRL).

You can enter a serial number in hexadecimal form, as it appears in the certificate display (a number preceded by 0x), or in decimal form.

• If you know the specific serial number of the certificate you want, enter it in both the "Lowest Serial Number" and "Highest Serial Number" fields.
• To find all certificates within a range of serial numbers, enter the lowest and highest numbers of the range. If you leave either the lower limit or upper limit field blank, all certificates before or after the one you specify are displayed.

If you are searching within a range of serial numbers, you can choose to filter out certificates that are not currently valid. To do so, click one or both of the checkboxes at the bottom of the form.

You can enter a serial number in hexadecimal form, as it appears in the certificate display (a number preceded by 0x), or in decimal form.

• If you know the specific serial number of the certificate you want, enter it in both the "Lowest Serial Number" and "Highest Serial Number" fields.
• To find all certificates within a range of serial numbers, enter the lowest and highest numbers of the range. If you leave either the lower limit or upper limit field blank, all certificates before or after the one you specify are displayed.

Enter values for one or more of these fields to find certificates by their owner information. When you have entered the field values for the server to match, go to the bottom of this section to specify the type of search (Exact or Partial) that you want performed.

Email address. Narrow the search by email address.

Common name. Find certificates associated with a specific person or server.

UserID. The UserID for the person whose certificate you want to find. For example, at many companies the UserID is the name used to log in to the network when starting up a computer.

Organization unit. Narrow the search to a specific division, department, or unit within an organization.

Organization. Narrow the search to a specific business, university, or organization.

Locality. Narrow the search to a local area (for example, the name of a city).

State. Narrow the search to a state or province.

Country. Narrow the search by country. Enter a two-letter code (for example, US).

If you select the Partial match method, you can specify wildcard patterns by using the question mark character (?) to match an arbitrary single character and the asterisk character (*) to match an arbitrary string of zero or more characters. A single asterisk in a field specifies that the corresponding component must be in the certificate's subject name but may have any value. A blank field indicates that you do not care if the component is present.

Find certificates that have been revoked during a particular period or by a particular agent. For example, you can search for all certificates revoked between July 1996 and January 1997, or all certificates revoked by the agent with the user name admin.

• To find certificates revoked within a particular time period, select the day, month, and year from the drop-down lists to identify the beginning and ending dates.
• To find certificates revoked by a particular agent, enter the name of the agent. You can use wildcards in this field.

Find certificates that have been issued during a particular period or by a particular agent. For example, you can search for all certificates issued between July 1996 and January 1997, or all certificates issued by the agent with the user name betatest.

• To find certificates issued within a time period, select the day, month, and year from the drop-down lists to identify the beginning and ending dates.
• To find certificates issued by a particular agent, enter the name of the agent. You can use wildcards in this field.

Find certificates that become effective or expire during a particular period. For example, you can list all certificates that became valid on June 1, 1996, or that will expire between January 1, 2001 and June 1, 2001.

You can also list certificates that have a validity period of a certain length of time. For example, you can list all certificates that are valid for less than one month.

• To find certificates that become effective or expire within a time period, select the day, month, and year from the drop-down lists to identify the beginning and ending dates.
• To find certificates that have a validity period of a certain length of time, select "Not greater" or "Not less" from the drop-down list, enter a number, and select a time unit from the drop-down list: Days, Weeks, Months, or Years.

Find certain types of certificates—that is, those that are intended for a particular use. For example, you can search for all certificates for subordinate CAs.

For each usage type, choose whether to find certificates where that type is On, Off, or Absent. If you leave the usage type blank, that type is not considered in the search.

This imports the certificate chain for Certificate Management System into your browser's list of trusted CAs. This option works for most browsers.

If your browser does not use the standard importation format or procedure, use this option to save the chain as a binary file and import it by some other method.

This displays the entire certificate chain on your screen in PKCS #7 format, so that you can copy and paste it to import it into a server you manage. For Netscape servers, use the Administration Server associated with the server to import the chain.

For a server that does not accept the PKCS #7 format for certificate chains, this displays each certificate in the chain separately, so that you can import each one into the server.

Use this option to manually check the revocation status of a particular certificate if you are not sure whether you have the latest version of the CRL. Enter the serial number of the certificate in decimal form, or in hexadecimal form (preceded by 0x) as it appears in the certificate display.

If you are using Netscape Navigator or Netscape Communicator, use this option to automatically download and import the latest version of the CRL into your browser.

If you are not using Netscape Navigator or Netscape Communicator, use this option to save a binary form of the latest CRL to a local file. You can import this file into your browser by whatever method is appropriate.

The header of the master CRL published by Certificate Management System contains the date and time of the latest update. You can compare this information to that in your browser's CRL to see if you have the latest version.