Netscape NETSCAPE MANAGEMENT SYSTEM 4.5 Assembly instructions

Installation and Setup Guide
Netscape Certificate Management System
Version4.5
October 2001

Netscape Communications Corporation (“Netscape”), a subsidiary of America Online, Inc., and its licensors retain all ownership
rights to the software programs offered by Netscape (referred to herein as “Software”) and related documentation. Use of the
Software and related documentation is governed by the license agreement accompanying the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations, or compilation works
is prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without
notice.
THIS DOCUMENTATION IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE
LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY
ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,
PROFITS, USE, OR DATA.
Software applications: © 2001 Sun Microsystems, Inc.
Some software code: © 1999, 2001 Netscape Communications Corporation.
All rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and
other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications
Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their
respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full
compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation
to the U.S. Government is with restricted rights as described in the license agreement accompanying Netscape software.

3
Contents
AboutThisGuide.............................................................. 23
What’sinThisGuide....................................................................23
WhatYouShouldAlreadyKnow .........................................................26
ConventionsUsedinThisGuide .........................................................27
WheretoGoforRelatedInformation......................................................28
Part 1 OverviewandDemoInstallation......................................... 31
Chapter 1 IntroductiontoCertificateManagementSystem.......................... 33
OverviewofKeyFeatures ...............................................................34
Flexibleend-entityregistrationservicesframework ....................................38
SystemOverview.......................................................................41
Public-KeyInfrastructure .............................................................43
CMSSubsystemsorManagers.........................................................44
CertificateManager ...............................................................45
RegistrationManager..............................................................47
DataRecoveryManager............................................................48
OnlineCertificateStatusManager ...................................................49
BasicSystemConfiguration ...........................................................50
Plug-inModules.....................................................................55
AuthenticationPlug-inModules ....................................................55
PolicyPlug-inModules ............................................................57
JobPlug-InModules...............................................................61
MapperandPublisherPlug-inModules ..............................................62
Event-DrivenNotifications............................................................64

4 Netscape Certificate Management System Installation and Setup Guide • October 2001
AuxiliaryComponents.................................................................. 64
Command-Line Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
CMSSDK .......................................................................... 65
EntryPointsforVariousTypesofUsers ................................................... 66
AgentServicesInterface .............................................................. 68
CertificateManagerAgentServices ................................................. 68
RegistrationManagerAgentServices ................................................ 69
DataRecoveryManagerAgentServices.............................................. 70
OnlineCertificateStatusManagerAgentServicesInterface............................. 71
End-EntityServicesInterface.......................................................... 72
SystemArchitecture .................................................................... 73
PKCS#11........................................................................... 74
NSS................................................................................ 76
JSSandtheJava/JNILayer ........................................................... 76
Middleware/Java2Layers ........................................................... 76
AuthenticationandPolicyModules .................................................... 77
Standards Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
CertificateManagementFormatsandProtocols.......................................... 77
SecurityandDirectoryProtocols....................................................... 78
Chapter 2 CertificateEnrollmentandLife-CycleManagement ....................... 81
StepsinEnd-EntityEnrollment .......................................................... 81
SomeEnrollmentScenarios.............................................................. 84
FirewallConsiderations .............................................................. 84
Extranet/E-Commerce:AcmeSalesCorp. .............................................. 85
EnrollingExistingCustomers....................................................... 86
EnrollingNewCustomers.......................................................... 87
EnrollingExtranetUsers ........................................................... 89
PINRegistration:AtlasManufacturing ................................................. 91
VPNClientEnrollmentandRevocation ................................................ 93
RouterEnrollmentandRevocation..................................................... 96
EndEntitiesandLife-CycleManagement.................................................. 98
Life-CycleManagementFormatsandProtocols.......................................... 98
AccesstoSubsystems ................................................................ 99
HTMLFormsforEndUsers.......................................................... 101
NetscapePersonalSecurityManager .................................................. 102
Chapter 3 DefaultDemoInstallation ........................................... 105
SystemRequirements.................................................................. 106
OperatingSystemandSoftwareRequired ............................................. 106
PlatformRequirements.............................................................. 106
OverviewoftheDefaultDemo.......................................................... 108

5
DemoPasswords ...................................................................111
Installing the Default Demo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Step1.RuntheInstallationScript—UNIX .............................................112
Step1.RuntheInstallationScript—WindowsNT .......................................114
Step2.RuntheInstallationWizard....................................................122
Step3.GettheFirstUserCertificate ...................................................135
EnrollingfortheFirstAgentCertificate .............................................135
IfYouNeedtheFirstAgentFormAgain ............................................137
UsingtheDefaultDemo................................................................138
VerifytheInstallation ...............................................................138
ViewingIssuedCertificatesFromtheAgentGateway .................................139
EnrollingforaCertificateFromtheEnd-EntityGateway ..............................140
FindingandApprovingaCertificateRequest ........................................141
SettingYourBrowsertoUsetheAgentCertificate ....................................142
TestingYourNewCertificate ......................................................142
CreateaPolicy .....................................................................143
ConfiguringanRSAKeyLengthPolicy .............................................143
UseanLDAPDirectory..............................................................145
Step1.EnableDirectory-BasedAuthentication .......................................146
Step2.AddaUsertotheDirectory .................................................147
Step3.EnrollwithDirectory-BasedAuthentication ...................................149
PublishCertificatestoanLDAPDirectory..............................................150
ConfigurethePublishingDestination ...............................................151
SetRulesforPublishingCertificates ................................................153
UpdatethePublishingDirectory ...................................................154
SendRenewalReminders ............................................................156
ConfiguringaMailServerforCertificateManagementSystem .........................157
ConfiguringCertificateManagementSystemtoSendRenewalReminders ...............157
Part 2 PlanningandInstallation.............................................. 161
Chapter 4 Planning Your Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
TopologyDecisions....................................................................164
ServerGroupsandCMSInstances ....................................................164
SingleCertificateManager ...........................................................165
CertificateManagerandRegistrationManager .........................................166
CertificateManagerandDataRecoveryManager .......................................168
CertificateManager,DataRecoveryManager,andRegistrationManager...................170
ClonedCertificateManager ..........................................................172
CertificateAuthorityDecisions ..........................................................173
CA’sDistinguishedName ...........................................................173

6 Netscape Certificate Management System Installation and Setup Guide • October 2001
CASigningKeyTypeandLength .................................................... 174
CA Signing Certificate’s Validity Period . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Self-SignedRootVersusSubordinateCA .............................................. 174
CAsandCertificateExtensions ....................................................... 175
CACertificateRenewalorReissuance ................................................. 176
CryptographicTokenDecisions ......................................................... 177
PublishingDecisions .................................................................. 177
PublishingtoCertificatesandCRLstoFiles ............................................ 178
PublishingtoCertificatesandCRLstoaDirectory ...................................... 178
PublishingCRLstotheOnlineCertificateStatusManager ............................... 179
SubsystemCertificateDecisions......................................................... 180
SSLServerCertificates .............................................................. 180
CertificateManagerCertificates ...................................................... 180
RegistrationManagerCertificates..................................................... 181
DataRecoveryManagerCertificateandStorageKey .................................... 182
OnlineCertificateStatusManagerCertificates .......................................... 182
AuthenticationDecisions............................................................... 183
PolicyDecisions....................................................................... 183
DeploymentStrategyandPortAssignments .............................................. 184
Chapter 5 InstallationWorksheet.............................................. 187
InformationforUNIXInstallationScript ................................................. 188
InstallationLocation ................................................................ 188
ConfigurationDirectoryServer....................................................... 188
User/GroupDirectoryServer ........................................................ 189
ConfigurationDirectorySettings ..................................................... 189
AdministrationServerInformation ................................................... 190
CertificateManagementSystemIdentifier ............................................. 191
InformationforNTInstallationScript.................................................... 191
InstallationDirectory ............................................................... 191
ConfigurationDirectoryServer....................................................... 191
User/GroupDirectoryServer ........................................................ 192
ConfigurationDirectorySettings ..................................................... 193
ConfigurationDirectoryServerAdministrator ......................................... 193
DirectoryServerAdministrationDomain .............................................. 193
DirectoryManagerSettings .......................................................... 193
AdministrationServerPort .......................................................... 194
CertificateManagementSystemIdentifier ............................................. 194
InitialConfiguration................................................................... 194
InternalDatabase................................................................... 195
Administrator...................................................................... 195
Subsystems ........................................................................ 195
RemoteCertificateManager ......................................................... 196

7
RemoteDataRecoveryManager ......................................................196
NetworkConfiguration..............................................................197
CertificateManagerConfiguration.......................................................197
CASigningCertificate...............................................................197
CA’sSerialNumberRange ........................................................197
Key-PairInformationforCASigningCertificate......................................198
SubjectNameforCASigningCertificate ............................................198
Validity Period for CA Signing Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
ExtensionsforCASigningCertificate ...............................................199
CASigningCertificateRequest .......................................................200
RegistrationManagerConfiguration .....................................................201
RegistrationManagerSigningCertificateRequest .......................................201
Key-PairInformationforRegistrationManagerSigningCertificate .....................201
SubjectNameforRegistrationManagerSigningCertificate ............................202
RegistrationManagerSigningCertificateIssuer.........................................202
DataRecoveryManagerConfiguration ...................................................203
TransportCertificate ................................................................203
Key-PairInformationforTransportCertificate .......................................203
SubjectNameforTransportCertificate..............................................204
Validity Period for Transport Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
ExtensionsforTransportCertificate ................................................205
TransportCertificateRequest.........................................................206
StorageKeyandRecoveryAgentConfiguration ........................................206
StorageKeyCreation .............................................................206
DataRecoveryScheme—1.........................................................206
DataRecoveryScheme—2.........................................................207
OnlineCertificateStatusManagerConfiguration ..........................................207
OnlineCertificateStatusManagerSigningCertificateRequest ............................207
Key-Pair Information for Online Certificate Status Manager Signing Certificate . . . . . . . . . . . 208
SubjectNameforOnlineCertificateStatusManagerSigningCertificate .................208
OnlineCertificateStatusManagerSigningCertificateIssuer ..............................209
ClonedCertificateManagerConfiguration................................................209
CASigningCertificate...............................................................210
CA’sSerialNumberRange ........................................................210
ClonedKeyandCertificateMaterial ................................................210
SSLServerKeyandCertificate .....................................................211
SSLServerCertificateConfiguration .....................................................211
SSLServerCertificate ...............................................................211
Key-PairInformationforSSLServerCertificate ......................................211
SubjectNameforSSLServerCertificate .............................................212
Validity Period for SSL Server Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
ExtensionsforSSLServerCertificate................................................213
SSLCertificateRequest ..............................................................214

8 Netscape Certificate Management System Installation and Setup Guide • October 2001
SingleSign-OnPassword............................................................... 214
Chapter 6 InstallingCertificateManagementSystem ............................. 215
InstallationOverview.................................................................. 215
InstallationStages .................................................................. 216
BeforeYouBegintheInstallation ..................................................... 217
Stage1.RunningtheInstallationScript................................................... 219
RunningtheInstallationScriptonUNIX............................................... 219
RunningtheInstallationScriptonWindowsNT ........................................ 222
Stage2.RunningtheInstallationWizard ................................................. 225
Installing the Certificate Manager as a Root CA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Installing the Certificate Manager as a Subordinate CA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Installing a Standalone Registration Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
Installing a Standalone Data Recovery Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Installing a Online Certificate Status Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
Stage3.EnrollingforAdministrator/AgentCertificate ..................................... 275
AgentCertificateforaCertificateManager............................................. 275
AgentCertificateforOtherCMSManagers ............................................ 278
Stage4.FurtherConfigurationOptions .................................................. 281
Stage5.CreatingAdditionalInstancesorCAClones....................................... 282
Chapter 7 Installing and Uninstalling CMS Instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283
Installing Multiple CMS Instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
CloningaCertificateManager .......................................................... 286
Step1.BeforeYouBegin............................................................. 287
Step2.CreateInstancesforCloneCAs ................................................ 289
Installing Clone CA in Master CA’s Server Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Installing Clone CA in a Different Server Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
Installing Clone CA on a Separate Host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
Step3.ShutdowntheMasterCA ..................................................... 291
Step4.CopyMasterCA’sCertificateandKeyDatabase ................................. 292
Step5.StarttheMasterCA .......................................................... 292
Step6.ConfiguretheCloneCA ...................................................... 292
Step8.EstablishTrustBetweenMasterCAandCloneCAs............................... 293
StepA.LocatetheMasterCA’sSSLServerCertificate................................. 294
StepB.CreateaPrivileged-UserEntryforCloneCAs ................................. 296
Step9.TestClone-MasterConnection ................................................. 299
StepA.RequestaCertificatefromtheCloneCA ..................................... 299
StepB.ApprovetheRequest ...................................................... 300
StepC.DownloadtheCertificatetotheBrowser ..................................... 300
StepD.RevoketheCertificate ..................................................... 301
StepE.CheckMasterCA’sCRLfortheRevokedCertificate ........................... 301

9
Step10.UseMasterCA’sAgentCertificateinCloneCAs.................................302
ViewingInstanceInformation...........................................................303
ChangingtheNameofanInstance.......................................................305
RemovinganInstanceFromaSystem ....................................................306
UninstallingCertificateManagementSystem..............................................308
UninstallingFromtheCommandLine.................................................308
UninstallingbyUsingtheWindowsNTAdd/RemoveProgramsUtility ...................308
Chapter 8 Starting and Stopping CMS Instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311
StartingCertificateManagementSystem..................................................312
RequiredStart-upInformation........................................................312
ConfiguringtheServertoStartWithouttheSingleSign-OnPassword...................313
ConfiguringtheServertoReadtheSingleSign-onPasswordFromaFile ................314
StartingFromNetscapeConsole ......................................................317
StartingFromtheCommandLine.....................................................318
StartingFromtheWindowsNTServicesPanel..........................................319
StoppingCertificateManagementSystem.................................................320
StoppingFromNetscapeConsole .....................................................320
StoppingFromtheCommandLine....................................................321
StoppingFromtheWindowsNTServicesPanel ........................................322
RestartingCertificateManagementSystem................................................322
RestartingFromtheCMSWindow ....................................................322
RestartingFromtheCommandLine...................................................323
CheckingSystemStatus ................................................................324
AttendingtoanUnresponsiveServer ....................................................325
CMSWatchdogProcess ................................................................325
PasswordCache.......................................................................326
Password-QualityChecker .............................................................327
Part 3 Configuration ....................................................... 329
Chapter 9 Administration Tasks and Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331
NetscapeConsole .....................................................................332
ConsoleTab........................................................................332
UsersandGroupsTab...............................................................333
NetscapeAdministrationServer ......................................................334
StartingAdministrationServer.....................................................335
ShuttingDownAdministrationServer ..............................................336
LoggingIntoNetscapeConsole .........................................................336
TheCMSWindow .....................................................................338
TasksTab..........................................................................339

10 Netscape Certificate Management System Installation and Setup Guide • October 2001
ConfigurationTab .................................................................. 339
StatusTab ......................................................................... 342
LoggingIntotheCMSWindow......................................................... 343
Chapter 10 CMS Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345
EffectsofInstallationTypeonConfiguration.............................................. 345
DuplicatingConfigurationFromOneInstancetoAnother ............................... 347
LocatingtheConfigurationFile ......................................................... 348
ModifyingtheConfiguration ........................................................... 349
ChangingtheConfigurationFromtheCMSWindow.................................... 349
ChangingtheConfigurationbyEditingtheConfigurationFile............................ 349
Guidelines for Editing the Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350
SampleConfigurationFile ........................................................... 353
RoadMaptoConfiguringSubsystems ................................................... 366
Step1.CheckWhichSubsystemsareInstalledintheInstance.......................... 366
Step2.CheckthePortNumbers ................................................... 366
Step3.VerifyKeyPairandCertificates ............................................. 366
Step4.SetupPrivilegedUsers..................................................... 367
Step5.CustomizeEnd-EntityandAgentForms...................................... 367
Step6.SetupAuthenticationforEndUsers.......................................... 367
Step7:EnableEvent-DrivenNotifications ........................................... 368
Step8.ScheduleJobs ............................................................. 368
Step9.SetupPolicies............................................................. 368
Step10.SetupPublishing......................................................... 369
Step11.SetupKeyArchivalandRecovery .......................................... 369
Step12.SetupLogging ........................................................... 369
Step13.PlanforBackingupCMSConfigurationandData ............................ 370
Chapter 11 SettingUpPorts .................................................. 371
CMSPorts............................................................................ 371
RemoteAdministrationPort ......................................................... 372
AgentPort......................................................................... 373
End-EntityPorts.................................................................... 373
ConfiguringPortNumbers ............................................................. 374
Step1.SpecifythePortNumber ...................................................... 374
Step2:SpecifyIPAddresses ......................................................... 377
Chapter 12 SettingUpInternalDatabase........................................ 379
InternalDatabase ..................................................................... 379
ConfiguringtheInternalDatabase....................................................... 380
Step1.IdentifytheDirectoryServerInstance........................................... 381
Step2.RestrictAccesstotheInternalDatabase ......................................... 382

11
Chapter 13 ManagingPrivilegedUsersandGroups .............................. 385
Privileged-User Types and Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386
Administrators .....................................................................386
Agents ............................................................................387
Agent’sCertificateforSSLClientAuthentication .....................................389
RevocationStatusCheckingofAgentCertificates.....................................392
TrustedManagers ..................................................................394
SubsystemsThatCanFunctionasTrustedManagers..................................395
ConnectorsforLinkingTrustedManagers ...........................................396
TrustedManager’sCertificateforSSLClientAuthentication ...........................397
GroupsandTheirPrivileges ............................................................398
GroupforAdministrators............................................................399
GroupsforAgents ..................................................................400
GroupforCertificateManagerAgents ..............................................400
GroupforRegistrationManagerAgents.............................................400
GroupforDataRecoveryManagerAgents ..........................................401
GroupforOnlineCertificateStatusManagerAgents ..................................401
GroupforTrustedManagers .........................................................402
SettingUpPrivilegedUsers.............................................................403
SettingUpAdministrators ...........................................................403
Step1.FindtheRequiredInformation ..............................................403
Step2.AddtheInformationtotheInternalDatabase..................................403
SettingUpAgents ..................................................................406
SettingupAgentsUsingtheAutomatedProcess .....................................406
SettingupAgentsUsingtheManualProcess.........................................407
SettingUpTrustedManagers.........................................................413
SettingupTrustedManagersUsingtheAutomatedProcess ...........................413
SettingUpaRegistrationManagerasaTrustedManager..............................414
SettingUpaCertificateManagerasaTrustedManager ...............................422
ChangingPrivileged-UserInformation ...................................................429
ChangingaPrivilegedUser’sLoginInformation ........................................429
ChangingaPrivilegedUser’sCertificate ...............................................430
ChangingMembersinaGroup .......................................................431
DeletingaPrivilegedUser ..............................................................432
Chapter 14 ManagingCMSKeysandCertificates ................................ 435
KeysandCertificatesfortheMainSubsystems ............................................436
CertificateManager’sKeyPairsandCertificates ........................................437
CASigningKeyPairandCertificate ................................................437
wTLSCASigningCertificate ......................................................438
OCSPSigningKeyPairandCertificate ..............................................438
CRLSigningKeyPairandCertificate ...............................................439
SSLServerKeyPairandCertificate .................................................441

12 Netscape Certificate Management System Installation and Setup Guide • October 2001
RemoteAdministrationServerCertificate ........................................... 443
RegistrationManager’sKeyPairsandCertificates ...................................... 445
SigningKeyPairandCertificate ................................................... 445
SSLServerKeyPairandCertificate................................................. 445
RemoteAdministrationServerCertificate ........................................... 446
DataRecoveryManager’sKeyPairsandCertificates .................................... 446
TransportKeyPairandCertificate ................................................. 447
StorageKeyPair ................................................................. 447
SSLServerKeyPairandCertificate................................................. 448
RemoteAdministrationServerCertificate ........................................... 448
OnlineCertificateStatusManager’sKeyPairsandCertificates............................ 449
OCSPSigningKeyPairandCertificate.............................................. 449
SSLServerKeyPairandCertificate................................................. 449
RemoteAdministrationServerCertificate ........................................... 450
TokensforStoringCMSKeysandCertificates ............................................ 450
InternalToken ..................................................................... 451
ExternalToken ..................................................................... 451
Installing External Tokens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451
ManagingTokensUsedbytheSubsystems ............................................ 454
ViewingTokens ................................................................. 454
ChangingaToken’sPassword ..................................................... 455
HardwareCryptographicAccelerators ................................................... 455
CertificateSetupWizard ............................................................... 456
UsingtheWizardtoRequestaCertificate.............................................. 457
Step1.SelecttheOperation ....................................................... 457
Step2.ChoosetheCertificate...................................................... 458
Step3.SpecifytheKey-PairInformation ............................................ 460
Step4.SpecifytheSubjectNamefortheCertificate ................................... 462
Step5.SpecifytheValidityPeriod.................................................. 463
Step6.SpecifyExtensions......................................................... 464
Step7.CopytheCertificateSigningRequest......................................... 466
Step8.ChecktheCertificateRequestStatus ......................................... 470
UsingtheWizardtoInstallaCertificateorCertificateChain ............................. 471
DataFormatsforInstallingCertificatesandCertificateChains ......................... 472
Step1.SelecttheOperation ....................................................... 473
Step2.SelecttheCertificateorCertificateChain ..................................... 474
Step3.SpecifytheLocationoftheCertificate ........................................ 475
Step4.ViewtheCertificateorCertificateChain ...................................... 477
Step5.InstalltheCertificateorCertificateChain ..................................... 477
Step6.VerifytheCertificateStatus ................................................. 478
ConfiguringtheServer’sSecurityPreferences ............................................. 478
ConfiguringtheServertoUseSeparateSSLServerCertificates ........................... 478
Step1.GettheRequiredSSLServerCertificates...................................... 479

13
Step2:UpdatetheConfiguration...................................................479
GettinganSSLClientCertificateforaSubsystem .......................................480
Setting Up Cipher Preferences for SSL Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 482
SSLCiphersSupportedinCertificateManagementSystem ............................482
ConfiguringtheServertoUseSpecificCiphers.......................................484
GettingNewCertificatesfortheSubsystems ..............................................485
Step1.PlanfortheNewCertificate....................................................486
Step2.RequesttheNewCertificate ...................................................489
Step3.InstalltheNewCertificate .....................................................489
Step4.DeploytheNewCertificate ....................................................490
DeployingCertificateManager’sCASigningCertificate...............................490
DeployingRegistrationManager’sSigningCertificate.................................491
DeployingDataRecoveryManager’sTransportCertificate ............................492
DeployingaSubsystem’sSSLServerCertificate ......................................493
RenewingCertificatesfortheSubsystems.................................................494
Step1.PlanforCertificateRenewal ...................................................495
Step2.RenewtheExistingCertificate..................................................496
Step3.InstalltheRenewedCertificate .................................................497
Step4.DeploytheRenewedCertificate ................................................497
DeployingCertificateManager’sRenewedCASigningCertificate ......................498
DeployingRegistrationManager’sRenewedSigningCertificate ........................498
DeployingDataRecoveryManager’sRenewedTransportCertificate....................499
DeployingaSubsystem’sRenewedSSLServerCertificate .............................501
Step5.RestarttheServer.............................................................501
ManagingtheCertificateDatabase.......................................................502
ViewingtheCertificateDatabaseContent ..............................................502
DeletingaCertificateFromtheCertificateDatabase .....................................504
ChangingtheTrustSettingsofaCACertificate .........................................505
Installing a New CA Certificate in the Certificate Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 507
Installing a CA Certificate Chain in the Certificate Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508
Chapter 15 SettingUpEnd-UserAuthentication ................................. 509
IntroductiontoAuthentication ..........................................................509
Privileged-UserAuthentication .......................................................510
AuthenticationofAdministrators ..................................................510
AuthenticationofAgents..........................................................512
End-EntityAuthentication ...........................................................515
AuthenticationofEndEntitiesDuringCertificateEnrollment ..........................515
AuthenticationofEndUsersDuringCertificateRenewal ..............................515
AuthenticationofEndUsersDuringCertificateRevocation ............................517
ConfiguringAuthenticationforEnd-UserEnrollment ......................................521
Step1.BeforeYouBegin .............................................................522
Step2.SetUptheDirectoryforPIN-BasedEnrollment...................................523

14 Netscape Certificate Management System Installation and Setup Guide • October 2001
StepA.ChecktheDirectoryforUserEntries......................................... 523
StepB.UpdatetheDirectory ...................................................... 524
StepC.PreparetheInputFile...................................................... 525
StepD.RuntheCommandWithouttheWriteOption................................. 525
StepE.ChecktheOutputFile...................................................... 526
StepF.RuntheCommandAgainwiththeWriteOption .............................. 526
Step3.EnabletheAttributePresentConstraintsPolicy ................................... 526
Step4:AddanAuthenticationInstance................................................ 529
Step5.SetUptheEnrollmentInterface ................................................ 534
StepA.AssociatetheAuthenticationInstanceWiththeEnrollmentForm................ 534
StepB.CustomizetheForm ....................................................... 535
StepC.HookUptheCertificate-BasedEnrollmentForm .............................. 535
StepD.RemoveUnwantedEnrollmentOptions...................................... 538
Step6.EnableEnd-EntityInteraction.................................................. 539
EnablingEnd-EntityInteractionwithaCertificateManager ........................... 539
EnablingEnd-EntityInteractionwithaRegistrationManager.......................... 541
Step7.TurnonAutomatedNotification ............................................... 542
Step8.TestYourAuthenticationSetup ................................................ 542
Step9.DeliverPINstoEndUsers..................................................... 544
ManagingAuthenticationInstances ..................................................... 544
DeletinganAuthenticationInstance .................................................. 544
ModifyinganAuthenticationInstance................................................. 545
ManagingAuthenticationPlug-inModules............................................... 547
RegisteringanAuthenticationModule ................................................ 547
DeletinganAuthenticationModule................................................... 549
Chapter 16 Setting Up Automated Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551
AutomatedNotifications ............................................................... 551
NotificationsofCertificateIssuancetoEndEntities ..................................... 552
NotificationofNewRequestinQueue ................................................ 553
CustomizingNotificationMessages ..................................................... 554
TemplatesforEvent-TriggeredNotifications ........................................... 554
CustomizingMessageTemplates ..................................................... 556
TokensAvailableinMessageTemplates ............................................... 557
TokensforCertificateIssuanceNotificationstoEndEntities ........................... 557
TokensforRejectionNotificationstoEndEntities .................................... 558
TokensforRequestInQueueNotificationMessages .................................. 559
ConfiguringaSubsytemtoSendNotifications ............................................ 559
Step1.BeforeYouBegin............................................................. 560
Step2.TurnOnCertificate-IssuanceNotification ....................................... 560
Step3.TurnonRequestinQueueNotification ......................................... 561
Step4.VerifyMailServerSettings .................................................... 563
Step5.TestYourConfiguration ...................................................... 564

15
Chapter 17 Scheduling Automated Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565
ConfiguringaSubsystemtoRunAutomatedJobs..........................................565
Step1.BeforeYouBegin .............................................................566
Step2.ModifyExistingJobs ..........................................................566
Step3.DeleteUnwantedJobs.........................................................569
Step4.AddNewJobs ...............................................................569
Step5.ScheduletheFrequency .......................................................573
Step6.VerifyMailServerSettings ....................................................574
Step7.TestYourConfiguration.......................................................575
ManagingJobPlug-inModules..........................................................575
RegisteringaJobModule ............................................................576
DeletingaJobModule...............................................................577
Chapter 18 SettingUpPolicies................................................ 579
IntroductiontoPolicy ..................................................................579
WhatIsPolicy? .....................................................................580
PolicyRules........................................................................581
TypesofPolicyRules .............................................................581
UsingPredicatesinPolicyRules ......................................................582
ExpressionSupportforPredicates ..................................................582
AttributesforPredicates ..........................................................584
PolicyProcessor ....................................................................588
ConfiguringPolicyRulesforaSubsystem ................................................589
Step1.BeforeYouBegin .............................................................590
Step2.ModifyExistingPolicyRules...................................................590
Step3.DeleteUnwantedPolicyRules .................................................594
Step4.AddNewPolicyRules ........................................................594
Step5.ReorderPolicyRules..........................................................599
Step6.RestarttheServer.............................................................600
Step7.TestPolicyConfiguration......................................................600
StepA.EnrollforaCertificate .....................................................600
StepB.ApprovetheRequest.......................................................601
StepC.ChecktheCertificateDetails ................................................601
UsingJavaScriptforPolicies ............................................................602
ManagingPolicyPlug-inModules .......................................................602
RegisteringaPolicyModule..........................................................602
DeletingaPolicyModule ............................................................604
Chapter 19 Setting Up LDAP Publishing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605
PublishingofCertificatestoaDirectory ..................................................605
TimingofDirectoryUpdates .........................................................607
DirectoryUpdateProcess ............................................................609
DirectorySynchronization ...........................................................610

16 Netscape Certificate Management System Installation and Setup Guide • October 2001
PublishingofCRLs .................................................................... 610
What’saCRL? ..................................................................... 611
ReasonsforRevokingaCertificate .................................................... 612
RevocationCheckingbyNetscapeClients ............................................. 613
RevocationCheckingbyNetscapeServers ............................................. 613
PublishingofCRLstoanLDAPDirectory ............................................. 614
CRLIssuingPoints ................................................................. 615
ConfiguringaCertificateManagertoPublishCertificatesandCRLs ......................... 615
Step1.BeforeYouBegin............................................................. 616
Step2.SetUptheDirectoryforPublishing............................................. 618
StepA.VerifytheDirectorySchema................................................ 618
StepB.AddanEntryfortheCA ................................................... 619
StepC.IdentifyanEntryThatHasWriteAccess ..................................... 621
StepD.VerifyEntriesforEndEntities .............................................. 621
StepE.SpecifytheDirectoryAuthenticationMethod ................................. 622
StepF.ModifytheCertificateMappingFile ......................................... 632
StepG.RestartDirectoryServer ................................................... 636
Step3.ConfiguretheCertificateManagertoPublishCertificates.......................... 636
StepA.ModifytheDefaultMappers,Publishers,andPublishingRules ................. 636
StepB.AddMappers,Publishers,andPublishingRules............................... 642
Step4.ConfiguretheCertificateManagertoPublishCRLs ............................... 648
StepA.SpecifyCRLDetails ....................................................... 649
StepB.SettheCRLExtensions..................................................... 651
StepC.CreateaMapperfortheCRL ............................................... 652
StepD.CreateaPublisherfortheCRL.............................................. 653
StepE.CreateaPublishingRulefortheCRL ........................................ 655
Step5.IdentifythePublishingDirectory............................................... 656
Step6.TestCertificateandCRLPublishing ............................................ 658
StepA.DecideaDirectoryEntryforRequestingaCertificate .......................... 659
StepB.RequestaCertificate ....................................................... 659
StepC.ApprovetheRequest ...................................................... 659
StepD.DownloadtheCertificatetotheBrowser ..................................... 660
StepE.CheckiftheDirectoryHastheCertificate..................................... 660
StepF.RevoketheCertificate...................................................... 661
StepG.ChecktheDirectoryfortheCRL ............................................ 662
ManuallyUpdatingCertificatesandCRLsinaDirectory ................................... 662
ManuallyUpdatingCertificatesintheDirectory ........................................ 663
ManuallyUpdatingtheCRLintheDirectory........................................... 664
Chapter 20 Publishing Certificates and CRLs to a File . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667
ConfiguringCertificateManagertoPublishtoFiles........................................ 667
Step1.BeforeYouBegin............................................................. 668
Step2.ConfiguretheCertificateManager.............................................. 669

17
StepA.CreateaPublisherfortheFile...............................................669
StepB.CreatePublishingRulesforCertificates.......................................671
StepC.CreateaPublishingRuleforCRLs ...........................................673
StepD.SpecifyCRLDetails........................................................674
StepE.SettheCRLExtensions .....................................................676
StepF.MakeSurePublishingisEnabled ............................................678
Step3.TestPublishing...............................................................678
StepA.RequestaCertificate .......................................................678
StepB.ApprovetheRequest.......................................................679
StepC.DownloadtheCertificatetotheBrowser......................................680
StepD.ChecktheFilefortheCertificate.............................................680
StepE.RevoketheCertificate ......................................................682
StepF.ChecktheFilefortheCRL ..................................................683
ManagingMapperandPublisherPlug-inModules.........................................685
RegisteringaMapperorPublisherModule.............................................685
DeletingaMapperorPublisherModule ...............................................687
Chapter 21 Setting Up an OCSP Responder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689
What’sanOCSP-CompliantPKISetup? ..................................................690
HowtoGetanOCSPResponder? .....................................................692
HowCertificateManager’sOCSP-ServiceFeatureWorks ..............................692
HowOnlineCertificateStatusManagerWorks.......................................693
HowtoGetOCSP-CompliantClients? .................................................694
SettingUpaCertificateManagerwithOCSPService .......................................695
Step1.BeforeYouBegin .............................................................695
Step2.InstallOCSP-CompliantClient .................................................696
Step3.EnableCertificateManager’sHTTPPort.........................................697
Step4.EnableCertificateManager’sOCSPService ......................................699
Step5.ConfigureCertificateManagerforExtensions ....................................700
Step6.RestarttheCertificateManager.................................................702
Step7.TestYourCA’sOCSPServiceSetup.............................................703
StepA.TurnOnRevocationCheckingintheBrowser.................................703
StepB.RequestaCertificate .......................................................704
StepC.ApprovetheRequest ......................................................704
StepD.DownloadtheCertificatetotheBrowser .....................................705
StepE.MakeSuretheCAisTrustedbytheBrowser ..................................705
StepF.VerifytheCertificateintheBrowser..........................................706
StepG.ChecktheStatusofCertificateManager’sOCSPService ........................706
StepH.RevoketheCertificate .....................................................707
StepI.VerifytheCertificateintheBrowser ..........................................707
StepJ.ChecktheCertificateManager’sOCSPServiceStatusAgain .....................707
SettingUpaRemoteOCSPResponder ...................................................708
Step1.BeforeYouBegin .............................................................709

18 Netscape Certificate Management System Installation and Setup Guide • October 2001
Step2.InstallanOCSP-CompliantClient .............................................. 710
Step3.IdentifytheCAtotheOCSPResponder ......................................... 711
Step4.ConfiguretheCertificateManagertoPublishCRLs ............................... 713
StepA.SpecifyCRLFormatandPublishingInterval.................................. 713
StepB.SettheCRLExtensions..................................................... 715
StepC.CreateaPublisherfortheCRL .............................................. 716
StepD.CreateaPublishingRulefortheCRL ........................................ 718
StepE.MakeSurePublishingisEnabled ............................................ 720
Step5.ConfigureCertificateManagerforRequiredExtensionPolicies..................... 721
Step6.ConfiguretheOnlineCertificateStatusManager ................................. 723
Step7.RestarttheCertificateManager ................................................ 727
Step8.RestarttheOnlineCertificateStatusManager .................................... 728
Step 9. Verify Certificate Manager and Online Certificate Status Manager Connection . . . . . . . 728
Step10.TestYourOCSPResponderSetup ............................................. 729
StepA.TurnOnRevocationChecking .............................................. 729
StepB.RequestaCertificate ....................................................... 730
StepC.ApprovetheRequest ...................................................... 730
StepD.DownloadtheCertificatetotheBrowser ..................................... 731
StepE.MakeSuretheCAisTrustedbytheBrowser.................................. 731
StepF.VerifytheCertificateintheBrowser ......................................... 732
StepG.ChecktheStatusofOnlineCertificateStatusManager ......................... 732
StepH.RevoketheCertificate ..................................................... 733
StepI.VerifytheCertificateintheBrowser.......................................... 733
StepJ.ChecktheOnlineCertificateStatusManagerStatusAgain....................... 733
Chapter 22 SettingUpKeyArchivalandRecovery ............................... 735
PKISetupforKeyArchivalandRecovery ................................................ 735
ClientsThatCanGenerateDualKeyPairs ............................................. 736
DataRecoveryManager ............................................................. 736
FormsforUsersandKeyRecoveryAgents............................................. 737
KeyArchivalProcess .................................................................. 737
WhyYouShouldArchiveKeys....................................................... 737
WheretheKeysareStored........................................................... 738
HowKeyArchivalWorks ........................................................... 739
KeyRecoveryProcess.................................................................. 741
KeyRecoveryAgentsandTheirPasswords ............................................ 741
SecretSharingofStorageKeyPassword ............................................ 741
InterfacefortheKeyRecoveryProcess.............................................. 742
LocalVersusRemoteKeyRecoveryAuthorization ................................... 743
HowAgent-InitiatedKeyRecoveryWorks............................................. 744
KeyRecoveryAgentScheme......................................................... 747
ChangingtheKeyRecoveryAgentScheme.......................................... 747
ChangingKeyRecoveryAgents’Passwords......................................... 749

19
ConfiguringKeyArchivalandRecoveryProcess ..........................................751
Step1.SetUptheKeyArchivalProcess................................................751
StepA.DeployClientsThatCanGenerateDualKeyPairs .............................752
Step B. Connect the Enrollment Authority and the Data Recovery Manager . . . . . . . . . . . . . . 752
StepC.CustomizetheCertificateEnrollmentForm ...................................753
StepD.ConfigureKeyArchivalPolicies.............................................757
Step2.SetUptheKeyRecoveryProcess ...............................................758
StepA.VerifythemofnScheme...................................................758
StepB.FacilitatetheKeyRecoveryAgentstoChangethePasswords....................759
StepC.DeterminetheAuthorizationModeforKeyRecovery ..........................759
StepD.CustomizetheKeyRecoveryForm ..........................................759
StepE.ConfigureKeyRecoveryPolicies ............................................759
Step3.TestYourKeyArchivalandRecoverySetup .....................................760
StepA.TestYourKeyArchivalSetup...............................................760
StepB.VerifytheKey.............................................................762
StepC.DeletetheCertificate.......................................................762
StepD.TestYourKeyRecoverySetup ..............................................762
StepD.RestoretheKeyintheBrowser’sDatabase....................................763
Chapter 23 ManagingCMSLogs .............................................. 765
IntroductiontoLogs ...................................................................765
LogsMaintainedbytheServer .......................................................766
ServicesThatAreLogged ............................................................767
LogLevels(MessageCategories)......................................................768
LogFileLocations ..................................................................769
LogFileNamingConventions ........................................................770
ActiveLogFileNamingConvention ................................................770
RotatedLogFileNamingConvention...............................................770
BufferedVersusUnbufferedLogging..................................................770
RotationofLogFiles ................................................................771
TimingofLogFileRotation........................................................771
LocationofRotatedLogFiles ......................................................772
DeletionofLogFiles ................................................................772
HowtoConserveDiskSpace ......................................................772
TimingofLogFileDeletion........................................................772
ConfiguringCMSLogs.................................................................773
Step1.BeforeYouBegin .............................................................773
Step2.ModifytheExistingListeners ..................................................773
Step3.DeleteUnwantedListeners ....................................................775
Step4.CreateNewListeners .........................................................776
MonitoringCMSLogs..................................................................779
MonitoringSystemLogs .............................................................780
MonitoringErrorLogs...............................................................782

20 Netscape Certificate Management System Installation and Setup Guide • October 2001
MonitoringAuditLogs.............................................................. 784
UsingSystemToolsforMonitoringtheServer(WindowsNTOnly) ....................... 786
LoggingtoWindowsNTEventLog ................................................ 787
UsingEventViewer .............................................................. 787
Avoiding Event Log From Getting Filled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 788
ArchivingofRotatedLogFiles.......................................................... 789
SigningLogFiles ................................................................... 790
ManagingLogModules................................................................ 792
RegisteringaLogModule ........................................................... 792
DeletingaLogModule .............................................................. 793
Part 4 IssuingandManagingCertificates ......................................795
Chapter 24 IssuingandManagingServerCertificates............................. 797
CertificateIssuancetoServers .......................................................... 797
HowtheManualServerEnrollmentProcessWorks ..................................... 798
GettingServerSSLCertificatesforNetscapeServers ....................................... 800
GettingCertificatesforVersion3.xServers............................................. 800
Step1.GeneratetheServerCertificateRequest....................................... 801
Step2.SubmittheServerCertificateRequest ........................................ 802
Step3.InstallYourServer’sSSLCertificate .......................................... 803
Step4.AcceptaCAasTrustedinYourServer ....................................... 803
Step5.VerifyYourServer’sSSLandCACertificates.................................. 805
GettingCertificatesforNetscapeVersion4.xServers .................................... 805
RenewalofServerCertificates .......................................................... 807
RevocationofServerCertificates ........................................................ 807
Chapter 25 SettingUpCEPEnrollment ......................................... 809
CEPEnrollment....................................................................... 809
CEPEnrollmentUsingtheScript ........................................................ 810
SettingupCEPEnrollmentManually .................................................... 811
Step1.SetuptheDirectoryforPublishingCertificatesandCRLs ......................... 812
Step2.ConfiguretheCertificateManagerforPublishingCertificatesandCRLs............. 813
Step3.SetUpAutomatedEnrollment ................................................. 816
Step4.SetUpMultipleCEPServices.................................................. 820
CertificateIssuancetoRoutersorVPNClients ............................................ 821
Step1.BeforeYouBegin............................................................. 822
Step2.GeneratetheKeyPairfortheRouter............................................ 823
Step3.RequesttheCA’sCertificate ................................................... 824
Step4.SubmittheCertificateRequesttotheCA ........................................ 824
Example........................................................................... 825