Netscape NETSCAPE MANAGEMENT SYSTEM 6.0 - AGENT GUIDE User manual

Agent’s Guide
Netscape Certificate Management System
Version6.0
March 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs
offered by Netscape (referred to herein as "Software") and related documentation. Use of the Software and related
documentation is governed by the license agreement for the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation
works is prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to
time without notice.
THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL
NETSCAPE BE LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND
ARISING FROM ANY ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR
INTERRUPTION OF BUSINESS, PROFITS, USE, OR DATA.
The Software and documentation are copyright © 2001 Sun Microsystems, Inc. Portions copyright 1999, 2002 Netscape
Communications Corporation. All rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States
and other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape
Communications Corporation, which may be registered in some countries. Other product and brand names are the exclusive
property of their respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in
full compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or
documentation to the U.S. government is with restricted rights as described in the license agreement for that Software.

3
Contents
AboutThisGuide............................................................... 5
WhatYouShouldAlreadyKnow ..........................................................5
What’sinThisGuide.....................................................................6
ConventionsUsedinThisGuide ..........................................................7
WheretoGoforRelatedInformation.......................................................8
Chapter 1 AgentServices ..................................................... 11
OverviewofCertificateManagementSystem...............................................11
AgentTasks ...........................................................................15
CertificateManagerAgentServices ....................................................15
RegistrationManagerAgentServices...................................................17
DataRecoveryManagerAgentServices.................................................18
OnlineCertificateStatusManagerAgentServices ........................................19
FormsforPerformingAgentOperations...................................................20
AccessingAgentServices................................................................23
Administrator/AgentCertificateEnrollment ............................................23
AgentServicesEntryPage ............................................................26
Services Summary Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Chapter 2 Handling Certificate Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
ManagingRequests.....................................................................27
ListingCertificateRequests ..............................................................30
SelectingaRequest...................................................................32
ApprovingRequests ....................................................................33
AssigningaRequest..................................................................34
Adjusting,Verifying,andApprovingaRequest..........................................34
SendinganIssuedCertificatetotheRequester ...........................................38

4 Netscape Certificate Management System Agent’s Guide • March 2002
Other Options for Handling Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Chapter 3 Finding and Revoking Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
BasicCertificateListing ................................................................. 43
AdvancedCertificateSearch............................................................. 45
ExaminingCertificates ............................................................... 50
RevokingCertificates ................................................................... 51
SearchingforCertificatestoRevoke.................................................... 51
RevokingOneorMoreCertificates..................................................... 52
RevokingOneCertificate .......................................................... 52
RevokingMultipleCertificates...................................................... 53
ConfirmingaRevocation .......................................................... 53
ManagingtheCertificateRevocationList.................................................. 55
ViewingorExaminingCRLs .......................................................... 55
UpdatingtheCRL ................................................................... 56
Chapter 4 PublishingtoaDirectory............................................. 59
WorkingwithaDirectoryServer ......................................................... 59
AutomaticDirectoryUpdates ......................................................... 59
ManualDirectoryUpdates............................................................ 60
UpdatingtheDirectorywithChanges..................................................... 60
Chapter 5 RecoveringEncryptedData........................................... 63
FindingandRecoveringKeys............................................................ 63
FindingArchivedKeys............................................................... 64
SelectingaKey...................................................................... 66
RecoveringKeys ....................................................................... 67
RemoteRecoveryAuthorization....................................................... 69
ViewingKeyServiceRequests ........................................................... 70
ListingKeyServiceRequests.......................................................... 71
SelectingaRequest .................................................................. 73
Chapter 6 Managing OCSP Service Related Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
ListingCAsIdentifiedbyOnlineCertificateStatusManager ................................. 75
IdentifyingaCAtoOnlineCertificateStatusManager ...................................... 76
AddingaCRLtoOnlineCertificateStatusManager ........................................ 78
CheckingtheRevocationStatusofaCertificate............................................. 79
Index ........................................................................ 81

5
About This Guide
This guide describes the Agent Services interface that Netscape Certificate
Management System (CMS) agent uses to administer a subsystem’s certificates and
keys.
This preface has the following sections:
• What You Should Already Know (page 5)
• What’s in This Guide (page 6)
• Conventions Used in This Guide (page 7)
• Where to Go for Related Information (page 8)
What You Should Already Know
This guide is intended for Certificate Management System agents—that is,
privileged users designated by the Certificate Management System administrator
to manage requests from end entities for certificate-related services. Each installed
CMS manager (Certificate Manager, Registration Manager, Data Recovery
Manager, and Online Certificate Status Manager) can have one or more agents.
Server administrators should refer to the CMS Installation and Setup Guide for
information on how to designate agents and assign agent privileges to users and
groups.
Before reading this guide, you should be familiar with the basic concepts of
public-key cryptography and the Secure Sockets Layer (SSL) protocol. These
include the following topics:
• Encryption and decryption
• Public keys, private keys, and symmetric keys

What’s in This Guide
6 Netscape Certificate Management System Agent’s Guide • March 2002
• Digital signatures
• The role of digital certificates in a public-key infrastructure (PKI)
• Certificate hierarchies
• SSL cipher suites
• The purpose of and major steps in the SSL handshake
For overviews of these topics, see the security-related appendixes of Managing
Servers with Netscape Console;see“Where to Go for Related Information,” on page 8.
What’s in This Guide
This guide describes the duties of the agents for the various CMS subsystems and
explains how to accomplish each task.
• Chapter 1, “Agent Services” provides an overview of the product and
identifies the different kinds of users, including agents. The chapter also
summarizes the tasks of each subsystem agent and lists the HTML forms you
use to perform agent tasks. Finally, the chapter explains how to access the
Agent Services pages and forms.
• As a Certificate Manager or Registration Manager agent, you are responsible
for handling requests for certificates that are made by end entities (end users,
server administrators, or other CMS subsystems) using manual enrollment.
Chapter 2, “Handling Certificate Requests” describes the general procedure for
handling requests and explains how to handle different aspects of certificate
request management.
• Chapter 3, “Finding and Revoking Certificates” explains how, as a Certificate
Manager agent, you can use the Agent Services page to find and examine a
specific certificate issued by Certificate Management System, or retrieve a list
of certificates that match specified criteria. This chapter also explains how to
revoke certificates, and manage the certificate revocation list.
• Chapter 4, “Publishing to a Directory” describes how a Certificate Manager
agent can update the LDAP directory with the current status of certificates.
• Chapter 5, “Recovering Encrypted Data” describes how to process key
recovery requests, and how to recover stored encrypted data when the
encryption key has been lost. This service is only available when the Data
Recovery Manager is installed.

Conventions Used in This Guide
About This Guide 7
• Chapter 6, “Managing OCSP Service Related Tasks” describes how to handle
tasks related to the CMS OCSP responder, Online Certificate Status Manager.
This service is only available when the Online Certificate Status Manager
subsystem is installed.
Conventions Used in This Guide
This guide uses the following conventions:
•Monospaced font—This typeface is used for text that is an executable part of a
program or text that you type. It’s also used for filenames, directory names,
and URLs.
•Italic—Italic type is used for emphasis, book titles, and to introduce new or
glossary terms.
• Text within “quotation marks”—Indicates cross-references to other topics
within this guide.
•Squarebrackets
[]—Square brackets enclose commands that are optional.
•Anglebrackets
<>—Angle brackets indicate placeholders for items that vary,
such as pathnames and variable names. Replace the angle brackets and their
text with text that applies to your situation.
•Forwardslash
/—A slash is used to separate directories in a path. (Note that
the Windows NT operating system supports both the slash and the backslash.)
• Sidebar text—Sidebar text marks important information. Make sure you read
the information before continuing with a task.
In addition, the following conventions are used for important notes.
NOTE You can access the Agent Services only if you have a valid agent
certificate.
CAUTION A caution note documents a potential risk of losing data, damaging
software or hardware, or otherwise disrupting system performance.

WheretoGoforRelatedInformation
8 Netscape Certificate Management System Agent’s Guide • March 2002
Where to Go for Related Information
This section summarizes the documentation that ships with Certificate
Management System, using these conventions:
•<server_root> is the directory where the CMS binaries are kept (specified
during installation).
•<instance_id> is the ID for this instance of Certificate Management System
(specified during installation).
The documentation set for Certificate Management System includes the following:
• Managing Servers with Netscape Console
Provides background information on basic cryptography concepts and the role
of Netscape Console. To view the HTML version of this guide, open this file:
<server_root>/manual/en/admin/ag/contents.htm
• CMS Installation and Setup Guide
Provides detailed information on deployment options for Certificate
Management System, a walk-through of a test or demo installation, complete
installation instructions, and information on administrative tasks. To access the
installation and configuration information from within the CMS Installation
Wizard, click any help button. To view the HTML version of this guide, open
this file: <server_root>/manual/en/cert/setup_guide/contents.htm
• CMS Plug-Ins Guide
Provides detailed reference information on CMS plug-ins for authentication,
policy, publishing, and so on. To access this information from the CMS
window within Netscape Console, click any help button. To view the HTML
version of this guide, open this file:
<server_root>/manual/en/cert/plugin_guide/contents.htm
• CMS Command-Line Tools Guide
Provides detailed reference information on CMS tools. To view the HTML
version of this guide, open this file:
<server_root>/manual/en/cert/tools_guide/contents.htm
• CMS Customization Guide
Provides detailed reference information on customizing the HTML-based
agent and end-entity interfaces. To view the HTML version of this guide, open
this file: <server_root>/manual/en/cert/custom_guide/contents.htm

Where to Go for Related Information
About This Guide 9
•CMS Agent’s Guide (this guide)
Provides detailed reference information on CMS agent interfaces. To access
this information from the Agent Services pages, click any help button. To view
the HTML version of this guide, open this file:
<server_root>/cert-<instance_id>/web-apps/agent/manual/
agent_guide/contents.htm
•End-EntityHelp
Provides detailed reference information on CMS End-Entity Services interface.
Users can access this guide by clicking any help button in the end user pages.
To view the HTML version of this guide, open this file:
<server_root>/cert-<instance_id>/web-apps/ee/manual/ee_guide/
contents.htm
For a complete list of CMS documentation, open this file:
<server_root>/manual/index.html.(Youwillnotbeabletoaccessthe
index.html file and the files specified above if you don’t have access to the
machine on which Certificate Management System is installed.)
For the latest information about Certificate Management System, check the CMS
Release Notes and other documents available at this site:
http://enterprise.netscape.com/docs/cms/index.html
NOTE You will not be able to access the files and directories specified
above if you don’t have access to the machine on which Certificate
Management System is installed.

WheretoGoforRelatedInformation
10 Netscape Certificate Management System Agent’s Guide • March 2002

11
Chapter 1
Agent Services
This chapter describes the role of the privileged users called agents in managing
Netscape Certificate Management System (CMS). It also introduces the tools that
agents use to administer service requests.
The chapter has the following sections:
• Overview of Certificate Management System (page 11)
• Agent Tasks (page 15)
• Forms for Performing Agent Operations (page 20)
• Accessing Agent Services (page 23)
Overview of Certificate Management System
Certificate Management System is a highly configurable set of software
components and tools for creating, deploying, and managing certificates. The
standards and services that facilitate the use of public-key cryptography and X.509
version 3 certificates in a networked environment are collectively called the public
key infrastructure (PKI) for that environment. In any PKI, a certificate authority (CA)
is a trusted entity that issues, renews, and revokes certificates. An end entity is a
person, router, server, or other entity that uses a certificate to identify itself.
To participate in a PKI, an end entity must enroll, or register, in the system. The end
entity typically initiates enrollment by giving the CA some form of identification
and a newly generated public key. The CA uses the information provided to
authenticate, or confirm, the identity; it then issues the end entity a certificate that
associates that identity with the public key, and signs the certificate with the CA’s
own private signing key.

Overview of Certificate Management System
12 Netscape Certificate Management System Agent’s Guide • March 2002
End entities and CAs may be in different geographic or organizational areas or in
completely different organizations. CAs may include third parties that provide
services through the Internet as well as the root CAs and subordinate CAs for
individual organizations. Policies and certificate content may vary from one
organization to another. End-entity enrollment for some certificates may require
physical verification, such as an interview or notarized documents, while
enrollment for others may be fully automated.
To meet the widest possible range of configuration requirements, Certificate
Management System permits the independent installation of four separate
subsystems, or “managers,” that typically play distinct roles:
•Certificate Manager—A Certificate Manager functions as a root or subordinate
certificate authority. This subsystem issues, renews, and revokes certificates,
generates certificate revocation lists (CRLs). It can publish certificates to a
Lightweight Directory Access Protocol (LDAP) directory and files, and CRLs to
an LDAP directory, a file, and an Online Certificate Status Protocol (OCSP)
responder. The Certificate Manager can be configured to accept requests from
end entities, Registration Managers, or both, and can process requests either
manually (that is, with the aid of a human being) or automatically (based
entirely on customizable policies and procedures). When set up to work with a
Registration Manager, the Certificate Manager processes requests and returns
the signed certificates to the Registration Manager for distribution to the end
entities. (For an overview of the role of certificate authorities and related
concepts of public-key cryptography, see Appendix D of Managing Servers with
Netscape Console.)
Note that the publishing tasks can be performed by the Certificate Manager
only. The Certificate Manager also has a built-in OCSP service, enabling
OCSP-compliant clients to directly query the Certificate Manager about the
revocation status of a certificate that it has issued. In certain PKI deployments,
it might be convenient to use the Certificate Manager’s built-in OCSP service,
instead of a Online Certificate Status Manager.
•Registration Manager—A Registration Manager is an optional component in
the PKI and can be used to separate the registration process from the
certificate-signing process. The Registration Manager performs a subset of the
end-entity tasks performed by the Certificate Manager, such as enrollment or
renewal, on behalf of the Certificate Manager. A Registration Manager is
typically installed on a different machine from the Certificate Manager that it
serves. After the Registration Manager approves requests, it forwards them to
this Certificate Manager, which trusts the Registration Manager to provide

Overview of Certificate Management System
Chapter 1 Agent Services 13
reliable authentication services and therefore trusts any signed requests it
submits. The Certificate Manager processes the requests and issues the
certificates. The Registration Manager then distributes the certificates to the
end entities.
•Data Recovery Manager—A Data Recovery Manager oversees the long-term
archival and recovery of private encryption keys for end entities. A Certificate
Manager or Registration Manager can be configured to archive end entities’
private encryption keys with a Data Recovery Manager as part of the process
of issuing new certificates. The Data Recovery Manager is useful only if end
entities are encrypting data (using applications such as S/MIME email) that
the organization may need to recover someday. It can be used only with client
software that supports dual key pairs—that is, two separate key pairs, one for
encryption and one for digital signatures. This service is available in newer
clients only; for example, Communicator versions 4.7x (with Netscape Personal
Security Manager installed) and Netscape 6 support generation of dual key
pairs. The Data Recovery Manager archives encryption keys. It does not
archive signing keys, since such archival would undermine nonrepudiation
properties of dual-key certificates.
•Online Certificate Status Manager—A Online Certificate Status Manager
performs the task of an online certificate validation authority, by enabling
OCSP-compliant clients to do real-time verification of certificates. The Online
Certificate Status Manager can receive CRLs from multiple Certificate
Managers and clients can query the Online Certificate Status Manager for the
revocation status of certificates issued by all these Certificate Managers. For
example, in a PKI comprising multiple CAs (a root CA and many subordinate
CAs) each CA can be configured to publish its CRL to the Online Certificate
Status Manager. This way, all clients in the PKI deployment can verify the
revocation status of a certificate by querying the Online Certificate Status
Manager.
Note that an online certificate-validation authority is often referred to as OCSP
responder.
Since CAs can delegate some responsibilities to subordinate CAs, a Certificate
Manager might delegate responsibilities to one or more levels of subordinate
Certificate Managers, and each Certificate Manager can interact with multiple
Registration Managers. Therefore many complex variations are possible.
Three kinds of entities can access CMS subsystems: administrators, agents, and end
entities. Administrators are responsible for the initial setup and ongoing
maintenance of the subsystems. Administrators can designate users with special
privileges, called agents, for each subsystem. Agents manage day-to-day
interactions with end entities (people, SSL-enabled servers, routers, and so on) and

Overview of Certificate Management System
14 Netscape Certificate Management System Agent’s Guide • March 2002
other aspects of the PKI. This guide describes the tasks that agents can perform.
End entities access Registration Manager or Certificate Manager subsystems to
enroll in a PKI and to take part in other life-cycle management operations, such as
renewal or revocation.
Figure 1-1 shows the ports used by administrators, agents, and end entities. All
agent and administrator interactions with CMS subsystems occur over HTTPS.
End-entity interactions can take place over HTTP or HTTPS.
Figure 1-1 Certificate Management System and its users

Agent Tasks
Chapter 1 Agent Services 15
Agent Tasks
The designated agents for each subsystem are responsible for the everyday
management of end-entity requests and other aspects of the PKI:
• Certificate Manager agents manage certificate requests received by the
Certificate Manager subsystem, maintain and revoke certificates as necessary,
and maintain global information about certificates.
• Registration Manager agents manage the certificate requests received by the
Registration Manager subsystem.
• Data Recovery Manager agents initiate the recovery of lost keys, and can
obtain information about key service requests and archived keys.
• Online Certificate Status Manager agents can perform tasks such as checking
which CAs are currently configured to publish their CRLs to the Online
Certificate Status Manager, identifying a Certificate Manager to the Online
Certificate Status Manager, adding CRLs directly to the Online Certificate
Status Manager, and viewing the status of OCSP service requests submitted by
OCSP-compliant clients.
To perform the privileged operations of an agent, you use the CMS Agent Services
pages. To access these pages, you must have a personal SSL client certificate, and
theCMSadministratormusthaveidentifiedyouasaprivilegeduserintheuser
database. For more information on how to get set up as a privileged user, see CMS
Installation and Setup Guide.
Certificate Manager Agent Services
The default entry page to the Certificate Manager agent services is shown in Figure
1-2. To access these pages, you must be a designated Certificate Manager agent and
your client software must have a valid certificate identifying you as such.

Agent Tasks
16 Netscape Certificate Management System Agent’s Guide • March 2002
Figure 1-2 Certificate Manager Agent Services page
As a Certificate Manager agent, you can perform the following tasks:
• Handle certificate requests.
You can list the certificate service requests received by the Certificate Manager
subsystem, assign requests to yourself, reject or cancel requests, and approve
requests for certificate enrollment. See Chapter 2, “Handling Certificate
Requests.”
• Clone requests.
You can clone any request, whether it’s still pending, canceled, rejected, or
completed. This can be useful in a variety of situations. For example, if a user
receives a certificate that doesn’t work because it has been incorrectly
formulated, you can locate the completed request, clone it, and correct it
without requiring the user to enroll a second time. Cloning a request gives it a
new request ID number and puts it into the list of pending requests, but does
not change the status of the original request.
• Find certificates.
You can search for individual certificates, or search for and list certificates by
various criteria, then display the details of certificates you have found. See
Chapter 3, “Finding and Revoking Certificates.”

Agent Tasks
Chapter 1 Agent Services 17
• Revoke certificates.
If a user’s key has been compromised, you need to revoke the user’s certificate
to ensure that the key is not misused. You may also need to revoke the
certificates of users who have left the organization. You can use Certificate
Manager Agent Services to find and revoke a specific certificate or a set of
certificates. Users can also revoke their own certificates. See “Revoking
Certificates” on page 51.
•UpdatetheCRL.
The Certificate Manager maintains a public list of certificates that have been
revoked, called the certificate revocation list (CRL). The list is usually
maintained automatically, but you may sometimes need to use the Certificate
Manager Agent Services page to update the list manually. See “Updating the
CRL” on page 56.
• Publish certificates to a directory.
You can set up Certificate Management System to publish certificates and lists
of revoked certificates in an LDAP directory. Certificate information is usually
published automatically, but you may sometimes need to use the Certificate
Manager Agent Services page to update the directory manually. See Chapter 4,
“Publishing to a Directory.”
Registration Manager Agent Services
The default entry page to the Registration Manager agent services is shown in
Figure 1-3. To access these pages, you must be a designated Registration Manager
agent and your client software must have a valid certificate identifying you as
such.

Agent Tasks
18 Netscape Certificate Management System Agent’s Guide • March 2002
Figure 1-3 Registration Manager Agent Services page
As a Registration Manager agent, you can handle certificate requests. You can list
the certificate service requests received by the Registration Manager subsystem,
assign requests to yourself, reject or cancel requests, clone requests, and approve
enrollment requests to be passed on to the Certificate Manager for issuance. See
Chapter 2, “Handling Certificate Requests.”
Data Recovery Manager Agent Services
The default entry page to the Data Recovery Manager agent services is shown in
Figure 1-4. To access these pages, you must be a designated Data Recovery
Manageragentandyourclientsoftwaremusthaveavalidcertificateidentifying
you as such.

Agent Tasks
Chapter 1 Agent Services 19
Figure 1-4 Data Recovery Manager Agent Services page
As a Data Recovery Manager agent, you can perform the following tasks:
• List key recovery requests from end entities.
• List or search for archived keys.
• Initiate the recovery of private data-encryption keys.
Key recovery requires the authorization of one or more recovery agents. The
administrator for the Data Recovery Manager designates recovery agents.
Typically, several recovery agents own portions of the storage key for the Data
Recovery Manager. The approval of mof a total of nagents is required to authorize
key recovery. The values of mand nfor your installation of the Data Recovery
Manager is determined by the administrator in charge of the subsystem.
For more information on these tasks, see Chapter 5, “Recovering Encrypted Data.”
Online Certificate Status Manager Agent
Services
The default entry page to the Online Certificate Status Manager agent services is
shown in Figure 1-5. To access these pages, you must be a designated Online
Certificate Status Manager agent and your client software must have a valid
certificate identifying you as such.

Forms for Performing Agent Operations
20 Netscape Certificate Management System Agent’s Guide • March 2002
Figure 1-5 Online Certificate Status Manager Agent Services page
As a Online Certificate Status Manager agent, you can perform the following tasks:
• Checking which CAs are currently configured to publish their CRLs to the
Online Certificate Status Manager.
• Identifying a Certificate Manager to the Online Certificate Status Manager.
• Adding CRLs directly to the Online Certificate Status Manager.
• Checking the revocation status of a certificate by submitting it to the Online
Certificate Status Manager.
For more information on these tasks, see Chapter 6, “Managing OCSP Service
Related Tasks.”
Forms for Performing Agent Operations
The agent services consist of a form-based HTML interface that is part of your
Certificate Management System installation. The CMS administrator designates
particular users as agents for each installed subsystem (Certificate Manager,
Registration Manager, Data Recovery Manager, and ). Only a designated agent for
a subsystem can use the Agent Services interface for that subsystem. In addition,
you must have a personal client SSL certificate to access the Agent Services
interface.