Netscape NETSCAPE MANAGEMENT SYSTEM 6.01 - AGENT... User manual

Agent’s Guide
Netscape Certificate Management System
Version6.01
May 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs
offered by Netscape (referred to herein as "Software") and related documentation. Use of the Software and related
documentation is governed by the license agreement for the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation
works is prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to
time without notice.
THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL
NETSCAPE BE LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND
ARISING FROM ANY ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR
INTERRUPTION OF BUSINESS, PROFITS, USE, OR DATA.
The Software and documentation are copyright © 2001 Sun Microsystems, Inc. Portions copyright 1999, 2002 Netscape
Communications Corporation. All rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States
and other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape
Communications Corporation, which may be registered in some countries. Other product and brand names are the exclusive
property of their respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in
full compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or
documentation to the U.S. government is with restricted rights as described in the license agreement for that Software.

3
Contents
AboutThisGuide............................................................... 5
WhatYouShouldAlreadyKnow ..........................................................5
What’sinThisGuide.....................................................................6
ConventionsUsedinThisGuide ..........................................................7
WheretoGoforRelatedInformation.......................................................8
Chapter 1 AgentServices ..................................................... 11
OverviewofCertificateManagementSystem...............................................11
AgentTasks ...........................................................................15
CertificateManagerAgentServices ....................................................15
RegistrationManagerAgentServices...................................................17
DataRecoveryManagerAgentServices.................................................18
OnlineCertificateStatusManagerAgentServices ........................................19
FormsforPerformingAgentOperations...................................................20
AccessingAgentServices................................................................23
Administrator/AgentCertificateEnrollment ............................................23
AgentServicesEntryPage ............................................................26
Services Summary Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Chapter 2 Handling Certificate Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
ManagingRequests.....................................................................27
ListingCertificateRequests ..............................................................30
SelectingaRequest...................................................................32
ApprovingRequests ....................................................................33
AssigningaRequest..................................................................34
Adjusting,Verifying,andApprovingaRequest..........................................34
SendinganIssuedCertificatetotheRequester ...........................................38

4 Netscape Certificate Management System Agent’s Guide • May 2002
Other Options for Handling Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Chapter 3 Finding and Revoking Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
BasicCertificateListing ................................................................. 43
AdvancedCertificateSearch............................................................. 45
ExaminingCertificates ............................................................... 50
RevokingCertificates ................................................................... 51
SearchingforCertificatestoRevoke.................................................... 51
RevokingOneorMoreCertificates..................................................... 52
RevokingOneCertificate .......................................................... 52
RevokingMultipleCertificates...................................................... 53
ConfirmingaRevocation .......................................................... 53
ManagingtheCertificateRevocationList.................................................. 55
ViewingorExaminingCRLs .......................................................... 55
UpdatingtheCRL ................................................................... 56
Chapter 4 PublishingtoaDirectory............................................. 59
WorkingwithaDirectoryServer ......................................................... 59
AutomaticDirectoryUpdates ......................................................... 59
ManualDirectoryUpdates............................................................ 60
UpdatingtheDirectorywithChanges..................................................... 60
Chapter 5 RecoveringEncryptedData........................................... 63
FindingandRecoveringKeys............................................................ 63
FindingArchivedKeys............................................................... 64
SelectingaKey...................................................................... 66
RecoveringKeys ....................................................................... 67
RemoteRecoveryAuthorization....................................................... 69
ViewingKeyServiceRequests ........................................................... 70
ListingKeyServiceRequests.......................................................... 71
SelectingaRequest .................................................................. 73
Chapter 6 Managing OCSP Service Related Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
ListingCAsIdentifiedbyOnlineCertificateStatusManager ................................. 75
IdentifyingaCAtoOnlineCertificateStatusManager ...................................... 76
AddingaCRLtoOnlineCertificateStatusManager ........................................ 78
CheckingtheRevocationStatusofaCertificate............................................. 79
Index ........................................................................ 81

5
About This Guide
This guide describes the Agent Services interface that Netscape Certificate
Management System (CMS) agent uses to administer a subsystem’s certificates and
keys.
This preface has the following sections:
• What You Should Already Know (page 5)
• What’s in This Guide (page 6)
• Conventions Used in This Guide (page 7)
• Where to Go for Related Information (page 8)
What You Should Already Know
This guide is intended for Certificate Management System agents—that is,
privileged users designated by the Certificate Management System administrator
to manage requests from end entities for certificate-related services. Each installed
CMS manager (Certificate Manager, Registration Manager, Data Recovery
Manager, and Online Certificate Status Manager) can have one or more agents.
Server administrators should refer to the CMS Installation and Setup Guide for
information on how to designate agents and assign agent privileges to users and
groups.
Before reading this guide, you should be familiar with the basic concepts of
public-key cryptography and the Secure Sockets Layer (SSL) protocol. These
include the following topics:
• Encryption and decryption
• Public keys, private keys, and symmetric keys

What’s in This Guide
6 Netscape Certificate Management System Agent’s Guide • May 2002
• Digital signatures
• The role of digital certificates in a public-key infrastructure (PKI)
• Certificate hierarchies
• SSL cipher suites
• The purpose of and major steps in the SSL handshake
For overviews of these topics, see the security-related appendixes of Managing
Servers with Netscape Console;see“Where to Go for Related Information,” on page 8.
What’s in This Guide
This guide describes the duties of the agents for the various CMS subsystems and
explains how to accomplish each task.
• Chapter 1, “Agent Services” provides an overview of the product and
identifies the different kinds of users, including agents. The chapter also
summarizes the tasks of each subsystem agent and lists the HTML forms you
use to perform agent tasks. Finally, the chapter explains how to access the
Agent Services pages and forms.
• As a Certificate Manager or Registration Manager agent, you are responsible
for handling requests for certificates that are made by end entities (end users,
server administrators, or other CMS subsystems) using manual enrollment.
Chapter 2, “Handling Certificate Requests” describes the general procedure for
handling requests and explains how to handle different aspects of certificate
request management.
• Chapter 3, “Finding and Revoking Certificates” explains how, as a Certificate
Manager agent, you can use the Agent Services page to find and examine a
specific certificate issued by Certificate Management System, or retrieve a list
of certificates that match specified criteria. This chapter also explains how to
revoke certificates, and manage the certificate revocation list.
• Chapter 4, “Publishing to a Directory” describes how a Certificate Manager
agent can update the LDAP directory with the current status of certificates.
• Chapter 5, “Recovering Encrypted Data” describes how to process key
recovery requests, and how to recover stored encrypted data when the
encryption key has been lost. This service is only available when the Data
Recovery Manager is installed.

Conventions Used in This Guide
About This Guide 7
• Chapter 6, “Managing OCSP Service Related Tasks” describes how to handle
tasks related to the CMS OCSP responder, Online Certificate Status Manager.
This service is only available when the Online Certificate Status Manager
subsystem is installed.
Conventions Used in This Guide
This guide uses the following conventions:
•Monospaced font—This typeface is used for text that is an executable part of a
program or text that you type. It’s also used for filenames, directory names,
and URLs.
•Italic—Italic type is used for emphasis, book titles, and to introduce new or
glossary terms.
• Text within “quotation marks”—Indicates cross-references to other topics
within this guide.
•Squarebrackets
[]—Square brackets enclose commands that are optional.
•Anglebrackets
<>—Angle brackets indicate placeholders for items that vary,
such as pathnames and variable names. Replace the angle brackets and their
text with text that applies to your situation.
•Forwardslash
/—A slash is used to separate directories in a path. (Note that
the Windows NT operating system supports both the slash and the backslash.)
• Sidebar text—Sidebar text marks important information. Make sure you read
the information before continuing with a task.
In addition, the following conventions are used for important notes.
NOTE You can access the Agent Services only if you have a valid agent
certificate.
CAUTION A caution note documents a potential risk of losing data, damaging
software or hardware, or otherwise disrupting system performance.

WheretoGoforRelatedInformation
8 Netscape Certificate Management System Agent’s Guide • May 2002
Where to Go for Related Information
This section summarizes the documentation that ships with Certificate
Management System, using these conventions:
•<server_root> is the directory where the CMS binaries are kept (specified
during installation).
•<instance_id> is the ID for this instance of Certificate Management System
(specified during installation).
The documentation set for Certificate Management System includes the following:
• Managing Servers with Netscape Console
Provides background information on basic cryptography concepts and the role
of Netscape Console. To view the HTML version of this guide, open this file:
<server_root>/manual/en/admin/ag/contents.htm
• CMS Installation and Setup Guide
Provides detailed information on deployment options for Certificate
Management System, a walk-through of a test or demo installation, complete
installation instructions, and information on administrative tasks. To access the
installation and configuration information from within the CMS Installation
Wizard, click any help button. To view the HTML version of this guide, open
this file: <server_root>/manual/en/cert/setup_guide/contents.htm
• CMS Plug-Ins Guide
Provides detailed reference information on CMS plug-ins for authentication,
policy, publishing, and so on. To access this information from the CMS
window within Netscape Console, click any help button. To view the HTML
version of this guide, open this file:
<server_root>/manual/en/cert/plugin_guide/contents.htm
• CMS Command-Line Tools Guide
Provides detailed reference information on CMS tools. To view the HTML
version of this guide, open this file:
<server_root>/manual/en/cert/tools_guide/contents.htm
• CMS Customization Guide
Provides detailed reference information on customizing the HTML-based
agent and end-entity interfaces. To view the HTML version of this guide, open
this file: <server_root>/manual/en/cert/custom_guide/contents.htm

Where to Go for Related Information
About This Guide 9
•CMS Agent’s Guide (this guide)
Provides detailed reference information on CMS agent interfaces. To access
this information from the Agent Services pages, click any help button. To view
the HTML version of this guide, open this file:
<server_root>/cert-<instance_id>/web-apps/agent/manual/
agent_guide/contents.htm
•End-EntityHelp
Provides detailed reference information on CMS End-Entity Services interface.
Users can access this guide by clicking any help button in the end user pages.
To view the HTML version of this guide, open this file:
<server_root>/cert-<instance_id>/web-apps/ee/manual/ee_guide/
contents.htm
For a complete list of CMS documentation, open this file:
<server_root>/manual/index.html.(Youwillnotbeabletoaccessthe
index.html file and the files specified above if you don’t have access to the
machine on which Certificate Management System is installed.)
For the latest information about Certificate Management System, check the CMS
Release Notes and other documents available at this site:
http://enterprise.netscape.com/docs/cms/index.html
NOTE You will not be able to access the files and directories specified
above if you don’t have access to the machine on which Certificate
Management System is installed.

WheretoGoforRelatedInformation
10 Netscape Certificate Management System Agent’s Guide • May 2002